Exploiting unauthenticated RCE in Wing FTP Server for initial access and abusing an insecure tar archive restore script for root privileges.

Chaining RCE in MCPJam with an LFI-to-RCE pivot in PrivateBin to exploit an internal Docker management service for root access.

Exploiting XSLT injection for arbitrary file write to achieve RCE via cron jobs, followed by priv-esc through a vulnerable needrestart version.

Exploiting an exposed Git repository, SQL injection, and dynamic rule execution to obtain root access

Bypassing pac4j-jwt authentication with a forged JWE token and exploiting SSH Certificate Authorities for root access