◆
ServMon: NVMS-1000 Directory Traversal to NSClient++ RCE
Hack The Box write-up for the ServMon machine. Anonymous FTP exposes internal notes pointing to a password file on a user's desktop, a directory traversal in NVMS-1000 reads the file remotely, password spraying lands SSH as Nadine, and authenticated RCE against NSClient++ through an SSH tunnel escalates to SYSTEM.
—11 min read