Blog

Continuation of Protostar (Stack 3–4): overwriting function pointers and EIP using classic overflows with gets(), offsets, and little-endian.

Practical introduction to stack buffer overflow with Protostar's Stack 0–2 challenges: offsets, little-endian, and using arguments/environment variables to modify memory.

PwnLab write-up: Init (Vulnhub): LFI with wrappers, file upload for RCE and escalation via SUID/PATH and injection in echo.

Bounty write-up (HackTheBox). Easy Windows machine that exploits a vulnerability in IIS, allowing a malicious web.config to be uploaded to execute ASP code and obtain RCE. We then escalate privileges with Metasploit (MS10-092).

Practical compilation of methods for transferring files during post-exploitation on Linux and Windows. Includes HTTP, Netcat, SCP, FTP, SMB, Certutil, PowerShell, and Powercat. Ideal for uploading tools or downloading data from the victim without Meterpreter or Empire.

We create a dictionary with the suspect's password pattern, attack a symmetric PGP with a dictionary, and decrypt the Templar encryption to recover the FLAG.

Extracting hidden data in base64 from a video file and cracking encrypted PGP files using John the Ripper in challenge 2 of CyberCamp 2018.

Write-up of Fighter (HackTheBox): medium-level Windows machine exploiting time-based SQLi to extract credentials, gets RCE via xp_cmdshell + msbuild NPS payload, and escalates to SYSTEM with Capcom.sys (CVE-2019-7253) + bypass of checks.

Canape write-up (HackTheBox). Intermediate Linux machine that exploits an insecure pickle deserialisation in a Flask + CouchDB site. Includes RCE via XXE-like in pickle, CouchDB enumeration, and escalation to root by abusing sudo pip install.

Write-up of Celestial (HackTheBox). Low-level Linux machine that exploits an insecure cookie deserialisation in Node.js (CVE-2017-16137) to obtain RCE, then escalates to root by abusing a cron job that executes an editable script.

Compilation of techniques for obtaining shell access in Windows after RCE. Includes in-memory PowerShell, Powercat, Regsvr32, HTA, Cscript, MSBuild, WMIC, Certutil, and tests against Windows Defender.

Rabbit write-up (HackTheBox): Windows machine that exploits time-based SQLi in Complain Management System for RCE via xp_cmdshell + msbuild NPS payload, and escalates to SYSTEM by abusing WAMP64 running as SYSTEM.