bcrypt

Linux box abusing the Jenkins CLI for arbitrary file read, cracking the recovered user hash, and reusing an SSH key for root.

Linux machine escaping a vm2 sandbox, recovering credentials from SQLite, and finishing with a Bash wildcard injection to root.

Linux machine exploiting a WonderCMS stored XSS (CVE-2023-41425) to plant a PHP webshell, cracking an escaped bcrypt hash, and finding command injection in a custom monitoring tool for root.