writeups · exploits · researchhttps://bikini.github.io/https://bikini.github.io/blog/2026-05-02-cobblestone/https://bikini.github.io/blog/2026-05-02-cobblestone/HTB Insane Linux: stored URL re-injected into a second query without escaping for a 5-column UNION, MySQL LOAD_FILE for arbitrary file read, INTO OUTFILE to forge a PHP admin session, sha256 cracked for cobble SSH, paramiko direct-tcpip out of an rbash chroot to localhost cobblerd, $globals() bypass on the Cheetah template sandbox, generate_autoinstall renders as rootSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-devarea/https://bikini.github.io/blog/2026-05-02-devarea/HTB Medium Linux: anonymous FTP gives the SOAP service jar, CXF CVE-2022-46364 reads /etc/systemd/system/hoverfly.service for admin creds, hoverfly middleware injects a reverse-shell command for dev_ryan, sudo on a syswatch script with a world-writable /usr/bin/bash gets root in one trickSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-gang-beasts/https://bikini.github.io/blog/2026-05-02-gang-beasts/unpatched mbedTLS DTLS heap overflow (CVE-2023-43615) reachable through Unity Relay, plus client-trusted auth, hardcoded dev IDs, remote input puppeteering, EB subdomain takeover, and 21 other findingsSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-garfield/https://bikini.github.io/blog/2026-05-02-garfield/HTB Hard: PrinterBug coerce → l.wilson_adm GenericWrite → ligolo pivot → SYSTEM on RODC01 → dump krbtgt_8245 → KeyList request to writable DC → Administrator hash → DA. Plus an 8-hour clock skew that breaks every Kerberos call until you patch datetimeSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-iris-rocket-league/https://bikini.github.io/blog/2026-05-02-iris-rocket-league/why every public rocket league agent plateaus at grand champion, and a four-pillar system design — replay anchor + ACCEL league + compositional reward stack + plasticity-stable architecture — that should reach SSL at 200M–1B environment stepsSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-lunar-client/https://bikini.github.io/blog/2026-05-02-lunar-client/electron deeplink RCE, .lcpack path traversal to startup folder, network-exposed debug port, IPC hijack to RCE, NTLM hash theft via lunarclient:// URL, 9 unpatched WebKit CVEs, dangling Cloudflare subdomain, unauthenticated payment basket manipulation, and the rest of a four-week desktop+infra auditSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-omoggle/https://bikini.github.io/blog/2026-05-02-omoggle/authorized pentest of a Next.js + Supabase face-rating app: writable database view → mass-defacement IDOR, OAuth open redirect → token theft, fake match-history injection, full avatar download, vote impersonation, client-side score manipulation, sybil voting, and a patch that fixed the wrong halfSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-overcooked2/https://bikini.github.io/blog/2026-05-02-overcooked2/Unity 2017.4 ships an arg that redirects mono assembly loading to attacker-controlled paths. The engine is end-of-life, the official patch starts at 2019.1, so this game will never get the fix. Plus the install dir is user-writable so the same primitive lands via DLL hijack, and Assembly-CSharp.dll has zero obfuscation so a weaponized mscorlib is trivial to buildSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-02-pingpong/https://bikini.github.io/blog/2026-05-02-pingpong/cross-forest pwn: ESC13 → gMSA password decryption → JEA escape → RBCD/MSSQL → GodPotato → ESC4→ESC1 to DA on both forestsSat, 02 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-07-7zip/https://bikini.github.io/blog/2026-05-07-7zip/audited 999 C/C++ source files in 7-Zip 26.01: HKCU registry DLL hijacking chains with RLO filename spoofing for a complete initial-access-to-persistence attack without admin, Mark-of-the-Web bypass via Zone.Identifier:$DATA suffix across WIM/NTFS/APFS/RAR5/HFS, default data stream overwrites, pre-existing junction arbitrary file write, 14 memory exhaustion DoS across archive parsers, CAB UInt64 truncation, numCodersOutStreams overflow — 30,000 fuzz mutations with zero crashes in the decompression coreThu, 07 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-07-hazmat/https://bikini.github.io/blog/2026-05-07-hazmat/HTB Hard Linux: Gitea on 3000 has a public repo with an API token in a reverted commit, token gives repo admin → server-side git hook for RCE as git user, pivot to Redis on localhost with password from Gitea config, forge Flask session cookie to become admin on the web app, admin file upload has no extension filter → Python reverse shell as www-data, www-data can write to /opt/scripts/ which root cron tars with a wildcard — inject checkpoint args for root shellThu, 07 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-07-mybb/https://bikini.github.io/blog/2026-05-07-mybb/audited the latest MyBB release: IPv6 SSRF bypasses the IPv4-only denylist in remote avatar fetching via AAAA DNS records, buddy selector stored XSS via single-quote and newline in usernames, mail header injection via newline in registered username, ACP language-properties editor only escapes double-quotes allowing backslash breakout to PHP code injection, template globals config disclosure via $GLOBALS bypass of check_template — chains from regular user account to remote code execution if admin is in your buddy listThu, 07 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-07-sightline/https://bikini.github.io/blog/2026-05-07-sightline/HTB Medium Windows: PDF export feature uses wkhtmltopdf with server-side rendering, SSRF reads internal API config endpoint with service account credentials, password reuse gets WinRM as svc_report, BloodHound shows WriteDACL on the machine account, abuse via resource-based constrained delegation to get a TGS as administratorThu, 07 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-07-turnstile/https://bikini.github.io/blog/2026-05-07-turnstile/HTB Easy Linux: Express app on port 3000 has a link preview feature that passes user URLs to curl via child_process.exec with insufficient sanitization, command injection gives shell as app user, MySQL credentials in config.js reused for local user account, user has sudo on apt-get which allows pre-invoke command execution for rootThu, 07 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-07-vencord/https://bikini.github.io/blog/2026-05-07-vencord/full static audit of the Vencord Discord client mod: cross-origin WebSocket RCE from any website via DevCompanion, one-click RCE via SupportHelper code execution in support channels, remote eval in oneko plugin, universal eval in webpack patching, browser extension strips all CSP and runs in MAIN world, cloud credential theft via configurable sync URL, Chromium sandbox force-disabled — 5 critical, 10 high, 14 medium, 10 low findings with 10 documented attack chainsThu, 07 May 2026 00:00:00 GMThttps://bikini.github.io/blog/2026-05-07-windows/https://bikini.github.io/blog/2026-05-07-windows/audited Windows 11 local privilege escalation surfaces: MareBackup scheduled task has GenericAll for BUILTIN\Users on a SYSTEM-context task definition, WiFiNetworkManagerTask named pipe trusts client-supplied SID at offset 0x14 on a world-writable pipe, Realtek HD Audio exposes a NULL-DACL named pipe to LocalSystem, KSecDD kernel IOCTL map recovered but sensitive operations gated to protected callers — plus the full surface scan across 20+ attack classesThu, 07 May 2026 00:00:00 GMT