Broker
An outdated Apache ActiveMQ broker is vulnerable to unauthenticated RCE (CVE-2023-46604), giving a shell as activemq. A sudo rule allowing nginx to be run as root is abused — a malicious config turns nginx into a WebDAV server that writes an SSH key into root's authorized_keys for a root login.