https://lukaszpastuszak.dev/tags/command-injection/Recent content in Command-Injection on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/postman/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/postman/An unauthenticated Redis instance gives an RDB write primitive for an SSH key, an encrypted id_rsa.bak cracks to a reused password for Matt, and Webmin 1.910 (CVE-2019-12840) command injection gives root.https://lukaszpastuszak.dev/writeups/redcross/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/redcross/Shared PHP sessions between subdomains, an NSS + PostgreSQL account backend, command injection in a setuid wrapper, and a x64 ROP buffer overflow, with multiple paths at every stage.