Luiz Cunha

Anonymous FTP leaks an SNMP string, SNMP leaks a service password, a System32 dump gives the Administrator hash, and SeImpersonatePrivilege finishes it.

A Flask dice app drops its Bearer cookie into a SQL query, MySQL as root gives file read and write, and a privileged Compose job hands over the host.

An SMB null session leaks a password in a description field, then Shadow Credentials, a credential buried in a custom binary, a Kerberoast and RBCD over the DC.

A Flask note library hands out any local file, /proc/self/environ leaks the admin secret, render_template_string gives a shell, and a SUID fetcher writes UID 0.

Anonymous FTP exposes a Roundcube backup with database credentials, CVE-2025-49113 gives code execution, and a root cron running tar with a wildcard roots it.