Beach Bar
Leaked credentials lead to unsafe YAML deserialization, remote code execution, and Linux privilege escalation.
linux
4 posts
Hollow Shell
Default credentials and a Zip Slip upload escape the theme directory and turn an automation hook into code execution.
Infinity Pool
Command injection in a legacy network-check endpoint leads through internal services to full compromise.
Eavesdropper
SSH access as Frank and process monitoring with pspy reveal credentials used for root privilege escalation.
