$#password-reuse

2 writeups

Two-headed penguin illustration inside an orange ring badge

HackTheBoxMedium10 Aug 2026

HTB: Abducted

A guest-writable printer share on Samba is pre-auth RCE (CVE-2026-4480), rclone's reversible "obscure" format hands over a reused SSH password, and a Samba force-user share with insecure wide-link support becomes an arbitrary-file-write into a root-writable systemd drop-in.

#samba
#rce
#privesc
#password-reuse

Stylized flame inside an orange ring badge

HackTheBoxMedium05 Aug 2026

HTB: Fireflow

An unauthenticated Langflow RCE (CVE-2026-33017) leads to leaked superuser credentials via process environment, password reuse for user access, a JWT alg:none forgery against a custom MCP server, and finally a Kubernetes nodes/proxy verb bypass to a privileged pod for host root.

#rce
#jwt
#kubernetes
#privesc