Uploaded August 2026 | Updated September 2026, 2 weeks ago
00:00 - Introduciton
01:00 - Start of nmap
02:30 - Finding the bin and mcp subdomain with ffuf
06:00 - Searching for PrivateBin exploits within version 2.0.2, finding an LFI but having trouble getting Code Execution from it
10:28 - Looking at the MCP Subdomain, finding MCPJam 1.4.2, which has an easy RCE Exploit
16:00 - SSH into the box as ben after dropping ssh key. Looking at processes and ports
18:37 - Looking at Arcane, another website discovering the default user of "arcane" still exists based upon timing on login
21:20 - Using find to see what files we have access to because we are in operator, discovering we can edit privateBin which allows us to weaponize the LFI to switch to its user (www-data)
26:30 - Inside of the PrivateBin Docker, looking for sensitive files, getting a password this lets us into Arcane.
30:03 - Logged into Arcane, a docker management website. Starting a container mounting / of the host to /mnt of the container, then accessing the host disk for privesc
33:30 - Showing a really cool unintended vector, which is the gshadow file. Using newgrp to add ourself to the docker group
00:00 - Introduciton
01:00 - Start of nmap
02:30 - Finding the bin and mcp subdomain with ffuf
06:00 - Searching for PrivateBin exploits within version 2.0.2, finding an LFI but having trouble getting Code Execution from it
10:28 - Looking at the MCP Subdomain, finding MCPJam 1.4.2, which has an easy RCE Exploit
16:00 - SSH into the box as ben after dropping ssh key. Looking at processes and ports
18:37 - Looking at Arcane, another website discovering the default user of "arcane" still exists based upon timing on login
21:20 - Using find to see what files we have access to because we are in operator, discovering we can edit privateBin which allows us to weaponize the LFI to switch to its user (www-data)
26:30 - Inside of the PrivateBin Docker, looking for sensitive files, getting a password this lets us into Arcane.
30:03 - Logged into Arcane, a docker management website. Starting a container mounting / of the host to /mnt of the container, then accessing the host disk for privesc
33:30 - Showing a really cool unintended vector, which is the gshadow file. Using newgrp to add ourself to the docker group
