HackTheBox - Luke

00:40 - Begin of Recon 02:45 - Checking FTP to get a note 03:38 - Going to each of the three websites 04:30 - Running Gobuster on port 80/3000 06:30 - Taking notes of all the login pages (forgot Ajenti) 07:55 - found which has a password 10:15 - Discovering /login on port 3000 accepts username=&password= 11:25 - Successful login! JWT Token returned 14:00 - Using curl to add the JWT Token in the header to access other api endpoints 15:10 - Using BurpSuite to add headers 18:30 - Navigating the Rest API to dump the usernames and passwords 20:30 - Attempting logins on other services 21:30 - Derry can login to /management 22:50 - Ajenti Password! Lets try logging in 22:30 - Ajenti has a virtual terminal that is running as root! 26:20 - Extra Content - Getting a reverse shell 28:30 - Grabbing the JWT Secret, so we can forge our own tokens! 29:10 - Creating a python script to generate JWT Tokens 30:20 - This token has no expiration