Assembly Line

Premium Machine (Locked)

An ASP.NET Core profile-import microservice deserializes attacker-supplied JSON with Newtonsoft.Json TypeNameHandling.All — polymorphic $type metadata lets you instantiate arbitrary .NET types. One of the app's own types runs a shell command on a property set, giving unauthenticated RCE. Loot leaked SSH creds from config, then escalate via a sudo GTFObins one-liner.