HackTheBox - Devzat

00:00 - Intro 01:15 - Start of nmap 03:00 - Poking at the SSH Chat Application 05:10 - Running a VHOST Scan and discovering pets.devzat.htb 08:30 - Discovering pets.devzat.htb doesn't have a 404 and is a golang webserver 10:55 - Fuzzing the user input on pets 14:10 - Webapp ignores when a semicolon is at the end of user input, indication to command injection [MasterRecon] 16:20 - Using Gobuster to discover the .git directory and working around the issue of the box having no 404 errors. Use git-dumper to extract. 19:00 - Doing some light source code analysis on the Go Binary 23:15 - Showing it is also an LFI Vulnerability, just incase command injection was patched 29:00 - Reverse shell returned, examining the git log of the files, don't see anything interesting 30:50 - Discovering from localhost we can login to chat as anyone, but messages are hidden on Reverse Shells. Switch to SSH and read the messages. 36:40 - Looking for an InfluxDB vulnerability via exploit-db, changelog, and synk 39:40 - Going to git, and pulling up the issue created for this issue so we can understand how to exploit it 41:30 - Using JWT.IO to create a token with a blank signature 45:20 - Testing our authentication bypass with curl, then creating a bash script to make it a bit easier for us to run queries. 47:00 - Using the HTTP API of InfluxDB to show databses, tables, and dump data to get catherines password 53:20 - Using the find command to find files owned by catherine, to find a backup of the dev source code 55:40 - Finding all the files that differ between two directories via find, md5sum, and grep 59:00 - Discovering the hard coded password required for the FILE command in the new devzat application 1:00:40 - Grabbing roots SSH Key via an LFI in the FILE Command