All posts · Page 4

October 17, 20223 min read

Webmin CVE-2022-0824 RCE in Golang

I've continued my quest to translate exploits into Golang. Here is an RCE in Webmin due to broken access controls. Please see the following links for more information.…

CVE GOLANG hacking POC coding cybersecurity infosec offensive security offsec

October 11, 20221 min read

Guitar Pro Directory Traversal and Filename XSS

These were given CVE 2022 43263 and CVE 2022 43264. I found these vulnerabilities in the latest version of Guitar Pro (1.10.2) on the iPad and iPhone. Neither one is that great of…

cybersecurity directory traversal guitar pro hacking infosec xss offensive security offsec

September 30, 20222 min read

CrushFTP DoS

I was doing a security review of CrushFTP , a multi platform FTP application, and I came across a DoS stemming from lack of validation of user input. Originally, I thought there…

crushftp cyber dos hacking infosec offsec coding security

September 29, 20222 min read

Golang Proof of Concept Exploit for CVE-2021-44077: PreAuth RCE in ManageEngine ServiceDesk Plus < 11306

Once again, I decided to rewrite an exploit in Golang. Once again, I did thirty seconds of searching to find if someone had already written this one in Golang. Once again, I did…

CVE-2021-44077 cyber cybersecurity GOLANG hacking infosec MANAGEENGINE offsec POC SERVICEDESK ZOHO coding CVE security

August 26, 20221 min read

A Quick AWS Lambda Reverse Shell

Let's say you're doing a pentest, and you run across access to AWS Lambda. I recently learned you can get a persistent shell (for 15 minutes, at least) via Lambda, which seemed…

aws cloud lambda python reverse shell coding cybersecurity hacking linux security

August 1, 20221 min read

The Incredibly Insecure Weather Station - Part 2

The weather station issues were given CVE 2022 35122 . I contacted the manufacturer in regards to these issues. They responded quickly. I wasn't expecting anything to be done…

cyber cybersecurity hacking infosec linux self hosting CVE

June 30, 20222 min read

The Incredibly Insecure Weather Station

This was given CVE 2022 35122. I recently purchased the ECOWITT GW1102 Home Weather Station . It's exactly what it sounds like a mini weather station for your house. It has all…

cybersecurity ecowitt hacking infosec self hosting CVE

April 7, 20228 min read

Deploying and Configuring a Bug Bounty Box with Terraform and Ansible

Prerequisites and Getting Started I sometimes like to spin up a virutal machine in the cloud, do some testing, and then tear it down. It doesn't even have to be for bug bounty…

ansible bounty bug bug bounty cybersecurity dev devops hacking infos linode linux ops terraform bugbounty

February 17, 20222 min read

MotionEye Config Info Disclosure

This was given CVE 2022 25568. As mentioned in my previous posts here and here , I've done a little digging into the conditions that are required for the MotioneEye config file to…

CVE cyber hacking infosec self hosting coding webdev cybersecurity

January 31, 20221 min read

Update: Hacking MotionEye - CVE-2021-44255

I was given CVE 2021 44255 for this authenticated RCE via a malicious tasks (python pickle) file. So that's fun. Even though it is authenticated, the default username is admin and…

CVE hacking infosec python