CVE-2017-12929

This exploit demonstrates an arbitrary file upload vulnerability in DlxSpot - Player4 LED video wall software, leading to remote command execution (RCE). The attacker uploads a malicious PHP shell via `resource.php` and executes commands through a crafted HTTP request.

This is a technical writeup detailing hardcoded SSH credentials (dlxuser:tecn0visi0n) in DlxSpot Player4 LED video wall software, allowing authentication bypass and privilege escalation to root. The vulnerability is confirmed in all known versions, with no patch available.