--- title: "#command-injection articles | Hashnode" description: "Explore 34 articles tagged #command-injection on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/command-injection" --- Tag # #command-injection 34 posts · 1 followers [404 Founders](https://hashnode.com/@404-founders) · [Oct 26](https://hashnode.com/posts/alert-collabora-nextcloud-cve-2026-110447/6ae3586b4fc984aa1d7a20c4) ### [Nextcloud Collabora CVE-2026-110447: Webshells via proxy.php](https://404-founders.com/blog/alert-collabora-nextcloud-cve-2026-110447?utm_source=hashnode&utm_medium=feed) CVE-2026-110447 CVSS 9.2 command injection in Nextcloud Collabora CODE Server. CISA KEV, active webshell attacks since September. Patch to 26.4.303. 5 min read · [404-founders.com](https://404-founders.com/blog/alert-collabora-nextcloud-cve-2026-110447?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 22](https://hashnode.com/posts/tryhackme-python-playground-writeup/6ab26fe5d90980069bb54b19) ### [TryHackMe: Python Playground Writeup](https://exploitnotes.hashnode.dev/tryhackme-python-playground-writeup?utm_source=hashnode&utm_medium=feed) Python Playground TryHackMe writeup covering Python sandbox bypass, RCE, credential recovery, Docker container escape, and SUID privilege escalation. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-python-playground-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-git-gud-writeup-2026/6a8b1219fb8f3d1521b65327) ### [BrunnerCTF : Git Gud Writeup (2026)](https://exploitnotes.hashnode.dev/brunnerctf-git-gud-writeup-2026?utm_source=hashnode&utm_medium=feed) Exploit an attacker-controlled .git/config through core.fsmonitor to achieve server-side RCE and leak the flag via Git status output. 4 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-git-gud-writeup-2026?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 18](https://hashnode.com/posts/tryhackme-athena-writeup/6a8481693fa56856fb89762c) ### [TryHackMe : Athena Writeup](https://exploitnotes.hashnode.dev/tryhackme-athena-writeup?utm_source=hashnode&utm_medium=feed) Solve TryHackMe Athena using anonymous SMB, newline command injection, systemd script hijacking, and a modified Diamorphine LKM rootkit. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-athena-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 12](https://hashnode.com/posts/tryhackme-lookup-writeup/6a7c3cee9e3057c36d0f3695) ### [TryHackMe : Lookup writeup](https://exploitnotes.hashnode.dev/tryhackme-lookup-writeup?utm_source=hashnode&utm_medium=feed) Complete TryHackMe Lookup walkthrough covering username enumeration, elFinder RCE, SSH access, and sudo look abuse to read the root flag. step by step 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-lookup-writeup?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/tryhackme-lookup-writeup/6a7c3cee9e3057c36d0f3695) [kareem Mohamed](https://hashnode.com/@kmbkareem) · [Aug 10](https://hashnode.com/posts/infinity-pool-a-walkthrough-of-thm-hacker-holidays-day-11/6a79d0cc358ba2bb1bd44d80) ### [Infinity Pool: A walkthrough of THM Hacker Holidays - Day 11](https://kmb.hashnode.dev/infinity-pool-a-walkthrough-of-thm-hacker-holidays-day-11?utm_source=hashnode&utm_medium=feed) Step-by-step THM Hacker Holidays Day 11 walkthrough. Exploit command injection, SSH tunneling, and FreePBX automation with 0xY0K4\_CL4W. 4 min read · [kmb.hashnode.dev](https://kmb.hashnode.dev/infinity-pool-a-walkthrough-of-thm-hacker-holidays-day-11?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 7](https://hashnode.com/posts/tryhackme-infinity-pool-writeup/6a75b6399d823577138e3c3f) ### [TryHackMe : Infinity Pool Writeup](https://exploitnotes.hashnode.dev/tryhackme-infinity-pool-writeup?utm_source=hashnode&utm_medium=feed) Complete TryHackMe Infinity Loop walkthrough exploiting command injection, credential leaks, FreePBX, and root RCE to capture both flags! 11 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-infinity-pool-writeup?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/tryhackme-infinity-pool-writeup/6a75b6399d823577138e3c3f) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 8](https://hashnode.com/posts/tryhackme-breakme-writeup/6a769e823bb69cf4b4c19181) ### [TryHackMe : BreakMe Writeup](https://exploitnotes.hashnode.dev/tryhackme-breakme-writeup?utm_source=hashnode&utm_medium=feed) Complete TryHackMe BreakMe walkthrough covering WordPress privesc, command injection, TOCTOU race, SSH key cracking, and Python jail escape to root!! 17 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-breakme-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jul 17](https://hashnode.com/posts/hackthebox-void-whispers-writeup/6a5a2fa0091a449c2ff7d47b) ### [HackTheBox : Void Whispers Writeup](https://exploitnotes.hashnode.dev/hackthebox-void-whispers-writeup?utm_source=hashnode&utm_medium=feed) Learn how to exploit the Void Whispers challenge using OS command injection, bypass the space filter with IFS, and retrieve the flag safely. Now! Fast 4 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-void-whispers-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jun 26](https://hashnode.com/posts/hackthebox-orion-writeup/6a3eb39c230865773e77319a) ### [HackTheBox: Orion Writeup](https://exploitnotes.hashnode.dev/hackthebox-orion-writeup?utm_source=hashnode&utm_medium=feed) Complete HTB Orion walkthrough covering Craft CMS RCE, credential extraction, password cracking, SSH access, and Linux root escalation. 14 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-orion-writeup?utm_source=hashnode&utm_medium=feed)