$#nosql-injection

Hacker Holidays — Day 7: Do Not Disturb

A NoSQL injection auth bypass leads to an EJS SSTI RCE, then an exposed Node --inspect debugger and disk-group membership chain all the way to a raw block-device read of root.txt.

• #hacker-holidays
• #nosql-injection
• #ssti
• #privesc