Uploaded March 2026 | Updated September 2026, 2 weeks ago
00:00 - Introduction
00:45 - Start of nmap
04:45 - Uploading a zip file to the extension, looking at the output discovering a new subdomain
09:45 - Going to Gitea, looking at source code, see a flask app listening on localhost and a bash script vulnerable to bash arithmetic injection, explaining how it works
13:00 - Trying to create a malicious extension that reaches back to us, using the examples provided on the website as a starting point
18:45 - Creating a Background Worker, and giving it the webrequest permission lets us make a request on startup. Now have it try to trigger the RCE
23:30 - Shell on the box, discover the __pycache__ directory gives everyone read/write access. Explaining pyc headers
32:50 - Using DD to copy the header over top of our pyc file, which will trick python into thinking it doesn't need to recompile the pyc file
37:30 - Getting Code execution as root
00:00 - Introduction
00:45 - Start of nmap
04:45 - Uploading a zip file to the extension, looking at the output discovering a new subdomain
09:45 - Going to Gitea, looking at source code, see a flask app listening on localhost and a bash script vulnerable to bash arithmetic injection, explaining how it works
13:00 - Trying to create a malicious extension that reaches back to us, using the examples provided on the website as a starting point
18:45 - Creating a Background Worker, and giving it the webrequest permission lets us make a request on startup. Now have it try to trigger the RCE
23:30 - Shell on the box, discover the __pycache__ directory gives everyone read/write access. Explaining pyc headers
32:50 - Using DD to copy the header over top of our pyc file, which will trick python into thinking it doesn't need to recompile the pyc file
37:30 - Getting Code execution as root
