CozyHosting
A Spring Boot app leaks an admin session cookie through an exposed Actuator endpoint, giving access to a dashboard whose SSH feature is vulnerable to command injection. A reverse shell leads to the application JAR, which holds hardcoded PostgreSQL credentials; the database yields a bcrypt hash that cracks to the password for the user josh. josh may run ssh as root via sudo, and the LocalCommand directive is abused to execute a shell as root.