Uploaded October 2025 | Updated September 2026, 2 weeks ago
00:00 - Introduction
01:00 - Start of nmap
02:55 - Looking at Upload Modules, can see the version of python/tensorflow looking for a way to get RCE in tensorflow h5 files
06:00 - Using docker to run the tensorflow, mounting our cwd in the docker to make it easy to copy files from the docker image
09:19 - Shell returned, looking at the database to get a password hash and cracking it to get another user
14:40 - SSH as the Gael User, discover another webserver running on port 9898 which is BackRest
18:20 - Using find to show files by user/group and discovering a backup of BackRest which contains the password hash, crack it
22:30 - Getting root.txt by backing it up and downloading it
25:20 - Getting root by putting a command in the backup job hook
29:20 - Showing another way to get root by command injection in Restic
00:00 - Introduction
01:00 - Start of nmap
02:55 - Looking at Upload Modules, can see the version of python/tensorflow looking for a way to get RCE in tensorflow h5 files
06:00 - Using docker to run the tensorflow, mounting our cwd in the docker to make it easy to copy files from the docker image
09:19 - Shell returned, looking at the database to get a password hash and cracking it to get another user
14:40 - SSH as the Gael User, discover another webserver running on port 9898 which is BackRest
18:20 - Using find to show files by user/group and discovering a backup of BackRest which contains the password hash, crack it
22:30 - Getting root.txt by backing it up and downloading it
25:20 - Getting root by putting a command in the backup job hook
29:20 - Showing another way to get root by command injection in Restic
