skip to content
~/bokkapig
_
hack the box machine writeups
[1]
machines
[2]
refs
[3]
cheatsheet
[4]
search
[5]
pdf-inject
← cd ../tags
grep -l "Python Eval() Injection" ./machines
[1]
sorted: date ▼
$ grep
/
difficulty
medium
clear ✕
name
diff
os
date
tags
Interpreter
medium
linux
2026-02-21
Pre-auth RCE via CVE-2023-43208 XStream deserialization in Mirth Connect 4.4.0, lateral movement through MySQL credential extraction and password hash replacement, privilege escalation via Python eval() injection in an internal Flask notification app running as root.
xstream deserialization
·
mirth connect
·
cve-2023-43208
·
hl7/mllp
·
python eval() injection
no machines match that filter