penelope

Linux machine chaining SMB enumeration, new-line command injection on an in-development router panel, cron job abuse, and a patched Diamorphine LKM rootkit for root.

Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.

Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.

Linux box exploiting an unfinished LimeSurvey install via malicious plugin upload, then Docker credential exposure and SUID abuse through a shared volume.

Linux machine bypassing a SQL injection login, forging magic bytes to upload a PHP webshell, and hijacking a SUID binary’s relative-path lshw call for root.

Linux machine where vhost discovery uncovers an authenticated Dolibarr RCE, followed by credential disclosure and Enlightenment SUID privilege escalation.

Linux machine leaking credentials over SNMP, exploiting a Nagios XI SQL injection and legacy admin-creation API, then abusing a sudo script’s unsanitised symlink target for root.

Linux machine driven by a Python eval() command injection, followed by credential reuse, Docker configuration disclosure, and sudo script abuse.

Linux machine leaking SSH credentials over SNMP, exploiting a Pandora FMS SQL injection to hijack a session, chaining an event feature into command execution, and hijacking a SUID binary’s relative tar call for root.

Linux machine chaining an LFI-executed webshell (staged via phpLiteAdmin), a port-knocked SSH key hidden with steganography, and a chkrootkit cron exploit for root.