Mar 11, 2024, 06:41 AM
Here is the video link for the walkthrough https://youtu.be/e4g3_cNU6do
Exploit Path:
1. Exploit XSS on contact us to discover hidden subdomain
2. Exploit RCE on version of service running on discovered subdomain
3. Once you gain initial foothold, you dump hashes on mongodb and successfully crack frank_dorky pass hash
4. Create SSH tunnel to access service running on localhost 3000
5. Create an alert to trigger RCE and gain another user access level.
6. Check env variable to retrieve credentials for another user with sudo privilege
7. Exploit another RCE to gain root.
Exploit Path:
1. Exploit XSS on contact us to discover hidden subdomain
2. Exploit RCE on version of service running on discovered subdomain
3. Once you gain initial foothold, you dump hashes on mongodb and successfully crack frank_dorky pass hash
4. Create SSH tunnel to access service running on localhost 3000
5. Create an alert to trigger RCE and gain another user access level.
6. Check env variable to retrieve credentials for another user with sudo privilege
7. Exploit another RCE to gain root.