HTB: Editor

Linux box where an unauthenticated XWiki RCE gives a foothold, database credentials are reused over SSH, and a Netdata ndsudo PATH vulnerability leads to root.

September 14, 2026 · 5 min

THM: Do Not Disturb

Linux boot2root combining a NoSQL authentication bypass, Node.js SSTI, Node inspector abuse, and disk-group privilege escalation.

August 11, 2026 · 7 min

Linux Privilege Escalation Cheatsheet

A practical Linux privilege escalation reference covering high-impact enumeration checks, common misconfigurations, credential hunting, container escapes, and last-resort kernel exploits.

May 25, 2026 · 11 min

HTB: Forgotten

Linux box exploiting an unfinished LimeSurvey install via malicious plugin upload, then Docker credential exposure and SUID abuse through a shared volume.

March 8, 2026 · 6 min

HTB: BoardLight

Linux machine where vhost discovery uncovers an authenticated Dolibarr RCE, followed by credential disclosure and Enlightenment SUID privilege escalation.

February 18, 2026 · 4 min

HTB: Jarvis

Linux machine chaining manual union-based SQL injection into a phpMyAdmin web shell, a Python command injection, and SUID systemctl abuse for root.

November 27, 2025 · 8 min