Write Ups
Boxes, labs, research & notes.
Management
OpenAM command injection, GLPI LDAP credential recovery, rdiff-backup path restriction bypass.
Fireflow
Langflow unauthenticated RCE, MCP JWT alg=none, Kubernetes nodes/proxy, privileged pod host access.
DanglingTree
WAC REST API RCE, SmarterMail password reset, DPAPI credential theft, ghost AD CS template ESC1.
Cohort
SSRF localhost bypass, internal port scan, status endpoint vhost leak, marimo RCE, Pack2Root.
DarkZeroReturns
Handlebars SSTI RCE, ligolo-ng pivot, SSPI Gitea, runner hijack, ksu root, cross-realm DCSync.
Bedside
pdfminer.six pickle RCE, internal Vite LFI, leaked SSH key, torch.load checkpoint deserialization.
Paperwork
LPD printer shell injection, PJL path traversal, SSH key drop, SCM_RIGHTS fd leak from root daemon.
Orion
Craft CMS preauth RCE, env leak, DB hash crack, loopback telnetd 2.7 login bypass.
Nexus
Leaked .env creds, Krayin CRM RCE, DB password reuse, gitea template-sync path traversal, root SSH key.
MakeSense
Stored XSS session hijack, WP theme editor RCE, credential reuse, internal OCR service arbitrary file write.
Enigma
NFS share mining, mail credential reuse, web app RCE, database hash cracking, command injection into web actions.
Nimbus
SSRF & IP obfuscation, AWS misconfiguration, unsafe YAML deserialization, container & kernel escape.
Checkpoint
AD DACL abuse, deleted object restoration, malicious VSIX extension, Kerberos DMSA impersonation, memory forensics.
Abducted
SMB & print subsystem exploitation, credential decryption, share misconfiguration, polkit abuse.
Reactor
Application exploitation, credential cracking, local port forwarding, debug protocol RCE.