$ grep -r "reverse-shell"
A portfolio site's login form is bypassed with a SQL injection, exposing an image upload page. Weak content validation is defeated by prepending PNG magic bytes to a PHP webshell, giving code execution as www-data and a reverse shell. A database config file leaks MySQL credentials; mysqldump recovers a plaintext password that is reused to become theseus. A custom SUID binary, /bin/sysinfo, calls helper tools by relative name, so PATH hijacking a malicious lshw yields a shell as root.
A Spring Boot app leaks an admin session cookie through an exposed Actuator endpoint, giving access to a dashboard whose SSH feature is vulnerable to command injection. A reverse shell leads to the application JAR, which holds hardcoded PostgreSQL credentials; the database yields a bcrypt hash that cracks to the password for the user josh. josh may run ssh as root via sudo, and the LocalCommand directive is abused to execute a shell as root.
A GraphQL API on port 3000 leaks HelpDeskZ credentials through introspection; the cracked password logs us into the help desk, whose unauthenticated arbitrary file upload yields a reverse shell. An outdated kernel is then exploited with CVE-2017-16995 for root.