Compromise of a VulnHub Linux machine by enumerating an exposed Samba 2.2.1a service, identifying the trans2open buffer overflow vulnerability, and exploiting it via Metasploit to obtain a root shell directly.
Read more →
Compromise of a Linux HackTheBox machine via CVE-2025-31161 authentication bypass on CrushFTP to gain admin access, followed by PHP reverse shell upload, credential extraction from a hardcoded Erlang script, and root flag retrieval through an exposed Erlang shell on port 2222.
Read more →
Compromise of a Linux HackTheBox machine via a js2py sandbox escape (CVE-2024-28397) in a web-based JavaScript editor to gain a shell, followed by credential extraction from a SQLite database and privilege escalation by abusing sudo npbackup-cli to read the root flag.
Read more →