00:45 - Begin of recon, Nmap
01:30 - Taking the CentOS Apache Version to find major version
03:20 - Running GoBuster with a Common-PHP-Files wordlist.
06:00 - Enumerating Ldap with ldapsearch
07:30 - Discovery of Password Hashes within ldap information
10:55 - Attempting to crack the hashes. (does not crack)
12:30 - Back to the web page
13:15 - Page says to login with ip@Lightweight with the password of your ip
15:35 - Running LinEnum
20:15 - Discovery of Extended Capabilities set on tcpdump
20:50 - Performing a packet capture over SSH without touching disk
23:45 - Examining the pcap created, don't see anything on ens33
24:20 - Performing a packet capture through SSH and piping live results to WireShark
26:00 - Discovery of LDAP Traffic, ldapuser2 password passed in clear-text
28:15 - Using bash to exfil a file over the network (backup.7z)
29:25 - Using 7z2john and hashcat to crack a 7zip file
32:05 - Examining extracted files to discover a new credential (ldapuser1)
33:30 - The openssl binary in ldapuser1 has an empty capability (which is all)
35:00 - Using GTFOBins to see what we can do with openssl
37:11 - Reading /etc/shadow with openssl
37:35 - Adding an entry into /etc/sudoers to allow us to escalate to root