Tier 2: Unified - HackTheBox Starting Point - Full Walkthrough

Learn the basics of Penetration Testing: Video walkthrough for the "Unified" machine from tier two of the ‪@HackTheBox‬ "Starting Point" track; "don't forget to contemplate". We'll be exploring the basics of enumeration, service discovery, Log4J vulnerability (CVE-2021-44228) aka Log4Shell in UniFi, MongoDB injection, hashcracking, privilege escalation and more! Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #HackTheBox #HTB #CTF #Pentesting #OffSec #CVE-2021-44228 Sign up for HackTheBox: https://htb-signup.cryptocat.me ↢HackTheBox↣ https://htb-signup.cryptocat.me   / hackthebox_eu     / discord   👷‍♂️Resources🛠 https://cryptocat.me/resources ↢Chapters↣ Start: 0:00 NMap scan: 0:35 Explore UniFi web server: 1:35 Investigate Log4J vulnerability: 4:31 Test JNDI:LDAP payload: 6:54 Reverse shell (Log4Shell): 11:38 Catch up on questions: 12:39 Enumerate MongoDB instance: 13:39 Try to crack password hash: 15:28 Inject user into database: 18:18 Login to UniFi admin panel: 19:20 Recover SSH credentials: 20:40 Buggy Admin UI - refer to walkthrough: 22:56 Submit user/root flag: 24:10 End: 24:51