A Flask booking app reads files by client-supplied path, and a self-hosted Gitea instance leaks the on-disk location of its own SQLite database — chaining the two pulls gitea.db off the box, where a crackable PBKDF2 hash for the developer account doubles as the SSH password.

The bank website's team page leaks employee names that convert to AD usernames; one account has Kerberos pre-authentication disabled, its AS-REP hash cracks offline to `Thestrokes23`, and WinRM access as fsmith delivers the user flag.

An anonymously readable SMB share leaks a WinRM credential backup whose zip and PFX are protected by dictionary-weak passwords; cracking both with john exports a client certificate that authenticates to WinRM over TLS for the user flag.

An RPC null session exposes all domain users; svc-alfresco has Kerberos pre-authentication disabled, so AS-REP Roasting returns an offline-crackable hash that cracks to s3rvice, granting a WinRM shell and the user flag.

An anonymous SMB share leaks a .NET helper binary whose hardcoded, XOR-obfuscated LDAP bind password is trivially reversed; binding to LDAP exposes a user whose info attribute stores a cleartext password, granting a WinRM shell and the user flag.

An anonymously readable SMB Replication share exposes a Groups.xml file with a GPP-encrypted password that decrypts instantly with gpp-decrypt, granting credentials to SVC_TGS and a foothold into the domain.

A Tiny File Manager instance left on shipped default credentials allows uploading a PHP reverse shell for a www-data foothold; a hidden vhost validates tickets over a WebSocket vulnerable to blind SQL injection, and sqlmap dumps reusable SSH credentials for the user flag.

SNMP's default community string exposes a plaintext service-account password from a running process's argument list, which authenticates to Nagios XI where CVE-2023-40931 SQL injection extracts the admin API key, enabling malicious check-command injection that writes an SSH key and lands a shell as the nagios user.

Anonymous FTP leaks operator notes pointing at a desktop password file; an unauthenticated directory-traversal flaw in the NVMS-1000 web app (CVE-2019-20085) reads that file over HTTP, and spraying the recovered passwords over SSH lands a shell as nadine for the user flag.

A site that auto-installs submitted Chrome extensions in a headless browser leaks internal vhost traffic, exposing a Gitea repo whose Flask app is vulnerable to bash arithmetic command injection delivered through a second malicious extension.

A public Request Baskets instance is vulnerable to SSRF (CVE-2023-27163), letting us proxy into a firewalled internal Maltrail v0.53 service, which in turn has an unauthenticated OS command injection (CVE-2023-31543) that hands back a reverse shell as puma for the user flag.

Jenkins 2.441 was vulnerable to CVE-2024-23897, an unauthenticated arbitrary file read via the CLI's @filename argument expansion, which exposed the user flag and jennifer's bcrypt hash directly, then cracking the hash to 'princess' gave Script Console access to decrypt a stored root SSH key.

A network printer admin panel stores LDAP service-account credentials and lets the directory server be set to an arbitrary host; pointing it at a rogue listener on port 389 leaks the svc-printer password in cleartext, which logs in over WinRM for the user flag.

An exposed .git directory leaks an .htaccess rule requiring a custom Special-Dev header to reach a dev vhost whose file upload accepted zip-inside-.txt archives executable via the phar:// PHP stream wrapper, giving RCE as www-data and eventually root via a SUID Python2 binary and sudo easy_install.

A default SNMP community string leaks a process command line containing cleartext SSH credentials; an internal-only PandoraFMS v7.0NG.742 instance reached over an SSH SOCKS tunnel is then chained — an unauthenticated SQL injection (CVE-2021-32099) steals a privileged session and an events command injection (CVE-2021-32098) returns a reverse shell for the user flag.

Starting with assume-breach credentials, judith.mader's WriteOwner right on the management AD group was abused to grant herself GenericWrite over management_svc, enabling a shadow credentials attack that yielded management_svc's NT hash and a WinRM foothold.

A Roundcube 1.6.10 webmail instance reached via a fuzzed vhost is exploited with provided credentials through CVE-2025-49113 — an unvalidated _from parameter that triggers PHP object deserialization for RCE — and a reversibly-encrypted password stored in the Roundcube session table is recovered with the app's own decrypt.sh to pivot to a user over SSH.

An SMB null-session exposes all domain usernames via RID cycling; username-as-password spraying finds operator:operator, which reaches MSSQL where xp_dirtree uncovers a downloadable backup ZIP containing plaintext credentials for raven with WinRM access.

An exposed source backup reveals an upload filter that trusts forged PNG magic bytes and only checks the trailing extension, so a shell.php.png webshell yields code execution as apache; a root cron job that feeds upload filenames straight into a shell exec() is then abused with a malicious filename to pivot to the guly user and the user flag.

An unauthenticated MSSQL UNION injection on watch.streamio.htb dumped all user password hashes; cracking them gave admin login, and the admin panel's debug parameter passed user input directly to PHP include(), enabling source disclosure via php://filter and Remote File Inclusion through master.php's eval(file_get_contents()) to land a reverse shell.