A pentester gets root - step by step example
I mean… this is an interesting write up, but the “got root” boils down to “someone committed the root private key to git and then left it sitting there”.<p>To be fair, I bet there are a lot of things like that out there, along with folk using “password1” as their login.<p>…but it felt like a bit of let down in the story.<p>1) Get shell access!<p>2) look for a commit entitled “root key here”<p>3) profit!<p>I was a bit disappointed, I was hoping for some exploit… but I guess often this stuff is just mundane human failures.<p>…also, is it fine to only partially redact a private key in an image?<p>I mean, tell me I’m wrong here, but isn’t that kinda bad? (Maybe it’s just a mock image for the post, who knows).