HackTheBox - Passage

00:00 - Intro
01:10 - Start of nmap
02:10 - Identifying this is likely Ubuntu Xenial
03:30 - Attempting basic SQL Map
05:20 - Failing to find a way to enumerate CuteNews version
06:55 - Looking over an exploit script from SearchSploit
08:15 - Finding there is a page that exposes a bunch of user hashes... wat?
10:20 - Copying a bunch of PHP Blobs, then using grep to only show us the hashes
11:50 - Going back to looking over the exploit script
14:00 - Sent the exploit script through burpsuite and looking at each request
15:45 - Getting a reverse shell and fixing out TTY
19:00 - Searching CuteNews PHP Files for passwords
20:35 - Decoding the php files within the users directory to get password hashes
20:50 - Writing a nasty bash one liner to go over all the files and output the base64, then use grep to only show what we want to get hashes
23:00 - Using Hash Identifier to get an idea what the hash is, then using CrackStation to quickly crack
26:15 - The Cred we decrypted was for John, using SU to switch to the john user
27:00 - Oddly enough the SSH Public key is John's directly wasn't generated by him... Validating that is the public key to the private key
30:00 - Using Nadav's key to SSH into the box
31:48 - Exploring VIMINFO to see some forensics on what this user has done
34:14 - Looking for USBCreator Privesc's
37:00 - Running the GDBus command to copy files and get root.