Bukhari's Archive

Orion is a Linux machine compromised via a Craft CMS 5.6.16 RCE exploit for initial access as www-data, followed by credential extraction from a leaked .env file, database enumeration for a crackable admin hash, and privilege escalation to root through CVE-2026-24061, an authentication bypass in telnetd via a spoofed USER environment variable.

A quick coding challenge solved — filter primes out of a list and multiply them to get the key.

Connected is a Linux machine compromised via CVE-2025-57819, an unauthenticated SQL injection in FreePBX 16 Endpoint Manager, leveraged to plant a cron-triggered web shell for RCE as the asterisk user, followed by privilege escalation through a writable config file executed by a root-owned Incron trigger.