$ grep -r "privilege-escalation"
A MegaShopping web app accepts weak default credentials and parses user-supplied XML without protection, so an XXE payload reads arbitrary files from the host — including Daniel's SSH private key, which gives a foothold over SSH. A scheduled batch script, job.bat, is world-writable, so overwriting it with a netcat reverse-shell command and waiting for the task to fire returns a shell as Administrator.
A portfolio site's login form is bypassed with a SQL injection, exposing an image upload page. Weak content validation is defeated by prepending PNG magic bytes to a PHP webshell, giving code execution as www-data and a reverse shell. A database config file leaks MySQL credentials; mysqldump recovers a plaintext password that is reused to become theseus. A custom SUID binary, /bin/sysinfo, calls helper tools by relative name, so PATH hijacking a malicious lshw yields a shell as root.