HackTheBox - Unobtainium

00:00 - Intro 01:10 - Start of nmap 05:00 - Downloading and installing the deb package with dpkg, then fixing the host file 06:35 - Running wireshark when examining the unobtainium application then examining the HTTP Requests 09:25 - Proxying the unobtainium app through Burpsuite by creating a new proxy listener and updating the host file 10:40 - Playing with the LFI on /todo and discovering we can only cause errors or include files in the local directory 12:30 - Using FFUF to attempt to find other JS Files with this LFI 14:50 - Copying the source code and looking for vulnerabilities 15:50 - Discovering hard coded credentials, examining the administrator password to see there would be too much entropy to bruteforce 17:45 - Analyzing the upload functionality to discover an RCE if we can upload 19:40 - Discovering a merge command and looking up Prototype Pollution to potentially update our user object with the upload permission 23:55 - Giving ourself the Upload Functionality then performing the RCE in Upload 25:53 - Ping works, now lets get a reverse shell 28:15 - Reverse shell returned, confirming we are in kubernetes downloading peirates and kubectl 32:49 - Using kubectl to do basic enumeration of kubernetes, switching our namespace then listing pods 36:15 - Demonstrating Peirates which makes the enumeration of kubernetes easier by providing a menu to list/switch namespaces and get pods 38:15 - Exploiting the same application in dev which gets us a different kubernetes token 41:15 - Doing the enumeration with kubectl again but this time we can utilize the Kube-System namespace to list secrets and taking an admin token 43:45 - Using our stolen token and discovering we can create pods using kubectl auth can-i create pods -n kube-system -token=(token) 44:22 - Explaining the attack we are about to do to create a pod with host disk mounted in the pod, then doing it in Peirates 47:00 - Looking at the Peirates source code to see how the attack works 48:55 - Doing the attack manually with kubectl 52:55 - The malicious pod is created now lets go into it and look at the root disk