https://lukaszpastuszak.dev/tags/hard/Recent content in Hard on Łukasz Pastuszak - security notesHugoen-usSat, 06 May 2023 00:00:00 +0000https://lukaszpastuszak.dev/writeups/snoopy/Sat, 06 May 2023 00:00:00 +0000https://lukaszpastuszak.dev/writeups/snoopy/A path-traversal filter bypass leaks a BIND TSIG key, which hijacks the mail domain to take over a Mattermost account; abusing a provisioning slash command honeypots SSH credentials, then CVE-2023-23946 (git apply symlink) and CVE-2023-20052 (ClamAV DMG XXE) escalate to root.https://lukaszpastuszak.dev/writeups/pollution/Sat, 03 Dec 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/pollution/A leaked Burp export gives an admin token and XXE, Redis session tampering reaches a developers portal, an LFI PHP filter chain lands RCE, FastCGI pivots to victor, and prototype pollution in a Node.js API run as root gives a root shell.https://lukaszpastuszak.dev/writeups/altered/Wed, 30 Mar 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/altered/A Laravel password-reset PIN falls to brute force once an X-Forwarded-For rate-limit bypass is in place, PHP type juggling skips a secret check to expose a UNION SQL injection, INTO OUTFILE drops a webshell for www-data, and an unpatched kernel (Dirty Pipe, CVE-2022-0847) gives root.https://lukaszpastuszak.dev/writeups/enterprise/Sat, 28 Oct 2017 00:00:00 +0000https://lukaszpastuszak.dev/writeups/enterprise/SQL injection in a custom WordPress plugin leads to credentials in a draft post, a Joomla admin file upload lands a shell on the host, and a SUID stack buffer overflow in /bin/lcars gives root.