- `/dump/` will let you take full coredump of current flask app- analyze the coredump to get `app.secret_key`, use that to forge an admin cookie- upload a malicious tar file that contains a symlink to root `/` directory, this will let you have system wide access of files- browse to `/proc/[pid]/cmdline`, there's a ssh-agent runnning and there is `/home/alice/.ssh/` which contains ssh key- gain a footing to RCE by overwriting `__free_hook` to `system`, this will basically execute everyline on what you send through the HTTP request- `sudo -l` gave you info, that we can run `sudo gcore` w/o password, take a full coredump of `ssh-agent`- analyze the coredump of ssh-agent, and recover the RSA prime parameters- use the recovered RSA private key to ssh into root
full article [https://circleous.blogspot.com/2021/04/why.html](https://circleous.blogspot.com/2021/04/why.html)