webPromedium
Lab 364 — PulseRelay — Path Traversal to RCE via Plugin Upload
hackadvisor
Task: Enterprise messaging platform (PulseRelay) on Jetty with plugin management and broken access control on user creation. Solution: Escalate privileges by creating admin user via unprotected endpoint, then upload JAR containing JSP webshell via plugin system for RCE.
$ ls tags/ techniques/
rcefile_uploadprivilege_escalationbroken_access_controljsphoneypot_flagjettyjar_uploadplugin_systemauto_deploy
csrf_token_extractionhoneypot_flag_identificationbroken_access_control_role_assignmentprivilege_escalation_via_user_creationjsp_webshell_in_jar_uploadjetty_plugin_auto_deploy_rce
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]PathRelay — Limited Path Traversal to RCE— hackadvisor
- [web][Pro]DecisionForge— hackadvisor
- [web][Pro]Lab 326 — PulseBoard — NoSQL Injection in Authentication— hackadvisor
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
- [web][Pro]Lab 247 — PulseGuard — SSTI in Webhook Notification Templates— hackadvisor