{"vulnerability": "cve-2020-6207", "sightings": [{"uuid": "24558ebf-e16f-4580-a8dc-bb2c62fb1c21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "c5e3beb4-0add-4eee-923c-3b4f41c312ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "07b95ed9-445a-4059-8cef-0d87ad7e7e81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970934", "content": "", "creation_timestamp": "2024-12-24T20:21:58.267232Z"}, {"uuid": "1095e11e-6230-4269-9d8c-5d9fe129bb7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "0a7fb93b-e319-4f7d-8e35-090383d98757", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:30.000000Z"}, {"uuid": "c604e2eb-3779-4ce2-9b8b-bad14fc66aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:49.000000Z"}, {"uuid": "12ccc11a-369e-4445-aaab-1ed09600a76e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb", "content": "", "creation_timestamp": "2021-03-25T21:56:17.000000Z"}, {"uuid": "08cf6bbc-e172-480a-b8d5-27221c33d617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:13:03.000000Z"}, {"uuid": "9bc6bb68-d09a-4d06-ab98-42bf4d76daa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/sap/cve_2020_6207_solman_rs.rb", "content": "", "creation_timestamp": "2021-03-25T21:56:17.000000Z"}, {"uuid": "7cde1835-a427-4501-a24b-205dc553f187", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-6207", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e54e5483-3d09-4b62-9943-3ff3be833bb6", "content": "", "creation_timestamp": "2026-02-02T12:29:02.311364Z"}, {"uuid": "6f672f12-5d44-4277-860e-1e31acd959e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "published-proof-of-concept", "source": "https://t.me/cKure/3781", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 #Zeroday: A publicly available fully-functional exploit that could be used to target SAP enterprise software.\n\nThe exploit leverages a vulnerability, tracked as\u00a0CVE-2020-6207, that stems from a missing authentication check in SAP Solution Manager (SolMan) version 7.2.\n\nhttps://thehackernews.com/2021/01/beware-fully-functional-released-online.html", "creation_timestamp": "2021-01-23T09:55:55.000000Z"}, {"uuid": "5bfbf68a-a531-4d96-ab14-1a41e9e98c06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "Telegram/2xenWatdi3Bm_NksPCE-fp5bJiS9z03rfFXupGvGflNqjeR_", "content": "", "creation_timestamp": "2025-01-30T02:17:48.000000Z"}, {"uuid": "19ef7481-c29d-4b0d-b4a8-98df14d2d697", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://t.me/arpsyndicate/179", "content": "#ExploitObserverAlert\n\nCVE-2020-6207\n\nDESCRIPTION: Exploit Observer has 21 entries related to CVE-2020-6207. SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.\n\nFIRST-EPSS: 0.974210000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-11-17T02:27:15.000000Z"}, {"uuid": "d302b863-eaa9-4eb7-8e97-1e5f3d6ccd49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "published-proof-of-concept", "source": "Telegram/mzMPJUtI8bSjYe6VDdVcO-nYDGgxJsJc_GR3bIyj6eBfmw", "content": "", "creation_timestamp": "2021-01-15T03:33:25.000000Z"}, {"uuid": "8a8482f9-7d3f-4db1-8c1f-a575cdf126cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2562", "content": "#Analytics\n10 most exploited vulnerabilities of the week (january 18-24)\nCVE-2020-14882/883:\nhttps://t.me/cybersecuritytechnologies/2004\nCVE-2021-2109:\nhttps://t.me/cybersecuritytechnologies/2540\nCVE-2020-6207:\nhttps://t.me/cybersecuritytechnologies/2506\nCVE-2021-3114/3115:\nArbitrary command execution in Go\nhttps://blog.golang.org/path-security\nCVE-2019-8791:\nhttps://t.me/cybersecuritytechnologies/2535\nCVE-2021-3129:\nhttps://t.me/cybersecuritytechnologies/2557\nCVE-2020-1033:\nhttps://t.me/cybersecuritytechnologies/2528\nCVE-2019-8792:\nhttps://t.me/cybersecuritytechnologies/2535", "creation_timestamp": "2021-01-24T14:36:01.000000Z"}, {"uuid": "6a9ddca7-a3f1-4b78-bee7-19956f20fc11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2506", "content": "#Research\n\"An Unauthenticated Journey to Root: Pwning Your Company's Enterprise Software Servers\", 2020.\n]-> PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)\nhttps://github.com/chipik/SAP_EEM_CVE-2020-6207", "creation_timestamp": "2021-01-16T11:50:06.000000Z"}, {"uuid": "28cbe90a-e3e6-4d1f-85c0-b3e209c2d667", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/42b03515-1e73-4929-9621-32c00935c9a6", "content": "", "creation_timestamp": "2026-06-19T12:48:03.886370Z"}, {"uuid": "413b30c3-1660-4ace-a669-ff6ae7877442", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bdd26347-139e-4ed5-a9b7-348cc7faca47", "content": "", "creation_timestamp": "2026-06-23T14:04:30.295741Z"}, {"uuid": "f2158c53-f1ce-44cf-9de5-ae8db817bdfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://t.me/cissp/2113", "content": "1. Confucius APT deploys Warzone RAT\nhttps://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat\n\n2. Analyzing Qakbot using Brim\u2019s No-code threat hunting\nhttps://medium.com/brim-securitys-knowledge-funnel/analyzing-qakbot-using-brims-no-code-threat-hunting-8e3415c3338d\n\nMultiple vulnerabilities in FiberHome (GPON FTTH, software ver. RP2602) HG6245D routers (PoCs)\nhttps://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html\n\n\"An Unauthenticated Journey to Root: Pwning Your Company's Enterprise Software Servers\", 2020.\n]-> PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)\nhttps://github.com/chipik/SAP_EEM_CVE-2020-6207\n\n1. 0Day RCE in Apple's Travel Portal (PoC)\nhttps://github.com/httpvoid/writeups/blob/main/Apple-RCE.md\n\n2. Stealing Your Private YouTube Videos\nhttps://bugs.xdavidhu.me/google/2021/01/11/stealing-your-private-videos-one-frame-at-a-time\n\n1. 0day VirtualBox 6.1.16 Escape for RealWorld CTF 2020/2021\nhttps://secret.club/2021/01/14/vbox-escape.html\nPoC:\nhttps://github.com/Sauercloud/RWCTF21-VirtualBox-61-escape\n\n2. Lateral Movement using DCOM Objects\nhttps://www.scorpiones.io/articles/lateral-movement-using-dcom-objects", "creation_timestamp": "2026-09-01T17:01:06.283287Z"}, {"uuid": "99c472ad-e884-406d-b989-97f5367c5a58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://t.me/cissp/2113", "content": "1. Confucius APT deploys Warzone RAT\nhttps://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat\n\n2. Analyzing Qakbot using Brim\u2019s No-code threat hunting\nhttps://medium.com/brim-securitys-knowledge-funnel/analyzing-qakbot-using-brims-no-code-threat-hunting-8e3415c3338d\n\nMultiple vulnerabilities in FiberHome (GPON FTTH, software ver. RP2602) HG6245D routers (PoCs)\nhttps://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html\n\n\"An Unauthenticated Journey to Root: Pwning Your Company's Enterprise Software Servers\", 2020.\n]-> PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)\nhttps://github.com/chipik/SAP_EEM_CVE-2020-6207\n\n1. 0Day RCE in Apple's Travel Portal (PoC)\nhttps://github.com/httpvoid/writeups/blob/main/Apple-RCE.md\n\n2. Stealing Your Private YouTube Videos\nhttps://bugs.xdavidhu.me/google/2021/01/11/stealing-your-private-videos-one-frame-at-a-time\n\n1. 0day VirtualBox 6.1.16 Escape for RealWorld CTF 2020/2021\nhttps://secret.club/2021/01/14/vbox-escape.html\nPoC:\nhttps://github.com/Sauercloud/RWCTF21-VirtualBox-61-escape\n\n2. Lateral Movement using DCOM Objects\nhttps://www.scorpiones.io/articles/lateral-movement-using-dcom-objects", "creation_timestamp": "2026-09-02T01:04:56.216755Z"}, {"uuid": "9498ad31-cec0-4fee-9d79-39392771fd2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb", "content": "{\"actions\": [{\"description\": \"Exec OS command on connected agent\", \"name\": \"EXEC\"}, {\"description\": \"List connected agents\", \"name\": \"LIST\"}, {\"description\": \"Get file with SolMan credentials from connected agent\", \"name\": \"SECSTORE\"}, {\"description\": \"Send SSRF from connected agent\", \"name\": \"SSRF\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"Yvan Genuer\", \"Pablo Artuso\", \"Dmitry Chastuhin\", \"Vladimir Ivanov\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem) of\\n          SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication\\n          checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents,\\n          send HTTP request (SSRF), and execute OS commands on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8.\\n\\n          Successful exploitation of the vulnerability enables unauthenticated remote attackers to achieve SSRF and execute OS commands from the agent connected\\n          to SolMan as a user from which the SMDAgent service starts, usually the daaadm.\", \"disclosure_date\": \"2020-10-03\", \"fullname\": \"auxiliary/admin/sap/cve_2020_6207_solman_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-12 14:18:57 +0000\", \"name\": \"SAP Solution Manager remote unauthorized OS commands execution\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/sap/cve_2020_6207_solman_rce\", \"references\": [\"CVE-2020-6207\", \"URL-https://i.blackhat.com/USA-20/Wednesday/us-20-Artuso-An-Unauthenticated-Journey-To-Root-Pwning-Your-Companys-Enterprise-Software-Servers-wp.pdf\", \"URL-https://github.com/chipik/SAP_EEM_CVE-2020-6207\"], \"rport\": 50000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:54.873463Z"}, {"uuid": "003d264e-d35b-493a-8dd2-c45e4822bb38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/sap/cve_2020_6207_solman_rs.rb", "content": "{\"aliases\": [], \"arch\": \"x64, x86\", \"author\": [\"Yvan Genuer\", \"Pablo Artuso\", \"Dmitry Chastuhin\", \"Vladimir Ivanov\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem) of\\n          SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication\\n          checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get information about connected SMDAgents,\\n          send HTTP request (SSRF) and execute OS command on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8.\\n\\n          Successful exploitation will allow unauthenticated remote attackers to get reverse shell from connected to the SolMan\\n          agent as the user under which it runs SMDAgent service, usually daaadm.\", \"disclosure_date\": \"2020-10-03\", \"fullname\": \"exploit/multi/sap/cve_2020_6207_solman_rs\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:09 +0000\", \"name\": \"SAP Solution Manager remote unauthorized OS commands execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/sap/cve_2020_6207_solman_rs.rb\", \"platform\": \"Linux,Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/sap/cve_2020_6207_solman_rs\", \"references\": [\"CVE-2020-6207\", \"URL-https://i.blackhat.com/USA-20/Wednesday/us-20-Artuso-An-Unauthenticated-Journey-To-Root-Pwning-Your-Companys-Enterprise-Software-Servers-wp.pdf\", \"URL-https://github.com/chipik/SAP_EEM_CVE-2020-6207\"], \"rport\": 50000, \"session_types\": false, \"targets\": [\"Linux\", \"Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:28.367710Z"}, {"uuid": "25a4f04a-8448-4b0e-8b45-eeae240275b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2113", "content": "1. Confucius APT deploys Warzone RAT\nhttps://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat\n\n2. Analyzing Qakbot using Brim\u2019s No-code threat hunting\nhttps://medium.com/brim-securitys-knowledge-funnel/analyzing-qakbot-using-brims-no-code-threat-hunting-8e3415c3338d\n\nMultiple vulnerabilities in FiberHome (GPON FTTH, software ver. RP2602) HG6245D routers (PoCs)\nhttps://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html\n\n\"An Unauthenticated Journey to Root: Pwning Your Company's Enterprise Software Servers\", 2020.\n]-> PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)\nhttps://github.com/chipik/SAP_EEM_CVE-2020-6207\n\n1. 0Day RCE in Apple's Travel Portal (PoC)\nhttps://github.com/httpvoid/writeups/blob/main/Apple-RCE.md\n\n2. Stealing Your Private YouTube Videos\nhttps://bugs.xdavidhu.me/google/2021/01/11/stealing-your-private-videos-one-frame-at-a-time\n\n1. 0day VirtualBox 6.1.16 Escape for RealWorld CTF 2020/2021\nhttps://secret.club/2021/01/14/vbox-escape.html\nPoC:\nhttps://github.com/Sauercloud/RWCTF21-VirtualBox-61-escape\n\n2. Lateral Movement using DCOM Objects\nhttps://www.scorpiones.io/articles/lateral-movement-using-dcom-objects", "creation_timestamp": "2026-09-11T21:00:05.132149Z"}, {"uuid": "b2851723-221c-42f6-b166-a394695272ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-6207", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2113", "content": "1. Confucius APT deploys Warzone RAT\nhttps://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat\n\n2. Analyzing Qakbot using Brim\u2019s No-code threat hunting\nhttps://medium.com/brim-securitys-knowledge-funnel/analyzing-qakbot-using-brims-no-code-threat-hunting-8e3415c3338d\n\nMultiple vulnerabilities in FiberHome (GPON FTTH, software ver. RP2602) HG6245D routers (PoCs)\nhttps://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html\n\n\"An Unauthenticated Journey to Root: Pwning Your Company's Enterprise Software Servers\", 2020.\n]-> PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)\nhttps://github.com/chipik/SAP_EEM_CVE-2020-6207\n\n1. 0Day RCE in Apple's Travel Portal (PoC)\nhttps://github.com/httpvoid/writeups/blob/main/Apple-RCE.md\n\n2. Stealing Your Private YouTube Videos\nhttps://bugs.xdavidhu.me/google/2021/01/11/stealing-your-private-videos-one-frame-at-a-time\n\n1. 0day VirtualBox 6.1.16 Escape for RealWorld CTF 2020/2021\nhttps://secret.club/2021/01/14/vbox-escape.html\nPoC:\nhttps://github.com/Sauercloud/RWCTF21-VirtualBox-61-escape\n\n2. Lateral Movement using DCOM Objects\nhttps://www.scorpiones.io/articles/lateral-movement-using-dcom-objects", "creation_timestamp": "2026-09-12T00:00:29.691486Z"}]}