if i was more reasonable, i'd have less to write about
I pointed a hyped offensive-security model at an easy Linux box. It ran a flawless Windows Active Directory engagement, captured three flags that don't exist, and was extremely proud of itself.
ZoneMinder's event export concatenates monitor names directly into shell commands. One unsanitized source, two exec() sinks, and a payload that someone else can trigger for you.
A path traversal in Camaleon CMS that only triggers under a weird combination of Rails 8, the Solid trio, and an S3 backend. Found by accident. Reproduced through stubbornness.
I pointed a hyped offensive-security model at an easy Linux box. It ran a flawless Windows Active Directory engagement, captured three flags that don't exist, and was extremely proud of itself.
ZoneMinder's event export concatenates monitor names directly into shell commands. One unsanitized source, two exec() sinks, and a payload that someone else can trigger for you.
A path traversal in Camaleon CMS that only triggers under a weird combination of Rails 8, the Solid trio, and an S3 backend. Found by accident. Reproduced through stubbornness.