Uploaded September 2023 | Updated September 2026, 2 weeks ago

---

00:00 - Intro
01:02 - Start of nmap
01:50 - Discovering Cacti version and finding a vulnerability
03:50 - Sending the payload from the description, discovering we need to set the X-FORWARDED-FOR
05:00 - Incrementing Host_ID and Local_Data_Ids and discovering different output
06:15 - Discovering with local_data_ids set to 6 and host_id set to 1, we can get code execution
06:50 - Showing the python exploit and showing it blindly spray, looking at the Metasploit module for some more info
10:40 - Getting a reverse shell
11:30 - Using Script to set up our PTY since python is not installed
13:40 - Connecting to the MySQL Database and then cracking passwords
18:25 - SSH into the box with Marcus and discovering mail on the box
20:20 - Discovering Docker is old and vulnerable to CVE-2021-41091
21:55 - Looking at the docker overlayfs directories, discovering we can go in them, finding the web container
23:10 - Using CapSH to escalate privileges on our docker container so we can make Bash a SetUID Binary
24:50 - Executing bash -p to get root