https://blog.msnieman.com/tags/pearcmd/Recent content in Pearcmd on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/resource/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/resource/A zip-upload feature on an SSH key management web app is exploited via a PHP pearcmd LFI-to-RCE trick to land a webshell as www-data; uploaded zip archives contain a HAR file with credentials for msainristil, and a SSH certificate signing API endpoint is abused to sign keys for additional principals, ultimately allowing privilege escalation to root via a sudo-accessible key-signing script.