Tag: Command Injection | Youssef Kessentini

Created2026-10-14|HTB Machines|HackTheBox•Linux•Command Injection•Path Traversal•CVE-2025-66034•CVE-2024-25082•fontTools•FontForge•Git Leak•Sudo Misconfiguration

HTB Medium Linux machine — credentials from an exposed .git, a fontTools arbitrary file write (CVE-2025-66034) for a webshell, FontForge archive command injection (CVE-2024-25082) to reach steve, and root by overwriting /etc/sudoers through a setuptools path traversal

OS Command Injection

Created2026-08-29|Portswigger|Command Injection•Portswigger•Web Security

What I learned after completing the OS Command Injection path in Portswigger

CCTV

Created2026-07-11|HTB Machines|HackTheBox•Linux•SQL Injection•CVE-2024-51482•CVE-2025-60787•ZoneMinder•motionEye•Command Injection•Default Creds•Credential Cracking

HTB Easy Linux machine — default creds into ZoneMinder, time-based SQL injection (CVE-2024-51482) to dump password hashes, and root via motionEye command injection (CVE-2025-60787)