İçerik Üretimi

Abuse a vulnerable Gotenberg PDF service (CVE-2026-40281) to inject ExifTool arguments and drop a web shell for RCE, then root via an insecure PHP-FPM config.

İncele →

Harden a vulnerable Beszel against a path traversal flaw (CVE-2026-27734) that exposes container configs, to capture the flag.

İncele →

Harden a vulnerable AdGuard against an authentication bypass (CVE-2026-32136) to capture the flag.

İncele →

Path traversal in a Beszel monitoring deployment: abuse the hub-to-agent proxy for Docker inspect data, recover credentials from container metadata, then escalate via dangerous Docker group membership.

İncele →

Critical h2c auth bypass in AdGuard Home exposes admin APIs over HTTP/2; recover credentials hidden in filtering rules, then escalate to root via a misconfigured sudo wget rule (GTFOBins).

İncele →

Harden a vulnerable OpenEMR against an arbitrary file write flaw (CVE-2026-24848) to capture the flag.

İncele →

Server-side template injection in a Spring Boot / Thymeleaf app: bypass an incomplete CVE-2026-40478 mitigation with a whitespace parsing trick for RCE, then root via an insecure service config.

İncele →

Config leak on an exposed OpenEMR, then RCE via an authenticated arbitrary file write in the EtherFax module, escalating through a backup process vulnerable to tar wildcard injection.

İncele →

SSTI foothold for arbitrary code execution and local file read, then privilege escalation via a Directory Traversal flaw (CVE-2024-8352) in the Social Web Suite plugin for root.

İncele →

Exploit CVE-2023-26469 for a foothold, then escalate privileges by abusing misconfigured SUDO permissions.

İncele →

Web enumeration and exploitation combined with MySQL enumeration, followed by hands-on privilege escalation practice.

İncele →

Command injection in CyberPanel 2.3.7: tamper the phpSelection field in intercepted requests to run commands as root and land a reverse shell for the root flag.

İncele →