All right, this note, we are going to see another misconfiguration that is allowing the reader access
to these private tickets.
So if you know the user name and if you notice, uh, if you can read the contents of this private Osiecki,
then you can log in to that user without the password.
You can log in to the as a city told that password and you largely get that user.
So, uh, administrators generally will back up the route route users as a key into something very important
near their territory.
So if you have the right access like a normal user, then you can ask your belonging to the user.
So I am here, the Ordover doctor, and this is about 30 to 40 in this river.
We have the private institute and we don't know the password.
So but so by reading this, are using this as the key.
We need to log in to this Bendit 14 user.
So frustrate me into this by using this Carpati, you can also use the normal switch and the number
is.
Uh, maybe, but no.
So let me go to zero.
I got to go to zero and then we need to open this connection reconnaissance and covid this password
Bandit 13 and this password.
So I successfully logged into this battle that you can see the username here address and we have this
as a certificate of private, so let us use the permissions of this one so we can treat this as a private,
let's say, cat.
So this is a priority and we can use this private key to do this panel for the user.
So here they have set the panel for dinner and we can use this one.
So let me as I said, I think this works.
As I such minus eight.
Bandit 14.
Yes, and there you go.
We have successfully logged into this abandoned 14 user, so we just said that where this one.
So.
Yes, there we go.
This one is you need to say, is it and many say to us it is private and the user Étretat is this old
machine.
That's why it has created its character to the same machine.
So you can ask a special IP address of another.
So we are actually logged into this Beneful.
So you can think this is not true to part, but it may have some higher privileges than the reality.
And you can also, uh, enumerate this user for any more escalation vectors so that this question is
not from that we, uh, not only from normal user producer, but also can be normal user to a somewhat
higher user.
So this is how you create or produce if you have the read permission for this as a private.