A SQLi login bypass and a Node preview route that require()s uploads into RCE, then loot on disk and a leaky APK carry the foothold clean through a pivot to Domain Admin.