HackTheBox - SneakyMailer

00:00 - Intro 00:45 - Start of nmap 03:10 - Poking a the websites 04:20 - Starting gobusters in the background while we look at the site 07:00 - Grabbing a list of emails off of the website 08:40 - Using SWAKS to mass email users with a link 14:45 - User went to our website, grabbed credentials 17:50 - Failing to do FTP User Enumeration, do this at the end of the video 19:00 - Failing with Thunderbird to login 22:30 - Switching to the Evolution Mail client to check mailboxes, finding FTP Details in Sent Mail 28:40 - Using wget to mirror the FTP Directory, then poking at PHP Files 30:50 - Showing pypi/, which *should* have been used during the phishing stage 31:30 - Checking if we can upload files to the FTP Directory and finding the dev VHOST 35:00 - Shell Returned 37:00 - Discovering a HTPASSWD file, then cracking it with hashcat 39:50 - Checking out and finding a pypi server 41:00 - Creating a Malicious PyPi Package 43: