Hack The Box Ready

00:00 Intro 01:20 Start of nmap discovering gitlab 02:30 Registering for an account, then finding the version 04:30 Searching the GitLab commit history to see the patch changing how localhost is verified 07:20 Using the import repo from URL feature to force the server to make a request 09:10 Attempting SSRF Attacks with Gopher 11:50 Successfully got the server to connect back using git with line breaks 13:00 Finding a gitlab RCE Path from SSRF using Redis 15:50 Failing to gttempting to get RCE 20:30 Ping isn t working, trying Whoami with NC 24:00 Finally get RCE with whoami and putting a space at the end of our payload 26:20 Attempting to get a Reverse Shell 29:40 Using CyberChef to get rid of the plus in our base64 paylaod 33:00 Reverse Shell Returned 37:00 DeepCE didn t give us much, running linPEAS again 40:15 Finding the SMTP Password in a backup which is the root password 41:40 Mounting the hosts disk to get root