aria2 1.18.8 running as a daemon with JSON-RPC enabled on port 6800 and no rpc-secret: anyone calls aria2.addUri with a dir and out option, so a file from the player's server is written anywhere the process can write, such as a cron directory.
Pas commencéDockercommit 0eb41d5x86_64 · aarch64Secret
Abuse the open aria2 RPC to write a file that gives you a shell on the server.
Le brief de ce lab se trouve dans son dépôt.