#
OverlayFS
2 posts
Nimbus — SSRF to IMDS Credential Theft, YAML Deserialization RCE, and Privileged Container Escape via core_pattern
An SSRF on a job scheduler leaks AWS IAM credentials from the instance metadata service. The stolen credentials give access to an SQS queue consumed by a worker doing unsafe YAML deserialization — yielding RCE inside a container. From there, a privileged CodeBuild container built with LocalStack is used to overwrite kernel's core_pattern and escape to root on the host.
HTB TwoMillion: A Lesson in API Abuse and Privilege Escalation
JavaScript deobfuscation reveals hidden API endpoints, leading to invite code generation. API route enumeration exposes an admin section with broken access control, enabling self-promotion to admin. Command injection in a VPN generation endpoint provides a shell. A leaked .env file gives SSH credentials, and CVE-2023-0386 (OverlayFS) escalates to root.