RCE on bokkapig

Connected

Sat, 06 Jun 2026 00:00:00 +0000

An unauthenticated stacked SQL injection in the FreePBX 16 endpoint module (CVE-2025-57819) inserts a full-access administrator directly into the ampusers table, and the Endpoint Manager firmware uploader (CVE-2025-61678) is then abused with a path traversal to drop a PHP webshell, yielding code execution as asterisk and the user flag. FreePBX config files leak the MariaDB credentials in plaintext, granting write access to the asterisk database. The root-run synologyabb sysadmin hook execs a DB-controlled CLI path, so repointing the SYNOLOGYABFBABBCLI setting at an attacker script and firing the incron trigger runs it as root.

Silentium

Sat, 11 Apr 2026 00:00:00 +0000

A staging Flowise 3.0.5 instance leaks a live password-reset token straight back in the /api/v1/account/forgot-password response (CVE-2025-58434), giving instant takeover of the ben@silentium.htb admin account. Authenticated, the Custom MCP node’s mcpServerConfig (CVE-2025-59528) spawns arbitrary processes, yielding root inside the Flowise container — whose environment block hands over SMTP_PASSWORD, reused verbatim as ben’s system password over SSH. Root comes from a second internal app: Gogs 0.13.3 running as root with open registration, where CVE-2025-8110 lets the contents API write through a committed symlink to overwrite the repository’s pre-receive hook, executed as root on the next push.

CCTV

Sat, 07 Mar 2026 00:00:00 +0000

Default ZoneMinder credentials lead to RCE as www-data. Lateral movement via cracked bcrypt hash to SSH as mark, then sniffing Docker inter-container traffic for sa_mark credentials. Privilege escalation by abusing motionEye running as root to inject a reverse shell into camera event hooks.

Pterodactyl

Sat, 07 Feb 2026 00:00:00 +0000

Unauthenticated RCE via Pterodactyl Panel LFI (CVE-2025-49132), credential reuse for SSH, then privilege escalation via PAM session injection (CVE-2025-6018) chained with udisks2 XFS resize race condition (CVE-2025-6019) to obtain root.

MonitorsFour

Sat, 06 Dec 2025 00:00:00 +0000

IDOR credential leak, Cacti SQL injection to stacked-query log poisoning RCE, and Docker Desktop API escape to root.