00:00 - Introduction
01:00 - Start of nmap
03:10 - Finding their public key, then sending an encrypted message that contains a XSS Test payload
06:50 - Creating a PGP Key and sending our public key, so they can send an encrypted message back
08:40 - Decrypting the message they sent to us
09:50 - Signing a message, but not encrypting it for them to verify and see they give us the metadata back
12:40 - Testing a SSTI Payload in the username of the key, and seeing it will dump the config
15:25 - Finding a SSTI Payload with Jinja2 that gives code execution... First attempt fails
19:23 - Testing a different SSTI Payload and getting code execution
21:40 - Reverse shell returned, discovering we are in a jail, attempting to get chisel up and running and failing
26:55 - Finding admin.json which contains another credential and we can use this to SSH into the box
28:00 - Logging into MySQL and attempting to crack the hashes
31:00 - Identifying that a file in the cargo directory for atlas is being updated every 2 minutes. Running pspy to identify what is happening
35:55 - We can write to one of the libraries cargo using to build, putting a reverse shell in
43:50 - Identifying that Atlas can run Firejail as root, finding a exploit for Firejail and getting root
Support the originator by clicking the read the rest link below.
