00:00 - Introduction
00:55 - Start of nmap
03:10 - Running a VHOST enumeration scan
04:00 - Discovering the Metaview application which is an image upload
04:50 - Attempting to exploit the file upload, uploading non images.
07:00 - Editing the exif metadata to put PHP tags in the image, still failing to get code execution but find XSS
09:00 - Looking for public exploits against exiftool
10:10 - Creating a malicious image with CVE-2021-22204 against ExifTool, DjVu exploit
15:00 - Reverse shell returned, examining the application
18:30 - Discovering Convert_images directory, using grep to find out if anything uses it and finding a script
20:30 - Finding the convert_images script uses an old copy of mogrify which uses image magic and has a vulnerability
21:30 - Exploiting CVE-2020-29599 in mogrify/image magic
28:50 - Our user can run neofetch with sudo, and XDG_CONFIG_HOME is preserved. Exploiting it by putting a malicious config