https://stream.echo6.co/videos/watch/03932ff4-da8d-4ee3-9491-ed50b1435a4b 00:00 - Intro 01:02 - Start of nmap 01:50 - Discovering Cacti version and finding a vulnerability 03:50 - Sending the payload from the description, discovering we need to set the X-FORWARDED-FOR 05:00 - Incrementing Host_ID and Local_Data_Ids and discovering different output 06:15 - Discovering with local_data_ids set to 6 and host_id set to 1, we can get code execution 06:50 - Showing the python exploit and showing it blindly spray, looking at the Metasploit module for some more info 10:40 - Getting a reverse shell 11:30 - Using Script to set up our PTY since python is not installed 13:40 - Connecting to the MySQL Database and then cracking passwords 18:25 - SSH into the box with Marcus and discovering mail on the box 20:20 - Discovering Docker is old and vulnerable to CVE-2021-41091 21:55 - Looking at the docker overlayfs directories, discovering we can go in them, finding the web container 23:10 - Using CapSH to escalate privileges on our docker container so we can make Bash a SetUID Binary 24:50 - Executing bash -p to get root Wed, 15 Apr 2026 11:42:04 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://stream.echo6.co https://stream.echo6.co/client/assets/images/icons/icon-512x512.png https://stream.echo6.co/videos/watch/03932ff4-da8d-4ee3-9491-ed50b1435a4b All rights reserved, unless otherwise specified in the terms specified at https://stream.echo6.co/about and potential licenses granted by each content's rightholder.