Chaining an Apache NiFi H2 Database RCE for initial access to exploit an internal OPC UA service, manipulating PLC safety variables to trigger a conditional sudo privilege escalation for root access.

Chaining an unauthenticated Mirth Connect RCE with database credential recovery for initial access to exploit a Python-based server-side template injection for root access.

Chaining an Apache CXF SSRF with a Hoverfly middleware RCE for initial access to exploit a world-writable system binary for root access.

Chaining an unauthenticated password reset with a Flowise RCE for initial access to exploit a symlink-based vulnerability in an internal Gogs service for root access.

Chaining API credential leaks with Cacti command injection, and a Docker api exposure to gain root access.