https://blog.msnieman.com/tags/linux/Recent content in Linux on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bucket/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bucket/A web application backed by a locally exposed S3-compatible bucket allows unauthenticated file uploads; uploading a PHP web shell through the bucket endpoint gives remote code execution on the server.https://blog.msnieman.com/writeups/redpanda/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/redpanda/A Spring Boot search page reflects user input into a Server-Side Template Injection sink, giving RCE as woodenk; a root-owned log-parser cron is then exploited via JPEG Artist metadata and XML External Entity injection to read root’s SSH key.https://blog.msnieman.com/writeups/resource/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/resource/A zip-upload feature on an SSH key management web app is exploited via a PHP pearcmd LFI-to-RCE trick to land a webshell as www-data; uploaded zip archives contain a HAR file with credentials for msainristil, and a SSH certificate signing API endpoint is abused to sign keys for additional principals, ultimately allowing privilege escalation to root via a sudo-accessible key-signing script.https://blog.msnieman.com/writeups/sea/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/sea/A WonderCMS site’s contact form SSRF is weaponized to deliver CVE-2023-41425, landing a shell as www-data; a password hash found in the CMS database cracks to pivot to a user account, and an internal monitoring service running as root is exploited to escalate.https://blog.msnieman.com/writeups/deputy/Sun, 12 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/deputy/A exposed .git directory leaks Terraform IAM ARNs; a case-sensitivity bug in the event-role API lets those ARNs cross account boundaries, eventually reading a DynamoDB record that contains credentials — which chain through the app to a root password.https://blog.msnieman.com/writeups/templtrap/Thu, 02 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/templtrap/A Langflow AI server exposed on port 80 is exploited via CVE-2026-0770 (SSTI RCE) for an initial shell as karen; screen 5.0.0 setuid-root logging (CVE-2025-23395) is then abused to symlink /etc/sudoers and grant passwordless sudo.https://blog.msnieman.com/writeups/interpreter/Sun, 22 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/interpreter/Mirth Connect 4.4.0 is vulnerable to CVE-2023-43208 (unauthenticated RCE); database credentials in mirth.properties lead to a PBKDF2-hashed password for the sedric user, and a root-owned Flask service using eval() on attacker-controlled f-strings enables arbitrary command execution as root.https://blog.msnieman.com/writeups/bloodflow/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bloodflow/A publicly exposed n8n workflow automation instance is vulnerable to CVE-2026-21858, an unauthenticated arbitrary file read to RCE chain, yielding a shell on the target.https://blog.msnieman.com/writeups/data/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/data/An unauthenticated Grafana path-traversal (CVE-2021-43798) exposes the SQLite database, leaking PBKDF2 password hashes that crack to yield SSH access; a privileged Docker container is then used to mount the host disk and read the root flag.https://blog.msnieman.com/writeups/wingdata/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/wingdata/Wing FTP Server 7.4.3 exposes an unauthenticated RCE endpoint; cracking the salted password hashes from its XML config yields SSH access as a system user, and a root-owned backup script extracting untrusted zip archives is exploited via CVE-2025-4138 (Python zipslip) for privilege escalation.https://blog.msnieman.com/writeups/facts/Thu, 12 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/facts/A Ruby on Rails app running Camaleon CMS 2.9.0 is compromised via mass-assignment privilege escalation to admin, then an LFI in the admin file-download endpoint retrieves an SSH private key from an internal MinIO S3 bucket; the key cracks with JtR and SSH access leads to a sudo facter binary abused for root RCE.https://blog.msnieman.com/writeups/reactoops/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/reactoops/A vulnerable React application is exploited via CVE-2025-55182 (react2shell), yielding unauthenticated remote code execution and a shell that reads the flag written to /app/flag.txt.https://blog.msnieman.com/writeups/broker/Sat, 06 Sep 2025 00:00:00 +0000https://blog.msnieman.com/writeups/broker/A default-credentialed Apache ActiveMQ 5.15.15 console reveals a version vulnerable to CVE-2023-46604 (OpenWire deserialization RCE); a sudo-allowed nginx binary is then abused with a malicious config to write an SSH key into root’s home.https://blog.msnieman.com/writeups/lantern/Tue, 20 Aug 2024 00:00:00 +0000https://blog.msnieman.com/writeups/lantern/A Skipper proxy CVE-2022-38580 SSRF exposes an internal Blazor WebAssembly app whose DLL contains base64-encoded admin credentials; those credentials log into the app, whose source code reveals a path traversal on /PrivacyAndPolicy and a DLL-loading component endpoint; a crafted Blazor component DLL reads tomas’s SSH private key, and procmon-based inspection of a root-run binary leads to privilege escalation.