msfvenom

Linux box where an unauthenticated XWiki RCE gives a foothold, database credentials are reused over SSH, and a Netdata ndsudo PATH vulnerability leads to root.

Windows machine using TLS certificate enumeration to find a staging subdomain, SSRF to leak admin credentials, a PHP webshell upload for a foothold, and an AlwaysInstallElevated MSI for SYSTEM.

Windows machine where an unauthenticated file upload sets up a CloudMe buffer overflow, leading to administrator access.

Windows machine built around an Adobe ColdFusion remote code execution bug, escalated to SYSTEM with a kernel exploit.

Windows box exploiting an IIS upload filter bypass via web.config, capped off with a kernel exploit for privilege escalation.

Windows machine using MSSQL injection to force NTLM authentication, gain WinRM access, and abuse the UniFi Video service for SYSTEM.

Windows machine centred on an AChat buffer overflow with custom shellcode, then credential discovery and password reuse for Administrator.

Linux machine exploiting a public OpenNetAdmin RCE, chaining reused database credentials into an internal-only site, and abusing a sudo-permitted nano binary for root.

Linux box that starts with an exposed PHP web shell, pivots through sudo-based lateral movement, and finishes with cron-driven privilege escalation.

Linux machine exploiting Apache ActiveMQ (CVE-2023-46604) for initial access, then abusing sudo nginx rights for root.