HackTheBox - Gofer

00:00 - Introduction 01:00 - Start of nmap 03:40 - Running gobuster to discover the subdomain 05:20 - Enumerating SMB to find a note which gives an email address to send a malicious document to and hints at HTTP Methods being filtered 08:45 - Discovering the domain responds differently to POST vs GET requests, then gobustering setting our method to POST 11:55 - Finding a SSRF in the proxy, then playing with protocols to discover it accepts GOPHER requests 16:40 - Showing we can get around the localhost/ blacklist by encoding the IP Address in HEX, then showing why gopher requests are cool 21:30 - Sending a SMTP Request via gopher to send an email with a link to a malicious file 27:55 - Making a ODT Document with a macro that executes on-open and sends a shell 34:50 - shell as jhudson 36:30 - Going over LinPEAS, discovering TCPDump has capabilities to allow any user to capture packets 44:40 - Opening the capture in Wireshark and showing