Stealthcopter

Overly-greedy regex replacements can break HTML sanitisation and lead to XSS.

Third write-up for the Sneaky Patchstack CTF challenge, exploring visual diffing and fun with PHP filter chains

Explore how creative tricks in PHP and WordPress allow you to bypass restrictions in a fun Patchstack CTF (S02E01) challenge and uncover neat tricks with filters and file paths!

This writeup explores a Patchstack WordPress CTF challenge where a vulnerable custom footer feature allows for dynamic function execution.

tldr; On their own, these two vulnerabilities in JupiterX Core wouldn’t have been very impactful or likely to get a bounty; but by chaining them together, the exploit could be escalated from a simple SVG upload to full Remote Code Execution (RCE).

tldr; Server-Side Template Injection (SSTI) is one of my favorite vulnerabilities, but rarely do I see it outside of CTF competitions… The WPML Multilingual CMS Plugin for WordPress used by over 1 million sites is susceptible to an Authenticated (Contribu…

tldr; This challenge was fun and engaging, blending CSPT with an open redirect flaw to ultimately pull off a successful XSS attack and grab the flag!

tldr; Reported ~300 vulns in WordPress plugins and themes, made about ~$27k.

This fun little challenge was to get reflected cross-site scripting (XSS) on a simple web app that is protected by a content security policy (CSP) and DOMPurify.

Solution for the WooCommerce WordPress plugin challenge that PatchStack submitted to the NahamCon 2024 CTF.

Unauthenticated Remote Code Execution (RCE) by chaining multiple vulnerabilities in the Anti-Malware Security and Brute-Force Firewall GOTMLS WordPress Plugin

tl;dr: Solved an awesome Valentine’s Day challenge by @goatsniff from Intigriti.

The Ninja Forms Contact Form Plugin for WordPress is susceptible to an SQL injection vulnerability when processing data export requests.

I decided to dust off my hacking hat and delve back into CTF challenges with the Intigriti December challenge.

A critical vulnerability in Medusa allows for information leakage, including plaintext credentials, by attaching to an unauthenticated WebSocket and waiting for a user to make a configuration change.

Over the weekend I participated in dCTF by DragonSec SI along with some friends.

I discovered a command injection vulnerability in SaltStack’s Salt that allows privilege escalation using malicious filenames on a minion when the master calls snapper.diff.

Recently I disclosed a local privilege escalation, CVE-2020-28243, in SaltStack’s Salt via specially crafted process names.

I discovered a command injection vulnerability in SaltStack’s Salt that allows privilege escalation via specially crafted process names on a minion when the master calls restartcheck.

The HTB x Uni CTF 2020 - Qualifiers have just finished and I wanted write-up some of the more interesting challenges that we completed.

Cargo Delivery was a Python command line application that uses AES CBC encryption and is vulnerable to a padding oracle attack.

The HTB x Uni CTF 2020 - Qualifiers have just finished and I wanted to write-up some of the more interesting challenges that we completed.

Summary The queen-of-hearts challenge was on two ports, 9010 which contained a downloadable Java .jar file and 9008 which was the service that you needed to interact with.

Summary The ace-of-clubs challenge presented a SSH server on port 9009 that had an easy to guess login.

This fun little challenge was solved by our binary exploitation expert: benything.

Summary The 7-of-spades challenge is a basic Python web application that lists information about Metasploit modules.

Summary The 5-of-clubs challenge was to write a Metasploit module that is uploaded and run on a computer to which you do not have direct access.

Metasploit ran another community CTF this year, and we decided to put forward a team.

@stealthcopter MSc Computer Security | OSCP I’m an Application Security Professional.

I wrote a new metasploit module, enum_containers, that enumerates a target post exploit and detects container platforms and lists any containers that are actively running on them.

I wrote a new metasploit module, docker_privileged_container_escape, that escapes from a docker container with access to the docker sock obtaining a root shell on the host operating system.

I developed a container enumeration script.

PortDroid is a Network Analysis Application that helps Network Administrators, Penetration Testers and Hackers with several useful networking tools.

A tasty root checker library and sample app.

tl;dr Found a vuln in some old and mostly unused data format in python, spoke to Guido van Rossum (inventor of Python), and submitted a PR with a fix.