HackTheBox - Passage

00:00 - Intro 01:10 - Start of nmap 02:10 - Identifying this is likely Ubuntu Xenial 03:30 - Attempting basic SQL Map 05:20 - Failing to find a way to enumerate CuteNews version 06:55 - Looking over an exploit script from SearchSploit 08:15 - Finding there is a page that exposes a bunch of user hashes... wat? 10:20 - Copying a bunch of PHP Blobs, then using grep to only show us the hashes 11:50 - Going back to looking over the exploit script 14:00 - Sent the exploit script through burpsuite and looking at each request 15:45 - Getting a reverse shell and fixing out TTY 19:00 - Searching CuteNews PHP Files for passwords 20:35 - Decoding the php files within the users directory to get password hashes 20:50 - Writing a nasty bash one liner to go over all the files and output the base64, then use grep to only show what we want to get hashes 23:00 - Using Hash Identifier to get an idea what the hash is, then using CrackStation to quickly crack 26:15 - The Cred we decrypted was for John, using SU to switch to the john user 27:00 - Oddly enough the SSH Public key is John's directly wasn't generated by him... Validating that is the public key to the private key 30:00 - Using Nadav's key to SSH into the box 31:48 - Exploring VIMINFO to see some forensics on what this user has done 34:14 - Looking for USBCreator Privesc's 37:00 - Running the GDBus command to copy files and get root.