HackTheBox - Sea

00:00 - Introduction
00:40 - Start of nmap
03:40 - Trying to identify what is running the webapp (WonderCMS), discovering a themes directory in source and burpsuite
04:36 - Taking a string that looks unique in the CSS and searching GitHub to discover where it exists in an open-source repo
05:45 - Showing several ways we could of dirbusted the themes directory to discover this file
08:45 - Discovering a public POC for the XSS Attack
14:07 - Showing the pathname is not being set correctly in the public poc, fixing it then getting a callback
18:50 - We see the webserver downloaded our shell but the poc didn't send it to us directly, manually triggering the callback
21:00 - Extracting the WonderCMS Password and cracking it
24:48 - Discovering a few ports listening on localhost, checking /etc to try and figure out the service listening on 8080
26:00 - Forwarding port 8080 back to our box, then discovering a webapp that has a command injection flaw
31:40 - Discovering our shell dies quickly, adding a nohup to our reverse shell to make it more stable
34:00 - Showing why our reverse shell is not stable, it hangs the webserver which causes it to restart
37:30 - Showing an alternate way to getting the shell, just editing sudoers file to add our user (we could also add a cron to send a reverse shell, ssh key, etc)
40:10 - Going over the XSS, showing the Reflective Injection and why it only triggers from admin
43:50 - Manually exploiting this XSS by writing our own javascript to install the theme
55:20 - Showing we could have just stolen PHPSESSID, then we can use our browser to install the module instead of performing a CSRF attack to do it