File-Upload Pen Test Traces a Route from Conversion Flaw to Database Access

Summary

In a staged, sponsored penetration-test demo, the presenter traces a file-conversion upload exploit to a shell, then finds an SSH key and database credentials in backups. A Teleport demo replaces direct SSH-key reuse with identity-bound, short-lived access.

Key points

• The presenter describes a commissioned test of a staging proofing application at a print studio; the walkthrough uses a Docker test setup and imaginary paths.
• The tester identifies file conversion of uploaded artwork as an attack surface and tests format-specific payloads, some intended to produce remote code execution or local file reads.
• ChatGPT is used to research candidate conversion-related RCE and local-file-include vulnerabilities and assemble proof-of-concept materials; the video does not identify a specific CVE as the cause.
• After gaining a shell in the demonstration, the tester finds a backed-up home directory containing an SSH key and uses it to access the test host.
• A configuration file is shown exposing database credentials, which the presenter uses in the demo to query customer records from MySQL.
• The presenter warns that reused SSH keys and stored credentials can extend access to other systems, though access to additional hosts is not demonstrated.
• In the sponsored Teleport demonstration, direct SSH-key access is denied; access is instead mediated through identity-based login and expiring certificates, with passkey and MFA options shown.