27 posts
A guest-writable printer share on Samba is pre-auth RCE (CVE-2026-4480), rclone's reversible "obscure" format hands over a reused SSH password, and a Samba force-user share with insecure wide-link support becomes an arbitrary-file-write into a root-writable systemd drop-in.
A KAPE triage image of an abandoned laptop yields one saved Chrome password, decrypted entirely offline through a DPAPI masterkey → Local State → AES-GCM chain, which turns out to be the passphrase for a hidden VeraCrypt volume holding the real evidence.
Enumeration notes only — this box is still active on HackTheBox, so the exploit chain stays unpublished until it retires. Recon points at a cloud-native, container/AWS-emulation themed target.
Persistence hiding outside every autoruns tool's coverage — a malicious WMI class buried in the raw CIM repository carries a compressed .NET payload that only detonates on the domain controller by name.
Two independent leaks combine to log into a CRM as the wrong-but-reused password, an authenticated file-upload CVE gets a shell, and a custom root-owned systemd timer with unsanitised git plumbing is abused via a hand-crafted malicious tree object to plant an SSH key as root.
The same unsanitised shell=True command injection shows up twice on this box — first as a low-priv foothold via a "connectivity check" tool, then again in a root-owned automation service reached by pivoting through internal-only FreePBX and Chisel tunnels.
An unauthenticated Langflow RCE (CVE-2026-33017) leads to leaked superuser credentials via process environment, password reuse for user access, a JWT alg:none forgery against a custom MCP server, and finally a Kubernetes nodes/proxy verb bypass to a privileged pod for host root.
A zip-slip flaw in a staff upload feature lets an extracted archive entry escape its per-upload folder and overwrite the app's own live Jinja template, turning a simple file upload into persistent SSTI/RCE.