1 min read
PyMedusa OS Command Injection
PyMedusa is a well known video library manager that many of us self hosted types may use to organize our libraries. I decided to give it a spin one day and found a classic OS…
tag
security
9 posts
1 min read
SQL Injection in Eufy Security Application
I found a textbook SQLi in the Eufy Security application. Don't mind the heavy use of red blocks to redact. The first, normal request. Everything looks fine. Notice the response…
2 min read
CrushFTP DoS
I was doing a security review of CrushFTP , a multi platform FTP application, and I came across a DoS stemming from lack of validation of user input. Originally, I thought there…
2 min read
Golang Proof of Concept Exploit for CVE-2021-44077: PreAuth RCE in ManageEngine ServiceDesk Plus < 11306
Once again, I decided to rewrite an exploit in Golang. Once again, I did thirty seconds of searching to find if someone had already written this one in Golang. Once again, I did…
1 min read
A Quick AWS Lambda Reverse Shell
Let's say you're doing a pentest, and you run across access to AWS Lambda. I recently learned you can get a persistent shell (for 15 minutes, at least) via Lambda, which seemed…
7 min read
Hacking MotionEye/MotionEyeOS
Getting Started with MotionEye MotionEye is an open source, web based GUI for the popular Motion CLI application found on Linux. I've known of the Motion command line app for…
3 min read
Quick and Easy (and not the best) way to use HTTPS with qBittorrent and Firefox
Wanna use HTTPS with your qBittorrent WebUI, but don't know how? First off, you probably shouldn't expose the qBittorrent WebUI to the internet. Use Tailscale to tunnel into your…
1 min read
CVE-2021-35959 Stored XSS in Folder Contents on Plone 5-5.2.4
I've been testing some new Python based CMSs and CMS like software. I've heard of Plone before, but I never had a chance to check it out until now. I was a couple of days into my…
1 min read
Malicious qBittorrent Search Plugin: Feature or Bug?
TLDR: Read the code before you install random qbittorent plug ins. qBittorrent has a feature that allows you to install a search plugin to search for torrents on your favorite…