ash
writeups · exploits · research
recent
all posts →- exploits 7-Zip — HKCU DLL hijack to persistent code execution, MotW bypass across five archive formats, and 27 other things from a full source audit
- writeups hazmat — Gitea leaked API token in commit history → git hook RCE → internal Redis session forging → Flask admin file upload → cron wildcard tar injection to root
- exploits MyBB 1.8.39 — IPv6 SSRF via remote avatar, stored XSS in buddy selector, mail header injection, ACP language-properties RCE, and a chain from regular user to code execution
- writeups sightline — SSRF in wkhtmltopdf PDF renderer → internal API credential extraction → WinRM foothold → RBCD via WriteDACL to admin
- writeups turnstile — Node.js command injection in URL preview → user pivot via MySQL password reuse → sudo apt-get pre-invoke to root
- exploits vencord — 5 critical RCE paths, sandbox disabled, CSP gutted, 39 findings across the Discord client mod that mass-roots its users by design
- exploits windows 11 — SYSTEM-context scheduled task writable by any user, world-writable named pipes with SID spoofing, and what the local privilege escalation surface looks like after a thorough sweep
- writeups cobblestone — second-order SQLi → INTO OUTFILE session forge → SSH chroot escape via paramiko channels → Cobbler Cheetah SSTI to root