Rfi on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/rfi/Recent content in Rfi on Łukasz Pastuszak - security notesHugoen-usSat, 04 Jun 2022 00:00:00 +0000StreamIOhttps://lukaszpastuszak.dev/writeups/streamio/Sat, 04 Jun 2022 00:00:00 +0000https://lukaszpastuszak.dev/writeups/streamio/A UNION-based MSSQL injection and a debug-parameter LFI chain into a raw eval() RCE, then credential reuse and Firefox-stored logins reach an AD ACL abuse (WriteOwner/Owns) over a group with ReadLAPSPassword to recover the local administrator password.