curl

Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.

Windows machine using TLS certificate enumeration to find a staging subdomain, SSRF to leak admin credentials, a PHP webshell upload for a foothold, and an AlwaysInstallElevated MSI for SYSTEM.

Windows machine where an unauthenticated file upload sets up a CloudMe buffer overflow, leading to administrator access.

Windows machine chaining PHP session poisoning for code execution, SMB-hosted RFI for a webshell, reused database credentials, and a malicious CHM help file for administrator.

Windows machine using anonymous FTP notes and an NVMS-1000 directory traversal to recover credentials, then abusing the NSClient++ REST API for a SYSTEM shell.

Linux machine chaining an LFI-executed webshell (staged via phpLiteAdmin), a port-knocked SSH key hidden with steganography, and a chkrootkit cron exploit for root.

Linux target chained from a Metabase pre-auth RCE through Docker credential disclosure to an OverlayFS kernel exploit for root.

Linux machine exploiting Apache ActiveMQ (CVE-2023-46604) for initial access, then abusing sudo nginx rights for root.

Linux machine using an LFI to leak Tomcat manager credentials for a WAR-based shell, cracking a reused backup password, and abusing LXD group membership to mount the host filesystem for root.