Docker on bokkapig

Silentium

Sat, 11 Apr 2026 00:00:00 +0000

A staging Flowise 3.0.5 instance leaks a live password-reset token straight back in the /api/v1/account/forgot-password response (CVE-2025-58434), giving instant takeover of the ben@silentium.htb admin account. Authenticated, the Custom MCP node’s mcpServerConfig (CVE-2025-59528) spawns arbitrary processes, yielding root inside the Flowise container — whose environment block hands over SMTP_PASSWORD, reused verbatim as ben’s system password over SSH. Root comes from a second internal app: Gogs 0.13.3 running as root with open registration, where CVE-2025-8110 lets the contents API write through a committed symlink to overwrite the repository’s pre-receive hook, executed as root on the next push.

Kobold

Sat, 21 Mar 2026 00:00:00 +0000

MCP Inspector STDIO RCE for foothold, PHP code injection in PrivateBin container to leak credentials, Docker escape via Arcane container management.

CCTV

Sat, 07 Mar 2026 00:00:00 +0000

Default ZoneMinder credentials lead to RCE as www-data. Lateral movement via cracked bcrypt hash to SSH as mark, then sniffing Docker inter-container traffic for sa_mark credentials. Privilege escalation by abusing motionEye running as root to inject a reverse shell into camera event hooks.

AirTouch

Sat, 17 Jan 2026 00:00:00 +0000

WiFi-centric box involving SNMP credential leak, WPA PSK cracking, web app file upload via cookie manipulation, WPA-Enterprise evil twin attack, and hostapd-wpe EAP user file credential disclosure for privilege escalation.

MonitorsFour

Sat, 06 Dec 2025 00:00:00 +0000

IDOR credential leak, Cacti SQL injection to stacked-query log poisoning RCE, and Docker Desktop API escape to root.