Uploaded September 2025 | Updated September 2026, 2 weeks ago
00:00 - Introduction
01:00 - Start of nmap
02:40 - Using gobuster to discover the VHOST and running into a minor issue, I think gobuster changed how it handles the domain on VHOST Scans.
06:00 - Looking at the Nuclei Results
09:40 - Using the append-domain (ad) flag in gobuster to allow our VHOST scan to work and discovering the Grafana subdomain
12:00 - Discovering Grafana is running 11.0.0 and searching CVE's
13:40 - Finding CVE-2024-9264, and running it to get a shell on the Grafana docker container
21:00 - Looking at the env variables, discovering a credential that works to SSH into the box
25:50 - Looking at the crontab.db file, discovering a password
27:50 - Forwarding localhost:8000 back to us, so we can hit crontab-ui and logging in and creating a malicious cron to get root
29:35 - Showcasing FFUF to bruteforce HTTP Login by using bashful to append a string to our fuzz list and also use an encoder to b64 encode
00:00 - Introduction
01:00 - Start of nmap
02:40 - Using gobuster to discover the VHOST and running into a minor issue, I think gobuster changed how it handles the domain on VHOST Scans.
06:00 - Looking at the Nuclei Results
09:40 - Using the append-domain (ad) flag in gobuster to allow our VHOST scan to work and discovering the Grafana subdomain
12:00 - Discovering Grafana is running 11.0.0 and searching CVE's
13:40 - Finding CVE-2024-9264, and running it to get a shell on the Grafana docker container
21:00 - Looking at the env variables, discovering a credential that works to SSH into the box
25:50 - Looking at the crontab.db file, discovering a password
27:50 - Forwarding localhost:8000 back to us, so we can hit crontab-ui and logging in and creating a malicious cron to get root
29:35 - Showcasing FFUF to bruteforce HTTP Login by using bashful to append a string to our fuzz list and also use an encoder to b64 encode
