I can't find any vods of the event so far, and there are no slides either. Would have been an interesting watch.

Just port scan, attack, 0wn, extract credentials, download all content, obtain other users' credentials, etc.

Looks like they used censys.io to find "open" seedboxes. I bet a lot of these providers use TCP sockets for internal communications so its no surprise there, when you can just request access, and it gives you it.