Uploaded February 2025 | Updated September 2026, 2 weeks ago
00:00 - Introduction
01:00 - Start of nmap
03:55 - Playing around with the website, booking a table and then registering an account
08:40 - Taking a look at the Save to iCalendar functionality and finding a File Disclosure vulnerability
12:15 - Finding the application source code via the /proc/self/cwd directory
14:15 - The JWT does RSA manually, using a weak exponent, showing we can factor this with RsaCtfTool
18:40 - Showing JWT.IO doesn't work with weak RSA Keys, showing an alternative tool
26:10 - Looking at cron jobs, finding all of the source code
28:20 - The DBMonitor Cron looks like it will execute code if we create specific files in the /data/scripts directory
33:50 - Using INTO OUTFILE with our SQL Injection to write files and exploit the DBMONITOR Cron to get a shell
41:30 - Shell returned looking at the database, then exploiting another cron because we can write a file
45:20 - Looking at the commit history of an Mercurial HG repo and finding a password
49:05 - We can run HG PULL as dev, showing there are multiple places we can put a HGRC file and create a repo with a hook that will execute a script on pull
57:05 - We can run rsync as root, but the standard gtfobin doesn't work
1:00:00 - Showing the chown flag doesn't remove setuid bits in RSYNC, which lets us make setuid files
1:03:00 - BEYOND ROOT: Showing the changes to the box (secure_file_priv and AppArmor) that allows MySQL To Write files
1:08:49 - Showing the CHOWN removes SetUID but Rsync does not when changing owners
00:00 - Introduction
01:00 - Start of nmap
03:55 - Playing around with the website, booking a table and then registering an account
08:40 - Taking a look at the Save to iCalendar functionality and finding a File Disclosure vulnerability
12:15 - Finding the application source code via the /proc/self/cwd directory
14:15 - The JWT does RSA manually, using a weak exponent, showing we can factor this with RsaCtfTool
18:40 - Showing JWT.IO doesn't work with weak RSA Keys, showing an alternative tool
26:10 - Looking at cron jobs, finding all of the source code
28:20 - The DBMonitor Cron looks like it will execute code if we create specific files in the /data/scripts directory
33:50 - Using INTO OUTFILE with our SQL Injection to write files and exploit the DBMONITOR Cron to get a shell
41:30 - Shell returned looking at the database, then exploiting another cron because we can write a file
45:20 - Looking at the commit history of an Mercurial HG repo and finding a password
49:05 - We can run HG PULL as dev, showing there are multiple places we can put a HGRC file and create a repo with a hook that will execute a script on pull
57:05 - We can run rsync as root, but the standard gtfobin doesn't work
1:00:00 - Showing the chown flag doesn't remove setuid bits in RSYNC, which lets us make setuid files
1:03:00 - BEYOND ROOT: Showing the changes to the box (secure_file_priv and AppArmor) that allows MySQL To Write files
1:08:49 - Showing the CHOWN removes SetUID but Rsync does not when changing owners
