$#command-injection

Hacker Holidays — Day 11: Infinity Pool

The same unsanitised shell=True command injection shows up twice on this box — first as a low-priv foothold via a "connectivity check" tool, then again in a root-owned automation service reached by pivoting through internal-only FreePBX and Chisel tunnels.

• #hacker-holidays
• #command-injection
• #pivoting
• #privesc