ssh

Linux machine chaining SNMP community-string enumeration, SSH password spraying, a world-writable cron script hijack, a Unix socket pivot, and a PATH-hijacked SUID binary for root.

Linux Docker machine chaining a REST API JWT secret leaked in Git history, a Python eval() command injection, database credential recovery, and a HashiCorp Vault SSH OTP privilege escalation to root.

Linux box exploiting an unfinished LimeSurvey install via malicious plugin upload, then Docker credential exposure and SUID abuse through a shared volume.

Linux box abusing the Jenkins CLI for arbitrary file read, cracking the recovered user hash, and reusing an SSH key for root.

Linux machine using SSRF to reach an internal API, recovering credentials from Git history, and escalating via a GitPython command injection.

Linux target chained from a Metabase pre-auth RCE through Docker credential disclosure to an OverlayFS kernel exploit for root.

Linux machine exploiting Apache ActiveMQ (CVE-2023-46604) for initial access, then abusing sudo nginx rights for root.

Linux machine exploiting Joomla information disclosure and authenticated template editing to pull database credentials, then escalating via apport-cli.

Linux machine escaping a vm2 sandbox, recovering credentials from SQLite, and finishing with a Bash wildcard injection to root.

Linux box chaining a Spring Boot Actuator session leak into cookie hijacking, command injection, JAR credential discovery, and sudo SSH abuse.