Wow - fantastic work! I'm glad the ES article came in handy for you ;)

I can almost promise you that if you could reach the external ES instance and exploit it - it was already exploited. They need to wipe that box and rebuild.

Overall, great writeup - thanks for sharing!