{"uuid": "854f785e-52b4-4e50-b7bc-9fdf43aa8408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27881", "content": "Look how we\u2019ve changed the location of key, admin_cap is set to true and pasted the key below. Note the color coding to comprehend how the JWT token is made.Privilege EscalationBefore opening this file up, we fired a netcat listener. Then after clicking on view can get a reverse shell. We convert this into a proper teletype first.python3 -c 'import pty;pty.spawn(\"/bin/bash\")'In the var/backups directory we saw home.tar.gz which was an old account backup.cp home.tar.gz /tmp/Smart thing to do here is do dumpster diving for old SSH keys. Luckily, we did find the SSH keys and copied this private key to our system.cat /home/noah/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEjwvANJPXv5FTFtiBAId3w59eLHbuKT_wrARKzdUTKZ2CVLCy0dVv4LyQuhw5IHceMZKDCs4_lDQfZqlWSgodwswH4PLVusDnxLbXlahquCzL3nqS5kiMyVG_v45v8xuDqvJG9mfKPTueVbsDaxFQhB61ZRYGVqzaKz7jy2pRaT6uMfDpvUik2-YKcu5g=s16000 We changed the permission on the key to \u201c600\u201d and logged in to noah\u2019s account using it.nano sshkeyThe user flag was in /home.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEjTJIozJU9Pj9tS2nTnTw2oI1D-d3_VRGOIIhgEDSPoVcjJsNKF4SuCEvPvI0VG60ZORFUVhJaerrhDTDVxezF08A9eFt_xv6MjwlU0aQb4fZ7f8ZqB-kZBwN3gqLUOGuyW7cdDVXBMEuLocISocyaNv_3Mz8ny3E2o1JtUtscj4z7tqcxwTfp7d2AEVg=s16000 We observed that version 18.06.0-ce was affected by CVE-2019-5736, a docker es[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.278696Z"}