https://lukaszpastuszak.dev/tags/easy/Recent content in Easy on Łukasz Pastuszak - security notesHugoen-usSat, 06 Jul 2024 00:00:00 +0000https://lukaszpastuszak.dev/writeups/permx/Sat, 06 Jul 2024 00:00:00 +0000https://lukaszpastuszak.dev/writeups/permx/An unauthenticated file upload in Chamilo LMS (CVE-2023-4220) gives RCE as www-data, a reused database password reaches mtz, and a symlink-following sudo ACL script escalates to root.https://lukaszpastuszak.dev/writeups/redpanda/Sat, 09 Jul 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/redpanda/SpEL SSTI in a Spring Boot search box gives a shell as woodenk, a hardcoded password reused for SSH, and a root cron job chaining log poisoning, path traversal, EXIF metadata path injection and XXE leaks the root SSH key.https://lukaszpastuszak.dev/writeups/goodgames/Mon, 21 Feb 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/goodgames/Union-based SQL injection dumps an MD5 admin hash, password reuse reaches an internal Flask panel, SSTI gives RCE in a container, and a shared bind-mount plus a SUID bit escapes to root on the host.https://lukaszpastuszak.dev/writeups/postman/Sat, 02 Nov 2019 00:00:00 +0000https://lukaszpastuszak.dev/writeups/postman/An unauthenticated Redis instance gives an RDB write primitive for an SSH key, an encrypted id_rsa.bak cracks to a reused password for Matt, and Webmin 1.910 (CVE-2019-12840) command injection gives root.