Linux

Home /
Tags /
Linux

Exploiting an Arbitrary File Write via MIME Type Misparsing

A while back while going through my files, I came across FLB-Music-Player, which I was using a while back before switching to a self-hosted alternative called Navidrome, which I run on my raspberry pi. I decided to take a look at it from a security point of view to try and identify any vulnerabilities in it. This blogpost will be a walkthrough of an interesting vulnerability I found in FLB-Music-Player 1.2.1, that could be abused to achieve RCE.

YTDLnis Android 1-Click RCE

Recently during my day-to-day Twitter scrolling routine, I came across an interesting vulnerability affecting the Android version of YTDLnis(versions 1.8.4 and prior). YTDLnis is a full-featured audio/video downloader for Android using yt-dlp. The vulnerability was discovered by Paul Gerste from Sonar and does not currently have a CVE assigned to it.

PerfectRoot Ctf 2024 - Pwn

This post walks through a hard rated Pwn challenge from PerfectRoot Ctf 2024. The binary has a buffer overflow and a restrictive seccomp filter. In this post, we will explore how to bypass these restrictions using alternative syscalls to get a file descriptor to the flag file and read its contents.

Abusing Legitimate Features in Casaos

CasaOs is one of the go-to tools for home server setups among tech and cloud enthusiasts. It is a straight forward interface that simplifies the complexities of server management, allowing users to set up and manage their own servers via a user-friendly interface without the steep learning curve usually associated with traditional server setups. In this blog post, we will explore some of the features in CasaOs and how an attacker could abuse them to compromise the underlying host.

Africa Bug Pwn 2024 Writeups

Recently I took part in the Africa Bug Pwn 2024 Capture the Flag Competition and managed to get second position with 2310 points. The CTF was very interesting and I got to learn a thing or two. This blog post will be a writeup of some of the challenges I managed to solve.

UrchinSec Tanzania National CTF MMXXIV

This blogpost is a walkthrough of the UrchinSec Tanzania National CTF challenges. The UrchinSec Tanzania National CTF was an interesting ctf organized by the urchinsec team . From the ctf, I managed to solve several challenges one of which was a 500 point reverse engineering challenge.

ImaginaryCTF Argv Pwn Writeup

This post covers a pwn challenge from the ImaginaryCTF discord where a buffer overflow in gets is converted into a format string vulnerability by overwriting the argv[0] pointer on the stack. We walk through leaking libc and stack addresses, then explore two methods to get a shell.

ShmooCon CTF

Over the recent weekend, I found some free time that enabled me to participate in the ShmooCon CTF. While it did not have pwn challenges as I had hoped, they offered a variety of challenges I enjoyed solving. This blogpost is a walkthrough of some of the challenges I managed to solve.

DG'hAck 2022 - Unserial Killer

This post covers a PHP insecure deserialization challenge from DG’hAck 2022 that involves chasing down a POP gadget and building a chain from scratch. We trace __destruct through __call and trait inheritance, then bypass __wakeup restrictions and forbidden attributes to call getContents for arbitrary file read on the flag.

CrewCtf Writeups

It has been a while since I last participated in a CTF (Capture The Flag) competition. With a few moments to spare this weekend, I decided to immerse myself in CrewCTF by theHackersCrew CTF team. Their event offered a diverse range of challenges, but I chose to focus primarily on the fascinating field of forensics. In this blog, I will share my approach and solutions for the different challenges I managed to solve.