TryHackMe - The Marketplace (Medium) - Live Walkthrough

0:00 - Introduction
0:20 - Starting The Marketplace
01:49 - Scanning with AutoRecon, finding a web server
05:10 - Attempting SQL injection against the login.
08:06 - Attempting username enumeration against the login, encountering errors.
11:57 - Trying to use the disabled file upload functionality, getting nothing.
14:22 - Playing with the JWT.
18:51 - Sending an XSS payload to the admin.
21:39 - Realising I had tmux copy mode turned on which didn't update the log.
22:32 - Sending an XSS payload to steal the admin's cookie.
24:39 - Finding a MySQL injection and using UNION to extract some data.
29:55 - Extracting username / password hashes from the database.
35:22 - Attempting to crack the password hashes but getting nowhere.
38:51 - Realizing I never checked for a messages table...
39:43 - Realizing I had enumerated a messages table all along.
40:45 - Finding a password in the messages, attempting to login using SSH.
42:22 - Logging in as jake, getting a flag.
44:20 - Finding a tar wildcard privesc exploit!
55:04 - Privilege escalation to the michael user.
1:05:09 - Getting a more stable shell as michael, realizing he's in the docker group.
1:07:30 - Mounting / in a docker container and escalating to root.
1:08:12 - Explaining the docker privesc.
1:14:13 - Accidentally overwriting /etc/passwd but fixing it!
1:17:12 - Getting "root" on the actual box.
1:18:22 - Outro

[xx]

Absolutely amazing walkthrough!

I worked through this room, and was stuck in the tar wildcard injection for days! I mean, I made it work, but never really understood what exactly I was doing. Your example with ls and explanation why the asterisk exploitation works made it absolutely clear in my head.

Thank you and keep up the great work!

[glens]

Awesome vid again Tib3rius. I used to use notion but got frustrated with it partially because of the scrolling issue you were having. If you have the time may I recommend you check out Obsidian. Very similar to Notion but I find it a much more pleasant experience.

[skycritch]

What happens if I take away the word "disabled"? * Works * Oh, wow. 😅