HackTheBox - Unobtainium

00:00 - Intro
01:10 - Start of nmap
05:00 - Downloading and installing the deb package with dpkg, then fixing the host file
06:35 - Running wireshark when examining the unobtainium application then examining the HTTP Requests
09:25 - Proxying the unobtainium app through Burpsuite by creating a new proxy listener and updating the host file
10:40 - Playing with the LFI on /todo and discovering we can only cause errors or include files in the local directory
12:30 - Using FFUF to attempt to find other JS Files with this LFI
14:50 - Copying the index.js source code and looking for vulnerabilities
15:50 - Discovering hard coded credentials, examining the administrator password to see there would be too much entropy to bruteforce
17:45 - Analyzing the upload functionality to discover an RCE if we can upload
19:40 - Discovering a merge command and looking up Prototype Pollution to potentially update our user object with the upload permission
23:55 - Giving ourself the Upload Functionality then performing the RCE in Upload
25:53 - Ping works, now lets get a reverse shell
28:15 - Reverse shell returned, confirming we are in kubernetes downloading peirates and kubectl
32:49 - Using kubectl to do basic enumeration of kubernetes, switching our namespace then listing pods
36:15 - Demonstrating Peirates which makes the enumeration of kubernetes easier by providing a menu to list/switch namespaces and get pods
38:15 - Exploiting the same application in dev which gets us a different kubernetes token
41:15 - Doing the enumeration with kubectl again but this time we can utilize the Kube-System namespace to list secrets and taking an admin token
43:45 - Using our stolen token and discovering we can create pods using kubectl auth can-i create pods -n kube-system -token=(token)
44:22 - Explaining the attack we are about to do to create a pod with host disk mounted in the pod, then doing it in Peirates
47:00 - Looking at the Peirates source code to see how the attack works
48:55 - Doing the attack manually with kubectl
52:55 - The malicious pod is created now lets go into it and look at the root disk