https://lukaszpastuszak.dev/tags/medium/Recent content in Medium on Łukasz Pastuszak - security notesHugoen-usThu, 04 Sep 2025 00:00:00 +0000https://lukaszpastuszak.dev/writeups/media/Thu, 04 Sep 2025 00:00:00 +0000https://lukaszpastuszak.dev/writeups/media/A WMP playlist file leaks Net-NTLMv2 for a crack and SSH login, an NTFS junction redirects an Apache write into the web root for a webshell, and FullPowers plus GodPotato reach SYSTEM.https://lukaszpastuszak.dev/writeups/voleur/Sat, 05 Jul 2025 00:00:00 +0000https://lukaszpastuszak.dev/writeups/voleur/NTLM is disabled domain-wide; a cracked Excel file leaks service credentials, WriteSPN enables targeted Kerberoasting, AD Recycle Bin restores a deleted user, DPAPI decryption recovers a higher-privileged account, and a WSL pivot exposes ntds.dit for full domain compromise.https://lukaszpastuszak.dev/writeups/vulncicada/Thu, 03 Jul 2025 00:00:00 +0000https://lukaszpastuszak.dev/writeups/vulncicada/A password on a sticky note in an image from an open NFS share, Kerberos-only authentication, ADCS ESC8 exploited via a Kerberos relay (a serialized empty CREDENTIAL_TARGET_INFORMATION DNS record) plus PetitPotam coercion, a DC machine-account certificate, DCSync, and the Administrator hash.https://lukaszpastuszak.dev/writeups/tombwatcher/Sat, 07 Jun 2025 00:00:00 +0000https://lukaszpastuszak.dev/writeups/tombwatcher/A chain of Active Directory ACL abuses (WriteSPN, AddSelf, ReadGMSAPassword, ForceChangePassword, WriteOwner) reaches john, then AD Recycle Bin plus ADCS ESC15 (CVE-2024-49019) escalates to Administrator.https://lukaszpastuszak.dev/writeups/streamio/Sat, 04 Jun 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/streamio/A UNION-based MSSQL injection and a debug-parameter LFI chain into a raw eval() RCE, then credential reuse and Firefox-stored logins reach an AD ACL abuse (WriteOwner/Owns) over a group with ReadLAPSPassword to recover the local administrator password.https://lukaszpastuszak.dev/writeups/timing/Sat, 11 Dec 2021 00:00:00 +0000https://lukaszpastuszak.dev/writeups/timing/A login timing side channel enumerates users, mass assignment sets role=1, an LFI plus php://filter discloses source, a predictable MD5(time()) upload name gives RCE, a git history leak yields a reused password, and Axel's .axelrc default_filename overwrites root's authorized_keys.https://lukaszpastuszak.dev/writeups/forge/Sat, 11 Sep 2021 00:00:00 +0000https://lukaszpastuszak.dev/writeups/forge/An 'upload from URL' feature is an SSRF read primitive; a redirect from the attacker's server bypasses the loopback blacklist and reaches an internal FTP for the SSH key, and pdb.post_mortem in a sudo script gives root.https://lukaszpastuszak.dev/writeups/sniper/Sat, 05 Oct 2019 00:00:00 +0000https://lukaszpastuszak.dev/writeups/sniper/LFI in a language parameter plus PHP session poisoning gives RCE as IUSR, a leaked database password reused via PSCredential reaches chris, and a malicious CHM captures the administrator's Net-NTLMv2 for SYSTEM.https://lukaszpastuszak.dev/writeups/craft/Sat, 13 Jul 2019 00:00:00 +0000https://lukaszpastuszak.dev/writeups/craft/A Gogs-leaked Python eval() injection in a beer-catalog API drops root inside a container; database credential reuse unlocks a private repo and an SSH key, and a leftover root-policy Vault token mints a one-time SSH password for root.https://lukaszpastuszak.dev/writeups/redcross/Sat, 10 Nov 2018 00:00:00 +0000https://lukaszpastuszak.dev/writeups/redcross/Shared PHP sessions between subdomains, an NSS + PostgreSQL account backend, command injection in a setuid wrapper, and a x64 ROP buffer overflow, with multiple paths at every stage.https://lukaszpastuszak.dev/writeups/node/Sat, 14 Oct 2017 00:00:00 +0000https://lukaszpastuszak.dev/writeups/node/A leaky Express API exposes hashes and a hidden admin, a password-protected backup yields MongoDB credentials reused for SSH, a Mongo-driven scheduler runs exec() as another user, and a SUID binary falls to a ret2libc buffer overflow (plus several unintended blacklist bypasses).