HackTheBox - Pollution

00:00 - Introduction
01:03 - Start of nmap
02:00 - Checking out the site, discovering an email (collect.htb) and setting up gobuster
06:00 - Discovering forum.collect.htb which is running MyBB, someone uploaded a Burp history file which contains API Information
09:30 - Manually examining the BurpSuite Backup File, and discovering it contains full HTTP Requests
12:12 - Sending a POST Request to /set/role/admin with the secret token
12:50 - The Admin Page has a separate registration forum, which sends an XML Request. Trying XXE and discovering Blind XXE
19:30 - Using my Blind XXE Script to make exfiltrating files quicker
23:20 - Trying to extract the Apache Configuration, getting the developers.collect.htb.conf file and then getting/cracking the htpasswd file
25:50 - Logging into developers.collect.htb, cannot login, going back to the Blind XXE getting source code and finding Redis Creds
28:50 - Enumerating Redis, seeing PHP Sessions, and changing our cookie to say we are an admin
36:50 - Using the PHP Filter Chain to get code execution on this include() which leads to a shell
44:20 - Looking at listening ports, seeing a few things on localhost. PHP FPM is listening on 9000, injecting code with fcgi.py into that and getting shell as Victor
52:45 - Grabbing the Pollution_API Source Code (listening on port 3000), then using Snyk to look for vulnerabilities
55:30 - Seeing where Lodash is used and talking about Prototype Pollution
59:30 - Logging into the API
1:02:00 - Our user is not an admin, logging into the MySQL Database and changing our role to admin
1:05:00 - Testing our ability to send messages
1:06:09 - Using Javscript Prototype pollution to set SHELL to a local file we created, which the exec() call uses and getting root.
1:07:00 - Doing this exploit without the need to drop a file by setting SHELL to /proc/self/exe