2026-11-04T14:02:20Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:02:21Z attached channel.png (68 bytes, image/png) -> 2026-11-04T14:04:56Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:04:57Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/1 2026-11-04T14:04:57Z recovered exfil-channel blob key from the signed disk token: ao2rd6serpk1ybrq01f9umu6j26a 2026-11-04T14:04:57Z exfiltration channel on disk: /app-fixed/storage/ao/2r/ao2rd6serpk1ybrq01f9umu6j26a 2026-11-04T14:04:58Z attached payload.dat (56 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/2 2026-11-04T14:04:58Z recovered write-payload blob key from the signed disk token: n81hy0reysr5jdvsbxwlb92iw1yk 2026-11-04T14:04:58Z write payload (56 bytes) on disk: /app-fixed/storage/n8/1h/n81hy0reysr5jdvsbxwlb92iw1yk 2026-11-04T14:04:58Z attached script.msl (1900 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/3 2026-11-04T14:04:58Z recovered msl-script blob key from the signed disk token: i1k5h4uzq51uhjs395w8ya99yuf3 2026-11-04T14:04:58Z MSL script on disk: /app-fixed/storage/i1/k5/i1k5h4uzq51uhjs395w8ya99yuf3 2026-11-04T14:04:58Z delivering the SVG that reaches the MSL coder through the analyzer at attach time 2026-11-04T14:04:58Z attached vector.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/4 2026-11-04T14:04:58Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:04:59Z exfiltrated 68 bytes through the attacker's own blob (SECRET_KEY_BASE present: False, planted credential recovered: False) 2026-11-04T14:04:59Z response after the template write contains command output: None 2026-11-04T14:04:59Z server-side RCE marker: '' 2026-11-04T14:04:59Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 68, "exfil_contains_secret_key_base": false, "exfil_contains_canary": false, "rce_response_evidence": null, "rce_marker": "", "rce_ok": false} 2026-11-04T14:08:35Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:08:36Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/1 2026-11-04T14:08:36Z recovered exfil-channel blob key from the signed disk token: 5mrsfrs5u8lz4jhdge8hfohmikxr 2026-11-04T14:08:36Z exfiltration channel on disk: /app-fixed/storage/5m/rs/5mrsfrs5u8lz4jhdge8hfohmikxr 2026-11-04T14:08:36Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/2 2026-11-04T14:08:36Z recovered exfil-canary blob key from the signed disk token: j4polddpd3ntlaw65jtu9lysrr14 2026-11-04T14:08:37Z attached payload.dat (56 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/3 2026-11-04T14:08:37Z recovered write-payload blob key from the signed disk token: r4qxdaxabpif8yzvpby2g6gu9td0 2026-11-04T14:08:37Z write payload (56 bytes) on disk: /app-fixed/storage/r4/qx/r4qxdaxabpif8yzvpby2g6gu9td0 2026-11-04T14:08:37Z attached script_env64.msl (748 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/4 2026-11-04T14:08:37Z recovered msl-env64 blob key from the signed disk token: 8tq63oqngnjtaju5h7xkt9xxu200 2026-11-04T14:08:37Z attached script_env128.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/5 2026-11-04T14:08:37Z recovered msl-env128 blob key from the signed disk token: 58a94o9pg863g997wbnoky116kwv 2026-11-04T14:08:37Z attached script_env256.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/6 2026-11-04T14:08:37Z recovered msl-env256 blob key from the signed disk token: 3ftwdt7izlju7dhrc6sscnwmsrp9 2026-11-04T14:08:37Z attached script_env512.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/7 2026-11-04T14:08:38Z recovered msl-env512 blob key from the signed disk token: hws5ewki07rj2ah2tdblv48yamvo 2026-11-04T14:08:38Z attached script_env1024.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/8 2026-11-04T14:08:38Z recovered msl-env1024 blob key from the signed disk token: va4fh5pgacnu6rpv15yhkwkeym63 2026-11-04T14:08:38Z attached script_env2048.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/9 2026-11-04T14:08:38Z recovered msl-env2048 blob key from the signed disk token: fjl9y35kz1ko7qf60pv0faqpi5gi 2026-11-04T14:08:38Z attached script_env4096.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/10 2026-11-04T14:08:38Z recovered msl-env4096 blob key from the signed disk token: p120ix859tj5rkcwatzecrsevlqh 2026-11-04T14:08:38Z attached script_env8192.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/11 2026-11-04T14:08:38Z recovered msl-env8192 blob key from the signed disk token: 44nfhvtiijc5b1yn8t64olatxqki 2026-11-04T14:08:38Z delivering SVG env64: through the analyzer 2026-11-04T14:08:38Z attached vector_env64.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/12 2026-11-04T14:08:39Z environment read with 64 samples (128 bytes) returned 68 bytes 2026-11-04T14:08:39Z delivering SVG env128: through the analyzer 2026-11-04T14:08:39Z attached vector_env128.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/13 2026-11-04T14:08:39Z environment read with 128 samples (256 bytes) returned 68 bytes 2026-11-04T14:08:39Z delivering SVG env256: through the analyzer 2026-11-04T14:08:39Z attached vector_env256.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/14 2026-11-04T14:08:39Z environment read with 256 samples (512 bytes) returned 68 bytes 2026-11-04T14:08:39Z delivering SVG env512: through the analyzer 2026-11-04T14:08:39Z attached vector_env512.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/15 2026-11-04T14:08:39Z environment read with 512 samples (1024 bytes) returned 68 bytes 2026-11-04T14:08:39Z delivering SVG env1024: through the analyzer 2026-11-04T14:08:39Z attached vector_env1024.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/16 2026-11-04T14:08:39Z environment read with 1024 samples (2048 bytes) returned 68 bytes 2026-11-04T14:08:39Z delivering SVG env2048: through the analyzer 2026-11-04T14:08:39Z attached vector_env2048.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/17 2026-11-04T14:08:40Z environment read with 2048 samples (4096 bytes) returned 68 bytes 2026-11-04T14:08:40Z delivering SVG env4096: through the analyzer 2026-11-04T14:08:40Z attached vector_env4096.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/18 2026-11-04T14:08:40Z environment read with 4096 samples (8192 bytes) returned 68 bytes 2026-11-04T14:08:40Z delivering SVG env8192: through the analyzer 2026-11-04T14:08:40Z attached vector_env8192.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/19 2026-11-04T14:08:40Z environment read with 8192 samples (16384 bytes) returned 68 bytes 2026-11-04T14:08:40Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:08:40Z exfiltrated 68 bytes through the attacker's own blob (SECRET_KEY_BASE present: False, planted credential recovered: False) 2026-11-04T14:08:40Z response after the template write contains command output: None 2026-11-04T14:08:40Z server-side RCE marker: '' 2026-11-04T14:08:40Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 68, "exfil_contains_secret_key_base": false, "exfil_contains_canary": false, "canary_bytes": 68, "rce_response_evidence": null, "rce_marker": "", "rce_ok": false} 2026-11-04T14:11:40Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:11:41Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/1 2026-11-04T14:11:41Z recovered exfil-channel blob key from the signed disk token: gwutu1xi37f5vkvoy2slecc2h16l 2026-11-04T14:11:41Z exfiltration channel on disk: /app-fixed/storage/gw/ut/gwutu1xi37f5vkvoy2slecc2h16l 2026-11-04T14:11:41Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/2 2026-11-04T14:11:41Z recovered exfil-canary blob key from the signed disk token: 2hr7dwfecqxpt1wsxb9d4ppni435 2026-11-04T14:11:41Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/3 2026-11-04T14:11:41Z recovered write-payload blob key from the signed disk token: goxoafeni8xrych7ga1iwizqhi0c 2026-11-04T14:11:41Z write payload (80 bytes) on disk: /app-fixed/storage/go/xo/goxoafeni8xrych7ga1iwizqhi0c 2026-11-04T14:11:42Z attached script_env64.msl (748 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/4 2026-11-04T14:11:42Z recovered msl-env64 blob key from the signed disk token: qghmzoa9hp45vu0tomekczkey4y2 2026-11-04T14:11:42Z attached script_env128.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/5 2026-11-04T14:11:42Z recovered msl-env128 blob key from the signed disk token: zl4pefdn929bqufaqazhmpojiyhx 2026-11-04T14:11:42Z attached script_env256.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/6 2026-11-04T14:11:42Z recovered msl-env256 blob key from the signed disk token: 1xg36pohiqfc89ys9q8lyouvp3dx 2026-11-04T14:11:42Z attached script_env512.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/7 2026-11-04T14:11:42Z recovered msl-env512 blob key from the signed disk token: nn8i9oo7yoaak12fb63xzcks4t2w 2026-11-04T14:11:42Z attached script_env1024.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/8 2026-11-04T14:11:42Z recovered msl-env1024 blob key from the signed disk token: cfek3fbe0ibrha4xi6lwco0oi1ks 2026-11-04T14:11:42Z attached script_env2048.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/9 2026-11-04T14:11:42Z recovered msl-env2048 blob key from the signed disk token: tb0f27jzcmne6dso6ehqo7zjcgws 2026-11-04T14:11:43Z attached script_env4096.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/10 2026-11-04T14:11:43Z recovered msl-env4096 blob key from the signed disk token: pf1q53ylwdks7ktdga3ilgktxbya 2026-11-04T14:11:43Z attached script_env8192.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/11 2026-11-04T14:11:43Z recovered msl-env8192 blob key from the signed disk token: c00x3423mjzdzbee6oba6qcv9l9i 2026-11-04T14:11:43Z delivering SVG env64: through the analyzer 2026-11-04T14:11:43Z attached vector_env64.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/12 2026-11-04T14:11:43Z environment read with 64 samples (128 bytes) returned 68 bytes 2026-11-04T14:11:43Z delivering SVG env128: through the analyzer 2026-11-04T14:11:43Z attached vector_env128.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/13 2026-11-04T14:11:43Z environment read with 128 samples (256 bytes) returned 68 bytes 2026-11-04T14:11:43Z delivering SVG env256: through the analyzer 2026-11-04T14:11:43Z attached vector_env256.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/14 2026-11-04T14:11:43Z environment read with 256 samples (512 bytes) returned 68 bytes 2026-11-04T14:11:43Z delivering SVG env512: through the analyzer 2026-11-04T14:11:43Z attached vector_env512.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/15 2026-11-04T14:11:43Z environment read with 512 samples (1024 bytes) returned 68 bytes 2026-11-04T14:11:43Z delivering SVG env1024: through the analyzer 2026-11-04T14:11:43Z attached vector_env1024.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/16 2026-11-04T14:11:43Z environment read with 1024 samples (2048 bytes) returned 68 bytes 2026-11-04T14:11:43Z delivering SVG env2048: through the analyzer 2026-11-04T14:11:43Z attached vector_env2048.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/17 2026-11-04T14:11:44Z environment read with 2048 samples (4096 bytes) returned 68 bytes 2026-11-04T14:11:44Z delivering SVG env4096: through the analyzer 2026-11-04T14:11:44Z attached vector_env4096.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/18 2026-11-04T14:11:44Z environment read with 4096 samples (8192 bytes) returned 68 bytes 2026-11-04T14:11:44Z delivering SVG env8192: through the analyzer 2026-11-04T14:11:44Z attached vector_env8192.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/19 2026-11-04T14:11:44Z environment read with 8192 samples (16384 bytes) returned 68 bytes 2026-11-04T14:11:44Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:11:44Z exfiltrated 68 bytes through the attacker's own blob (SECRET_KEY_BASE present: False, planted credential recovered: False) 2026-11-04T14:11:44Z response after the template write contains command output: None 2026-11-04T14:11:44Z server-side RCE marker file content: '' (expected 'PRUVA_RCE_6407a176c7c5') 2026-11-04T14:11:44Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 68, "exfil_contains_secret_key_base": false, "exfil_contains_canary": false, "canary_bytes": 68, "rce_response_evidence": null, "rce_marker": "", "rce_marker_expected": "PRUVA_RCE_6407a176c7c5", "rce_ok": false} 2026-11-04T14:13:37Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:13:37Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/1 2026-11-04T14:13:38Z recovered exfil-channel blob key from the signed disk token: 3oezavzs2iqea93ckl1bks7o0wt8 2026-11-04T14:13:38Z exfiltration channel on disk: /app-fixed/storage/3o/ez/3oezavzs2iqea93ckl1bks7o0wt8 2026-11-04T14:13:38Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/2 2026-11-04T14:13:38Z recovered exfil-canary blob key from the signed disk token: pv0h1mqx6bz1aylycnzma28cns0c 2026-11-04T14:13:38Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/3 2026-11-04T14:13:38Z recovered write-payload blob key from the signed disk token: ec8134pvl446yv41wpy6xkr08j4r 2026-11-04T14:13:38Z write payload (80 bytes) on disk: /app-fixed/storage/ec/81/ec8134pvl446yv41wpy6xkr08j4r 2026-11-04T14:13:38Z attached script_env64.msl (748 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/4 2026-11-04T14:13:38Z recovered msl-env64 blob key from the signed disk token: km0nnwku57dgev5ula4s6macz4lt 2026-11-04T14:13:38Z attached script_env128.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/5 2026-11-04T14:13:38Z recovered msl-env128 blob key from the signed disk token: d62174egvg69ujku45oe5s9lqx9y 2026-11-04T14:13:38Z attached script_env256.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/6 2026-11-04T14:13:38Z recovered msl-env256 blob key from the signed disk token: qehayqcq2kgkt6icr5g2rg48slmm 2026-11-04T14:13:39Z attached script_env512.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/7 2026-11-04T14:13:39Z recovered msl-env512 blob key from the signed disk token: 5r0z9g2rpotu4lft3r8ipbwiu53o 2026-11-04T14:13:39Z attached script_env1024.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/8 2026-11-04T14:13:39Z recovered msl-env1024 blob key from the signed disk token: io61z6mcga64ritgixwta83ucw17 2026-11-04T14:13:39Z attached script_env2048.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/9 2026-11-04T14:13:39Z recovered msl-env2048 blob key from the signed disk token: 7n7bgf7pz293flfnfhrrq718szkx 2026-11-04T14:13:39Z attached script_env4096.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/10 2026-11-04T14:13:39Z recovered msl-env4096 blob key from the signed disk token: 8e9u2pinzm62ox9prokktrkwka7v 2026-11-04T14:13:39Z attached script_env8192.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/11 2026-11-04T14:13:39Z recovered msl-env8192 blob key from the signed disk token: wknb89iridg5jhsd0yzkmwskmhst 2026-11-04T14:13:39Z delivering SVG env64: through the analyzer 2026-11-04T14:13:39Z attached vector_env64.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/12 2026-11-04T14:13:39Z environment read with 64 samples (128 bytes) returned 68 bytes 2026-11-04T14:13:39Z delivering SVG env128: through the analyzer 2026-11-04T14:13:39Z attached vector_env128.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/13 2026-11-04T14:13:39Z environment read with 128 samples (256 bytes) returned 68 bytes 2026-11-04T14:13:39Z delivering SVG env256: through the analyzer 2026-11-04T14:13:39Z attached vector_env256.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/14 2026-11-04T14:13:40Z environment read with 256 samples (512 bytes) returned 68 bytes 2026-11-04T14:13:40Z delivering SVG env512: through the analyzer 2026-11-04T14:13:40Z attached vector_env512.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/15 2026-11-04T14:13:40Z environment read with 512 samples (1024 bytes) returned 68 bytes 2026-11-04T14:13:40Z delivering SVG env1024: through the analyzer 2026-11-04T14:13:40Z attached vector_env1024.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/16 2026-11-04T14:13:40Z environment read with 1024 samples (2048 bytes) returned 68 bytes 2026-11-04T14:13:40Z delivering SVG env2048: through the analyzer 2026-11-04T14:13:40Z attached vector_env2048.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/17 2026-11-04T14:13:40Z environment read with 2048 samples (4096 bytes) returned 68 bytes 2026-11-04T14:13:40Z delivering SVG env4096: through the analyzer 2026-11-04T14:13:40Z attached vector_env4096.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/18 2026-11-04T14:13:40Z environment read with 4096 samples (8192 bytes) returned 68 bytes 2026-11-04T14:13:40Z delivering SVG env8192: through the analyzer 2026-11-04T14:13:40Z attached vector_env8192.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/19 2026-11-04T14:13:40Z environment read with 8192 samples (16384 bytes) returned 68 bytes 2026-11-04T14:13:40Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:13:41Z exfiltrated 68 bytes through the attacker's own blob (SECRET_KEY_BASE present: False, planted credential recovered: False) 2026-11-04T14:13:41Z response after the template write contains command output: None 2026-11-04T14:13:41Z server-side RCE marker file content: '' (expected 'PRUVA_RCE_c4cb09651299') 2026-11-04T14:13:41Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 68, "exfil_contains_secret_key_base": false, "exfil_contains_canary": false, "canary_bytes": 68, "rce_response_evidence": null, "rce_marker": "", "rce_marker_expected": "PRUVA_RCE_c4cb09651299", "rce_ok": false} 2026-11-04T14:16:32Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:16:33Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/1 2026-11-04T14:16:33Z recovered exfil-channel blob key from the signed disk token: t2xi4wfl68gwghdjxr4g2bg9r391 2026-11-04T14:16:33Z exfiltration channel on disk: /app-fixed/storage/t2/xi/t2xi4wfl68gwghdjxr4g2bg9r391 2026-11-04T14:16:33Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/2 2026-11-04T14:16:33Z recovered exfil-canary blob key from the signed disk token: vibg3kmr6aio4fy39o3kp7qu11uw 2026-11-04T14:16:33Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/3 2026-11-04T14:16:33Z recovered write-payload blob key from the signed disk token: k8zs9xrg0jqc8cylhlqty34damge 2026-11-04T14:16:33Z write payload (80 bytes) on disk: /app-fixed/storage/k8/zs/k8zs9xrg0jqc8cylhlqty34damge 2026-11-04T14:16:34Z attached script_env64.msl (748 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/4 2026-11-04T14:16:34Z recovered msl-env64 blob key from the signed disk token: oearmd4pw9j8cd2j8g770sh8ktb4 2026-11-04T14:16:34Z attached script_env128.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/5 2026-11-04T14:16:34Z recovered msl-env128 blob key from the signed disk token: q4p0nk7zzck5igj72styl81ct3yz 2026-11-04T14:16:34Z attached script_env256.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/6 2026-11-04T14:16:34Z recovered msl-env256 blob key from the signed disk token: 31ho15va4alzu5c0cqbgn1j1xhdv 2026-11-04T14:16:34Z attached script_env512.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/7 2026-11-04T14:16:34Z recovered msl-env512 blob key from the signed disk token: jyimnsthwo0wuaqogpgq19b5w939 2026-11-04T14:16:34Z attached script_env1024.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/8 2026-11-04T14:16:34Z recovered msl-env1024 blob key from the signed disk token: uxa1els4pv9mpukn6pq4d0sd1im4 2026-11-04T14:16:34Z attached script_env2048.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/9 2026-11-04T14:16:34Z recovered msl-env2048 blob key from the signed disk token: 98gj2574hefc2e4z4nh30hkh7k86 2026-11-04T14:16:34Z attached script_env4096.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/10 2026-11-04T14:16:34Z recovered msl-env4096 blob key from the signed disk token: u35gmfrmuzdli9rn5doao9iza73b 2026-11-04T14:16:35Z attached script_env8192.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/11 2026-11-04T14:16:35Z recovered msl-env8192 blob key from the signed disk token: q5ak5jiagijc4a1r77n6ndakemx7 2026-11-04T14:16:35Z delivering SVG env64: through the analyzer 2026-11-04T14:16:35Z attached vector_env64.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/12 2026-11-04T14:16:35Z environment read with 64 samples (128 bytes) returned 68 bytes 2026-11-04T14:16:35Z delivering SVG env128: through the analyzer 2026-11-04T14:16:35Z attached vector_env128.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/13 2026-11-04T14:16:35Z environment read with 128 samples (256 bytes) returned 68 bytes 2026-11-04T14:16:35Z delivering SVG env256: through the analyzer 2026-11-04T14:16:35Z attached vector_env256.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/14 2026-11-04T14:16:35Z environment read with 256 samples (512 bytes) returned 68 bytes 2026-11-04T14:16:35Z delivering SVG env512: through the analyzer 2026-11-04T14:16:35Z attached vector_env512.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/15 2026-11-04T14:16:35Z environment read with 512 samples (1024 bytes) returned 68 bytes 2026-11-04T14:16:35Z delivering SVG env1024: through the analyzer 2026-11-04T14:16:35Z attached vector_env1024.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/16 2026-11-04T14:16:35Z environment read with 1024 samples (2048 bytes) returned 68 bytes 2026-11-04T14:16:35Z delivering SVG env2048: through the analyzer 2026-11-04T14:16:36Z attached vector_env2048.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/17 2026-11-04T14:16:36Z environment read with 2048 samples (4096 bytes) returned 68 bytes 2026-11-04T14:16:36Z delivering SVG env4096: through the analyzer 2026-11-04T14:16:36Z attached vector_env4096.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/18 2026-11-04T14:16:36Z environment read with 4096 samples (8192 bytes) returned 68 bytes 2026-11-04T14:16:36Z delivering SVG env8192: through the analyzer 2026-11-04T14:16:36Z attached vector_env8192.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/19 2026-11-04T14:16:36Z environment read with 8192 samples (16384 bytes) returned 68 bytes 2026-11-04T14:16:36Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:16:36Z exfiltrated 68 bytes through the attacker's own blob (SECRET_KEY_BASE present: False, planted credential recovered: False) 2026-11-04T14:16:36Z response after the template write contains command output: None 2026-11-04T14:16:36Z server-side RCE marker file content: '' (expected 'PRUVA_RCE_7e1d4225e69d') 2026-11-04T14:16:36Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 68, "exfil_contains_secret_key_base": false, "exfil_contains_canary": false, "canary_bytes": 68, "rce_response_evidence": null, "rce_marker": "", "rce_marker_expected": "PRUVA_RCE_7e1d4225e69d", "rce_ok": false} 2026-11-04T14:18:38Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:18:38Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/1 2026-11-04T14:18:38Z recovered exfil-channel blob key from the signed disk token: yz4b5plameotk5zbosimck3t7lf6 2026-11-04T14:18:38Z exfiltration channel on disk: /app-fixed/storage/yz/4b/yz4b5plameotk5zbosimck3t7lf6 2026-11-04T14:18:38Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3302/uploads/2 2026-11-04T14:18:38Z recovered exfil-canary blob key from the signed disk token: mx6eaceinlh8turamemeg7evnuzk 2026-11-04T14:18:39Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/3 2026-11-04T14:18:39Z recovered write-payload blob key from the signed disk token: ab6f0d3qzm46tprzihmy1rj1z17o 2026-11-04T14:18:39Z write payload (80 bytes) on disk: /app-fixed/storage/ab/6f/ab6f0d3qzm46tprzihmy1rj1z17o 2026-11-04T14:18:39Z attached script_env64.msl (748 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/4 2026-11-04T14:18:39Z recovered msl-env64 blob key from the signed disk token: utat6yxkbhy6w5ms0ooqp4qsd2pk 2026-11-04T14:18:39Z attached script_env128.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/5 2026-11-04T14:18:39Z recovered msl-env128 blob key from the signed disk token: syc0lpmhhlyk88afto597vqcz8cl 2026-11-04T14:18:39Z attached script_env256.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/6 2026-11-04T14:18:39Z recovered msl-env256 blob key from the signed disk token: 50awy5tieiwk0j7mrcwzif1fi4pq 2026-11-04T14:18:39Z attached script_env512.msl (749 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/7 2026-11-04T14:18:39Z recovered msl-env512 blob key from the signed disk token: 5wmccp31arovnao4ooboi97bp0z2 2026-11-04T14:18:39Z attached script_env1024.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/8 2026-11-04T14:18:39Z recovered msl-env1024 blob key from the signed disk token: zzes5bcsjwbr3u4yc6lnoa0lqk0u 2026-11-04T14:18:40Z attached script_env2048.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/9 2026-11-04T14:18:40Z recovered msl-env2048 blob key from the signed disk token: 50lvm4crtoeufhqtva6162kgt5d8 2026-11-04T14:18:40Z attached script_env4096.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/10 2026-11-04T14:18:40Z recovered msl-env4096 blob key from the signed disk token: nzbn1i7fzf71fygrynciqs6m2m20 2026-11-04T14:18:40Z attached script_env8192.msl (750 bytes, application/octet-stream) -> http://127.0.0.1:3302/uploads/11 2026-11-04T14:18:40Z recovered msl-env8192 blob key from the signed disk token: x092e4znkfmpsnqyumr3fwt4bnxz 2026-11-04T14:18:40Z delivering SVG env64: through the analyzer 2026-11-04T14:18:40Z attached vector_env64.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/12 2026-11-04T14:18:40Z environment read with 64 samples (128 bytes) returned 68 bytes 2026-11-04T14:18:40Z delivering SVG env128: through the analyzer 2026-11-04T14:18:40Z attached vector_env128.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/13 2026-11-04T14:18:40Z environment read with 128 samples (256 bytes) returned 68 bytes 2026-11-04T14:18:40Z delivering SVG env256: through the analyzer 2026-11-04T14:18:40Z attached vector_env256.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/14 2026-11-04T14:18:40Z environment read with 256 samples (512 bytes) returned 68 bytes 2026-11-04T14:18:40Z delivering SVG env512: through the analyzer 2026-11-04T14:18:40Z attached vector_env512.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/15 2026-11-04T14:18:40Z environment read with 512 samples (1024 bytes) returned 68 bytes 2026-11-04T14:18:40Z delivering SVG env1024: through the analyzer 2026-11-04T14:18:40Z attached vector_env1024.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/16 2026-11-04T14:18:40Z environment read with 1024 samples (2048 bytes) returned 68 bytes 2026-11-04T14:18:40Z delivering SVG env2048: through the analyzer 2026-11-04T14:18:40Z attached vector_env2048.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/17 2026-11-04T14:18:40Z environment read with 2048 samples (4096 bytes) returned 68 bytes 2026-11-04T14:18:40Z delivering SVG env4096: through the analyzer 2026-11-04T14:18:41Z attached vector_env4096.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/18 2026-11-04T14:18:41Z environment read with 4096 samples (8192 bytes) returned 68 bytes 2026-11-04T14:18:41Z delivering SVG env8192: through the analyzer 2026-11-04T14:18:41Z attached vector_env8192.svg (306 bytes, image/svg+xml) -> http://127.0.0.1:3302/uploads/19 2026-11-04T14:18:41Z environment read with 8192 samples (16384 bytes) returned 68 bytes 2026-11-04T14:18:41Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:18:41Z exfiltrated 68 bytes through the attacker's own blob (SECRET_KEY_BASE present: False, planted credential recovered: False) 2026-11-04T14:18:41Z response after the template write contains command output: None 2026-11-04T14:18:41Z server-side RCE marker file content: '' (expected 'PRUVA_RCE_88f57a7fe0c3') 2026-11-04T14:18:41Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 68, "exfil_contains_secret_key_base": false, "exfil_contains_canary": false, "canary_bytes": 68, "rce_response_evidence": null, "rce_marker": "", "rce_marker_expected": "PRUVA_RCE_88f57a7fe0c3", "rce_ok": false}