HTB Era exposes FTP and HTTP. VHOST enumeration reveals file.era.htb with a vulnerable file manager. An IDOR leaks a full backup, SQLite DB, and OpenSSL keys. Cracked creds and an unsafe admin-only PHP wrapper enable RCE. Abusing security questions grants admin, and a signed cron-executed binary leads to root access.

TwoMillion exposes several vulnerabilities: an exposed invite-code mechanism for initial access, insecure API endpoints that allowed privilege escalation by granting admin rights, an admin endpoint vulnerable to command injection (RCE), exposed database credentials used to pivot to a user account, and a local kernel exploit enabling full root escalation.