Chamilo 1.11.26 Post Auth RCE via Phar Unserialize Polyglot 6 min read - Nov 18, 2024 This article is the result of an OffenSkill Training. It explores a post-authentication phar unserialize leading to a remote code execution (RCE) within Chamilo (Learning Management System) 1.11.12 up to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server.

Spip Preauth RCE 2024: Part 2, A Big Upload 12 min read - Sep 4, 2024 Another Spip Research article! This time, we'll tell you the story of how Vozec & I got a new unauth RCE on Spip v3.4.1! This all started by a cute challenge of mine, and ended like it always do, in an eval!

Spip Preauth RCE 2024: Part 1, The Feather 22 min read - Aug 16, 2024 We're in 2024, and we'll do some eval. Will you do some eval with me? It's been a while! Anyway, yes, we'll cover a new pre-authentication remote code execution on Spip, default installation, abusing a recent scary code change in the porte-plume plugin! :)

Maarch Courrier 21.03, 2nd order cmd injecton to RCE 8 min read - Jul 16, 2023 This article is the result of an OffenSkill training. It discusses a critical remote code execution (RCE) vulnerability found in the Maarch Courrier software, an electronic correspondence and document management system. The vulnerability, found during a white-box code review session, allows an attacker with administrator access to execute arbitrary commands on the server. The exploit involves command injection through improperly sanitized user inputs in the administration settings of the software. Detailed analysis, including proof of concept and the method of exploitation through the software's REST API, is provided.

Kong & Konga Exploitation & Hardening 20 min read - May 10, 2023 In this article, we discuss our team's journey in exploring and identifying vulnerabilities in Kong and Konga, two open-source API management tools. By dissecting the software and discovering potential security issues, we contribute to a more secure implementation of these tools. The article emphasizes responsible disclosure, hardening processes, and the importance of continuously improving software security. It shares our experiences, challenges, and insights, while highlighting the need for increased awareness and better vulnerability management practices in the open-source community.

Php-Internalog, Introspection Applied to 0day Research 14 min read - Nov 18, 2022 For web 0day research, it is important to get as much insights on your target as you can. Simply fuzzing around and reading the responses or logs is simply not enough. Php-internalog is our attempt at gaining vision in the core actions a php server can take. This article includes all our iterations over this idea, and opens on a new approach, and an... Already existing tool! But with a different use than its intended purpose.

Pre-Auth Remote Code Execution - Web Page Test 17 min read - Sep 23, 2022 While working at ManoMano, I spent some time auditing various software we rely on for end2end tests. During this, I stumbled upon Web Page Test, a software that will query and render a website with a headless browser in order to audit its performance, usability, loading time, etc. Back then, our tech ecosystem was relying on this, but we, at the Security Team explained why this software seemed way too prone to security issues. One week later, Web Page Test was gone because 'a pre-auth SSRF has been found in no time'. But as the engineering crew trusted us on this, we really wanted them to know that they trusted us for good reasons. So during my next R&D week (1 out of 4, so yup, this was my free time), I spent a few more days to turn this SSRF into a preauth RCE, including ways to exploit both WPT master and workers.

RCE on Spip and Root-Me, v2! 13 min read - Aug 16, 2022 Some more 0-day research done on Spip, includes preauth and postauth RCE. We're also welcoming our first guest-writer t0 that will introduce another post-auth RCE he found! Disclosing a bit late but hey, now it's there! :)

1001 ways to PWN prod - A tale of 60 RCE in 60 minutes 36 min read - Jul 14, 2022 In May 2022, I've been invited to give a talk to the HitchHack event in Vannes. This is the same event I gave my very first talk exactly 4 years ago. To celebrate, we'll go through many exploit chains I went through, as always, sharing knowledge and fun at the same time! This is basically a huge bag of ideas, with over 70 methods to gain remote code execution from nothing. Enjoy!

pty4all - The shells you deserve 8 min read - Jan 29, 2022 I hope you like tooling, bash scripting, and uber-duper shells, because we're going to enhance the sad shells we had to happy automated, multiplexed, encrypted, fully interactive PTYs with push notification and automatic persistency!

Failed02 Pulse Secure VPN and Guacamole WebSocket Hooking 20 min read - Dec 18, 2021 Just an incomplete exploit chain worth sharing. It'll show an attempt to exploiting Pulse Secure VPN through its guacamole and postgres components. It implies socat, metasploit, puppeteer, and WebSocket hooking!

RCE with SSRF and File Write as an exploit chain on Apache Guacamole 7 min read - Nov 20, 2021 While doing research on various topics, I stood upon Guacamole, a software that can be used as a connection bastion or protocolar gateway. It has many original vulnerabilities that lead to a Remote Code Execution once chained. Let's begin, shall we?

Get shells with JET, the Jolokia Exploitation Toolkit 5 min read - Oct 29, 2021 I spent too much time hacking on Jolokia, so here's an exploitation toolkit, it provides file read, write, rmi injection, information disclosure, and much more. Enjoy!

Failed01 - DOS to RCE in jolokia 4 min read - Oct 3, 2021 Some exploits are just too fun to be true. This first example attempts to exploit a web application through JVM options modification using jolokia coupled with a DOS attack. Fun right? But as explained, this doesn't work, and here's why!

Salut, ca va ? 2 min read - Sep 24, 2021 Recently, someone explained to me that the sentance "Salut ca va ?" (Hi, how are you?) is useless. But is this really the case?

SSRF to RCE with Jolokia and MBeans 8 min read - Feb 28, 2021 Exploitation writeup for a RCE a found recently, involving a path traversal, an SSRF, jolokia endpoints, and Tomcat jsp files!

RCE on Spip and Root-Me 15 min read - Sep 29, 2020 Vulnerability research write-up on spip, the web framework used by root-me.org. The issues found goes from XSS to RCE, passing by SQLi!

A Helping Hand 11 min read - May 3, 2020 Help a friend to troupleshoot issues on their server isn't always an easy thing. There are many ways to achieve this, and I'm going to show you three different solutions. We'll make use of ssh, tmux, tmate, gotty, socat and even ngrok.

Reverse XSShell 2 min read - Feb 22, 2020 Having some fun playing with xss and websockets. A different approach to reverse shell and their contexts!

Infosec made easy 4 min read - Feb 3, 2020 Bien souvent, je me retrouve à parler d'infosec avec des personnes très novices, voir complètement étrangères à ce milieu. C'est pourquoi je vous propose aujourd'hui un petit récap des attaques classiques, mais expliqué 'avé lé mimines ! '

Wordpress Subpath Auditor 5 min read - Jan 25, 2020 Introduction to Wordpress Subpath Auditor, a homemade tool that can be used to audit various components within a Wordpress installation. It relies on docker, git, php, wordpress, python, and virtualenv.

SSHrc and telegram apis 3 min read - Jan 17, 2020 Are your servers and bounces alone? Do you know what they do late at night? Who they hang out with when you're not around? Well, I do, and I'll tell you how to spy them! (TL;DR: Telegram api and sshrc)

Ngrok your DockerSploit 6 min read - Dec 15, 2019 Tired of broken tools? You broke your system frequently by installing random sh*t? So do I! Let's see how to use docker, metasploit, ngrok and aliases in order to simplify your life and keep your system alive while hacking the planet!

A linux caca story 8 min read - Apr 6, 2019 A few days ago, I realized that some 'libcaca.so' file was present in my linux filesystem. As caca means poop in French and I'm pretty immature, I investigated. What I found was... Wonderful.

New York, Datadog and I - Week 3 to 6 14 min read - Mar 16, 2019 Third article about my trip to New-York. Datadog parties, cool rooftop, visiting with Marine, api endpoints sanitization, vagrant and ansible, finding a home AGAIN... And pics!

New York, Datadog and I - Week 2 12 min read - Feb 16, 2019 Second article about my trip to New-York. Finding a home, no one cooks, free Wi-Fi, work, keyboard, Valentine's day... And pics!

New York, Datadog and I - Week 1 13 min read - Feb 9, 2019 First article about my trip to New-York. Why, where, when, with whom, what surprised me, how it went... And pics!

ThinkLoveShare's migration 6 min read - Dec 9, 2018 Short introduction to the technologies used to build and maintain this website and a few words on why I changed.

GreHack 2018 13 min read - Nov 16, 2018 GreHack 2018 is an hacking event (conferences and CTF) that takes place each year at Grenoble in France. Last year was the first time I went to an event like that, this year, I bring you in !

CSAW - Algebra 3 min read - Sep 16, 2018 Miscellaneous challenge that encourage the CTFer to either code an equation solver, of use one already existing.

CSAW - Big boi 2 min read - Sep 16, 2018 Binary exploitation of a dummy command executor, simple buffer overflow of a function's parameters.

CSAW - Shell->Code 4 min read - Sep 16, 2018 Binary exploitation using linked lists in order to store parts of a shellcode in many places and then link their execution with jumps.

CSAW - Short Circuit 2 min read - Sep 16, 2018 Hardware challenge on paper! This task consists in getting the internal state of a (simple) circuit, bit by bit, and convert it to ascii texte.

Security Fest - Excess ess 1 6 min read - Jun 4, 2018 Web challenge about XSS and browser behavior. It's all about finding a bypass in order to execute a javascript function after its references has been removed.

PWN 4/4 : Stack Pivot ToZeMoon ! 14 min read - May 10, 2018 The basics of binary operation are normally acquired, let's go for a practical operation with a stack pivot!

PWN 3/4 : SaperliROPette ! 11 min read - May 9, 2018 Introduction to Return Oriented Programming (ROP) and practical example.

PWN 2/4 : Return to libc, pick a shell ! 16 min read - May 8, 2018 Introduction to Return to libc (ret2libc) and practical example.

PWN 1/4 : Buffer Overflow, where it all began 21 min read - May 3, 2018 Introduction to binary exploitation, ELF format and shellcode writing.

A question of standards? 8 min read - Apr 1, 2017 Reflection on the theme of tolerance, the norms of our society and what they imply.

Une histoire de coquelicot 3 min read - Mar 30, 2017 Exercice d'écriture partagé avec une amie, voulu frais et mignon, à propos d'une femme-coquelicot

Reasoning without headache 13 min read - Mar 7, 2017 Reasoning is not simple and often leads to a headache or even stress. Here are some personal methods and advices that will hopefully allow you to better experience these research phases.

Sponsorship & Partnership 1 min read - Jan 1, 2000 ThinkLoveShare Writing InfoSec BlogPosts & Streaming takes time and requires a decent setup (and work-life balance). If you like the work done here and want to help me moving forward with new research & projects (thanks! ❤️ ), here are a few options! Sponsor a Stream-Episode twitch.tv/thelaluka or BlogPost You can suggest a topic, guest, tool or feature to PoC Your logo & links will be reflected Live & in the Wall of Support below Make a one-shot or reccurent small donation through one of Tipeee - tipeee.

Streaming 1 min read - Jan 1, 2000 Stream @ twitch.tv/thelaluka Replays @ youtube.com/@TheLaluka Alerts @ twitter.com/TheLaluka Community @ discord/ThinkLoveShare Everything @ linktr.ee/TheLaluka Past Streams Stream Replayz 2024 Pentest Role Play Game Stream Replayz 2023 OffenSkill-Related