Writeups on bokkapig

Reactor

Tue, 04 Aug 2026 14:45:21 +0100

A ReactorWatch monitoring dashboard on port 3000 runs Next.js 15.0.3 with React 19.0.0 — vulnerable to React2Shell (CVE-2025-55182 / CVE-2025-66478), an unauthenticated RCE in the React Server Components Flight deserializer. A POST to / carrying a Next-Action header and a forged circular Flight chunk reaches Function via $1:constructor:constructor, giving code execution as the node service account. The app’s world-readable SQLite database yields engineer’s MD5 password hash, reused verbatim for SSH. Root comes from a root-owned uptime-monitor systemd unit launched with –inspect=127.0.0.1:9229: the Node debug port is an unauthenticated root eval primitive, driven over the Chrome DevTools Protocol.

Cohort

Sat, 01 Aug 2026 00:00:00 +0000

An internal marimo notebook server — discovered by bypassing an SSRF host blocklist on the Cohort Analytics ‘source validator’ — exposed the unauthenticated /terminal/ws endpoint (CVE-2026-39987), granting a pre-auth PTY as marimo. Privilege escalation abused a deliberately held-back PackageKit (CVE-2026-41651, ‘Pack2TheRoot’): a TOCTOU race in the D-Bus InstallFiles transaction let an unprivileged user install a malicious .deb whose postinst ran as root, dropping a SUID bash.

Connected

Sat, 06 Jun 2026 00:00:00 +0000

An unauthenticated stacked SQL injection in the FreePBX 16 endpoint module (CVE-2025-57819) inserts a full-access administrator directly into the ampusers table, and the Endpoint Manager firmware uploader (CVE-2025-61678) is then abused with a path traversal to drop a PHP webshell, yielding code execution as asterisk and the user flag. FreePBX config files leak the MariaDB credentials in plaintext, granting write access to the asterisk database. The root-run synologyabb sysadmin hook execs a DB-controlled CLI path, so repointing the SYNOLOGYABFBABBCLI setting at an attacker script and firing the incron trigger runs it as root.

Silentium

Sat, 11 Apr 2026 00:00:00 +0000

A staging Flowise 3.0.5 instance leaks a live password-reset token straight back in the /api/v1/account/forgot-password response (CVE-2025-58434), giving instant takeover of the ben@silentium.htb admin account. Authenticated, the Custom MCP node’s mcpServerConfig (CVE-2025-59528) spawns arbitrary processes, yielding root inside the Flowise container — whose environment block hands over SMTP_PASSWORD, reused verbatim as ben’s system password over SSH. Root comes from a second internal app: Gogs 0.13.3 running as root with open registration, where CVE-2025-8110 lets the contents API write through a committed symlink to overwrite the repository’s pre-receive hook, executed as root on the next push.

DevArea

Sat, 28 Mar 2026 00:00:00 +0000

Anonymous FTP exposed a Java SOAP service JAR; an MTOM XXE attack against the CXF endpoint leaked the Hoverfly admin password from a systemd unit file, then authenticated RCE via Hoverfly middleware yielded a shell as dev_ryan; privilege escalation exploited a world-writable /bin/bash by writing a SUID-creating wrapper triggered by a root-owned systemd timer.

Kobold

Sat, 21 Mar 2026 00:00:00 +0000

MCP Inspector STDIO RCE for foothold, PHP code injection in PrivateBin container to leak credentials, Docker escape via Arcane container management.

VariaType

Sat, 14 Mar 2026 00:00:00 +0000

Exploited fonttools CVE-2025-66034 designspace path traversal to write a PHP webshell, escalated to user via FontForge archive command injection, then root via setuptools PackageIndex arbitrary file write to cron.d.

CCTV

Sat, 07 Mar 2026 00:00:00 +0000

Default ZoneMinder credentials lead to RCE as www-data. Lateral movement via cracked bcrypt hash to SSH as mark, then sniffing Docker inter-container traffic for sa_mark credentials. Privilege escalation by abusing motionEye running as root to inject a reverse shell into camera event hooks.

Interpreter

Sat, 21 Feb 2026 00:00:00 +0000

Pre-auth RCE via CVE-2023-43208 XStream deserialization in Mirth Connect 4.4.0, lateral movement through MySQL credential extraction and password hash replacement, privilege escalation via Python eval() injection in an internal Flask notification app running as root.

WingData

Sat, 14 Feb 2026 00:00:00 +0000

Unauthenticated RCE in Wing FTP Server v7.4.3 via NULL byte Lua injection (CVE-2025-47812), lateral movement through cracked FTP user password hash, and root via Python tarfile data filter PATH_MAX bypass (CVE-2025-4517).

Pterodactyl

Sat, 07 Feb 2026 00:00:00 +0000

Unauthenticated RCE via Pterodactyl Panel LFI (CVE-2025-49132), credential reuse for SSH, then privilege escalation via PAM session injection (CVE-2025-6018) chained with udisks2 XFS resize race condition (CVE-2025-6019) to obtain root.

Facts

Sat, 31 Jan 2026 00:00:00 +0000

Exploited CamaleonCMS path traversal (CVE-2024-46987) to extract MinIO credentials and an encrypted SSH key, then escalated via sudo facter –custom-dir to root.

Overwatch

Sat, 24 Jan 2026 00:00:00 +0000

Windows AD DC with anonymous SMB share leaking .NET app credentials, MSSQL linked server DNS poisoning for credential capture, and WCF SOAP service command injection for SYSTEM access.

AirTouch

Sat, 17 Jan 2026 00:00:00 +0000

WiFi-centric box involving SNMP credential leak, WPA PSK cracking, web app file upload via cookie manipulation, WPA-Enterprise evil twin attack, and hostapd-wpe EAP user file credential disclosure for privilege escalation.

Browsed

Sat, 10 Jan 2026 00:00:00 +0000

Malicious Chrome MV3 extension uploaded to server-side browser achieved RCE via bash arithmetic evaluation in a Flask/bash backend, then escalated to root via .pyc injection into a world-writable pycache directory of a sudo-allowed Python script.

MonitorsFour

Sat, 06 Dec 2025 00:00:00 +0000

IDOR credential leak, Cacti SQL injection to stacked-query log poisoning RCE, and Docker Desktop API escape to root.

Expressway

Thu, 20 Nov 2025 00:00:00 +0000

IKEv1 Aggressive Mode PSK hash capture and offline brute-force reveals SSH credentials; custom sudo 1.9.17 binary is exploited via CVE-2025-32463 NSS library injection to achieve root.

Baby

Tue, 18 Nov 2025 00:00:00 +0000

LDAP anonymous bind leaks an initial password in a user description; the target user (Caroline.Robinson) has STATUS_PASSWORD_MUST_CHANGE set, allowing password reset via SAMR; Backup Operators group membership enables direct flag read via FILE_OPEN_FOR_BACKUP_INTENT over SMB.

Eighteen

Sat, 15 Nov 2025 00:00:00 +0000

Windows Server 2025 DC with MSSQL impersonation leading to credential extraction, password spray for WinRM access, and BadSuccessor dMSA privilege escalation to Domain Admin.