Linux

MCPJam Inspector RCE (CVE-2026-23744) through unauthenticated stdio server injection, pivoting via an exposed Jupyter session to reach a backdoored OpsMCP service that leaks the root SSH key.

FreePBX unauthenticated RCE (CVE-2025-57819) chained with five distinct incrond-based privilege escalation paths to achieve root via an Asterisk daemon running under incrond.

Overview Cap is a retired easy Linux box which demonstrates how small web authorization flaws and insecure protocol usage can chain into full system compromise. it teaches three core ideas: Basic service enumeration (FTP/SSH/HTTP) IDOR (Insecure Direct Object Reference) in a web app that exposes other users’ files Credential discovery from a PCAP file, then privilege escalation via Linux capabilities (cap_setuid) 🔒 This section is password protected. Decrypt 1. Recon Start with a full TCP scan and default scripts/version detection: ...