Oouch

$ tldr OAuth logic break → Bearer token theft → uWSGI RCE → DBus privesc

·	·
Operating system	Linux
Difficulty	Hard
Vector	Linux privesc
IP	`10.10.10.177`
Retirement date	2020-08-01
Skills	FTP Enumeration Abusing OAuth Endpoint Virtual Hosting Enumeration Breaking OAuth Logic - Authorize as Administrator Registering a new application - Django Docs Abusing Authorization Workflow Token Stealing Playing with Bearer Tokens - Abusing Authentication Information Leakage Host Discovery && Port Discovery - Bash Scripting PIVOTING UWSGI Exploitation [RCE] - User Pivoting Abusing DBUS Message [Privilege Escalation]

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Subdomain Enumeration	HackTricks	Open
Information Leakage	HackTricks	Open
Port Forwarding / Pivoting	HackTricks	Open
OAuth Authentication Vulnerabilities	PortSwigger	Open
Remote Code Execution (RCE)	HackTricks	Open

Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-07-13