https://blog.msnieman.com/tags/rce/Recent content in RCE on Myles Nieman — BlogHugoen-usThu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/Thu, 02 Jul 2026 00:00:00 +0000https://blog.msnieman.com/writeups/ghost/LDAP injection on a Next.js intranet leaks a service-account secret that unlocks Gitea; a custom Ghost CMS file-read exposes an RCE dev key; from there, MSSQL linked-server SA impersonation provides a Windows foothold, and a cross-forest Kerberos golden ticket via Mimikatz completes the domain compromise.https://blog.msnieman.com/writeups/bloodflow/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/bloodflow/A publicly exposed n8n workflow automation instance is vulnerable to CVE-2026-21858, an unauthenticated arbitrary file read to RCE chain, yielding a shell on the target.https://blog.msnieman.com/writeups/wingdata/Tue, 17 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/wingdata/Wing FTP Server 7.4.3 exposes an unauthenticated RCE endpoint; cracking the salted password hashes from its XML config yields SSH access as a system user, and a root-owned backup script extracting untrusted zip archives is exploited via CVE-2025-4138 (Python zipslip) for privilege escalation.https://blog.msnieman.com/writeups/reactoops/Wed, 14 Jan 2026 00:00:00 +0000https://blog.msnieman.com/writeups/reactoops/A vulnerable React application is exploited via CVE-2025-55182 (react2shell), yielding unauthenticated remote code execution and a shell that reads the flag written to /app/flag.txt.https://blog.msnieman.com/writeups/adselfservice/Thu, 28 Aug 2025 00:00:00 +0000https://blog.msnieman.com/writeups/adselfservice/An exposed ManageEngine ADSelfService Plus portal running version 6.1 is vulnerable to CVE-2021-40539 (REST API authentication bypass to RCE), yielding a webshell that runs as NT AUTHORITY\SYSTEM and direct access to both flags.