Just uploaded what I think is one of my better HTB Videos (CyberMonday). A lot went wrong when recording this box, so there's heaps of valuable troubleshooting methodology in this video. Specifically, there was a Protocol Smuggling portion of the box. You can rewrite the HTTP VERB which enables you to talk to a Redis instance that is used to store Laravel cookies. If you try and do this all blindly, you will likely have a bad time as there's tons of escaping, and many people I talked to that solved it didn't even know how to confirm they were able to write to Redis in the first place! @0xdf_ and I spent about an hour looking through the docs and believe the MIGRATE command is the only way to really do this. MIGRATE isn't needed at all for the exploit but is tremendously helpful in troubleshooting. The one thing that delayed us into looking into the Redis Docs was spinning up a REDIS Service locally sounded like a lot of work. I probably burned an hour throwing payloads blindly at this box until it dawned on me that a single docker command would let me test things locally. Don't sleep on docker, it is incredibly helpful when trying to mimic target environments quickly. The icing on the cake with this box is there is a File Disclosure vulnerability that leads to leaking the DB Password which is used for SSH. Perfect timing for this box to retire as its very similar to that recent owncloud vuln. Env Variables often contain gold mines. Anyways the video is here: youtu.be/VNMn5bXA8XY