PACK2THEROOT

OFFSEC - Proving Grounds - FLINK

1 September 2026·1835 words·9 mins

OFFSEC PG PRACTICE APACHE FLINK MSFCONSOLE PACK2THEROOT CVE-2026-41651

Apache Flink 2.0.0 on port 8081 is exploited via Metasploit’s JAR Upload RCE module for initial access. LinPEAS identifies Pack2TheRoot (CVE-2026-41651), enabling privilege escalation to root.

OFFSEC - Proving Grounds - ZAB

30 August 2026·1473 words·7 mins

OFFSEC PG PRACTICE MAGE PACK2THEROOT CVE-2026-41651

Gobuster finds local.txt on port 80. A Mage web app on port 6789 provides browser-based terminal access. The server is vulnerable to Pack2TheRoot (CVE-2026-41651), enabling privilege escalation to root.

OFFSEC - Proving Grounds - BACKUPBUDDY

28 August 2026·1608 words·8 mins

OFFSEC PG PRACTICE PATH TRAVERSAL SSH2JOHN JOHN PACK2THEROOT CVE-2026-41651

PHP File Manager on port 80 allows default login and path traversal to Brian’s SSH key. SSH access is gained, then CVE-2026-41651 is exploited to become root.

OFFSEC - Proving Grounds - MEDITRACK

18 August 2026·2059 words·10 mins

OFFSEC PG PRACTICE SQLITE GITEA FLASK PICKLE PACK2THEROOT CVE-2026-41651

SQLi on port 9000 dumps creds. Crack meditrackDev for Gitea access. Find Flask secret to forge admin cookie, then import snapshot for Pickle RCE. Escalate to root via CVE-2026-41651.