https://blog.msnieman.com/tags/lfi/Recent content in LFI on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/resource/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/resource/A zip-upload feature on an SSH key management web app is exploited via a PHP pearcmd LFI-to-RCE trick to land a webshell as www-data; uploaded zip archives contain a HAR file with credentials for msainristil, and a SSH certificate signing API endpoint is abused to sign keys for additional principals, ultimately allowing privilege escalation to root via a sudo-accessible key-signing script.https://blog.msnieman.com/writeups/facts/Thu, 12 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/facts/A Ruby on Rails app running Camaleon CMS 2.9.0 is compromised via mass-assignment privilege escalation to admin, then an LFI in the admin file-download endpoint retrieves an SSH private key from an internal MinIO S3 bucket; the key cracks with JtR and SSH access leads to a sudo facter binary abused for root RCE.https://blog.msnieman.com/writeups/lantern/Tue, 20 Aug 2024 00:00:00 +0000https://blog.msnieman.com/writeups/lantern/A Skipper proxy CVE-2022-38580 SSRF exposes an internal Blazor WebAssembly app whose DLL contains base64-encoded admin credentials; those credentials log into the app, whose source code reveals a path traversal on /PrivacyAndPolicy and a DLL-loading component endpoint; a crafted Blazor component DLL reads tomas’s SSH private key, and procmon-based inspection of a root-run binary leads to privilege escalation.