LFI

Windows machine chaining PHP session poisoning for code execution, SMB-hosted RFI for a webshell, reused database credentials, and a malicious CHM help file for administrator.

Linux machine chaining an LFI-executed webshell (staged via phpLiteAdmin), a port-knocked SSH key hidden with steganography, and a chkrootkit cron exploit for root.

Linux machine using an LFI to leak Tomcat manager credentials for a WAR-based shell, cracking a reused backup password, and abusing LXD group membership to mount the host filesystem for root.

FreeBSD machine chaining an LFI-driven log poisoning webshell with a multiply-encoded backup password, then SSH port forwarding into a root-owned VNC session for root.