HackTheBox - Phoenix

00:00 - Intro 01:00 - Start of nmap 02:22 - Taking a look at the SSL Certificates and website to find blog/forum 04:57 - Running WPScan, explaining why i like aggressive scanning 09:00 - Finding public vulnerability in Asgaros Forms (Blind Time Based SQLi) 10:45 - Running SQLMap to confirm the injection 21:00 - Examining the Wordpress Database structure, so we can run SQLMap to dump very specific things 25:20 - Cracking wordpress credentials to find out we can’t use any because of MFA 30:10 - Using our SQL Injection to dump a list of activated plugins in wordpress 32:00 - Finding an exploit in the Download From Files plugin, converting it to ignore SSL Validation Errors 35:45 - Uploading a malicious phtml (php) file to get a shell on the box 41:00 - Examining how MFA is enabled on SSH/SU by looking at PAM files 42:10 - Discovering the network can bypass MFA, which our host is on. 45:10 - Using find to show files created between two dates 48:20 - Discov