HackTheBox RegistryTwo

Video Description

00:00 - Intro 01:00 - Start of nmap 03:10 - Enumerating port 5000/5001 to see a Docker Registry and Auth Server 06:10 - Creating our auth token for the Docker Registry 08:45 - Adding the SSL Cert to our certificate store, then doing a docker pull to download and run the container 13:00 - Discovering JSESSIONID Cookie, attempting the weird directory traversal bug of /..;/ (nginx directory didn't have a trailing slash on the location) 16:45 - The Examples directory has a sessions example that lets us modify the session, doing this to get a File Disclosure vulnerability then downloading the WAR file hosting the app 27:45 - Opening the WAR in JD-GUI then examining the source code, discovering we can change our user to admin by editing the session 33:30 - Pointing the RMI.HOST back to us, then use YSOSERIAL to host a malicious server 42:50 - YSOSERIAL-MODIFIED Docker is up, using YSOSERIAL to start a JRMP Listener and host a malicious payload 46:45 - Shell on the container, showing where IPv6 addresses are stored (/proc/if_inet6) and that we could have gotten this with the file disclosure which allows for bypassing the firewall, did not need to do the ysoserial step for this next one. 52:51 - Looking at the source code again, discovering we can use the RMI to perform file operations on the host 56:00 - Start of creating the RMI Client Java App 1:09:18 - Running into an error using our decompiled code. Having our exploit just reference the class files (before decompilation) 1:25:00 - Finishing up our exploit script, then writing an SSH Key 1:36:60 - Looking at running processes, discovering the RMI Server restarts every 3 minutes, then running PSPY discovering a quarentine.jar 1:43:00 - Looking at the initial JAR again, discovering it will give out a config. Using RECAF so I can just replace code in the jar without recompiling 1:48:00 - Looking at the Quarantine Service, which pulls a config from the RMI Server then runs CLAM AV 1:51:40 - Having CLAM AV scan /root, and flag every file as a virus sending it to /dev/shm