bulio

More Ways to Achieve RCE/Privesc in FreeSWITCH

2026-05-17T00:00:00+00:00

More Ways to Achieve RCE/Privesc in FreeSWITCH TL;DR A user with access to FreeSWITCH’s Event Socket Library (ESL) has several different ways of achieving RCE. Even if the built-in system commands module is disabled, and even if other modules with more obvious paths to RCE are disabled, there are still ways of getting shell access to the host. ESL listens...

Loading Modules From Untrusted Paths to Achieve RCE/Privilege Escalation in FreeSWITCH

2026-04-11T00:00:00+00:00

Loading Modules From Untrusted Paths to Achieve RCE/Privilege Escalation in FreeSWITCH TL;DR FreeSWITCH’s ESL API accepts the load command with arbitrary file paths, including UNC paths on Windows, with no integrity checks or directory restrictions. An attacker with API access can load a malicious .so or .dll to execute code as the FreeSWITCH process. On Linux, this is a privilege...

We Are The Art - AI & Engineering

2026-03-29T00:00:00+00:00

We Are The Art - AI & Engineering In the past few months, the release of powerful LLMs such as Opus 4.6 and GPT 5.4 as well as agents such as Claude Code, Codex, Opencode, and more have led to a lot of discussion in the software engineering industry. While some engineers are excited about using artificial intelligence to speed...

Becoming a Director: My Six-Year Journey in Security

2026-03-04T00:00:00+00:00

Becoming a Director: My Six-Year Journey in Security I’ve recently become a Director of Security @ Rocket.Chat. Six years ago, I was a law student with almost no security knowledge. I don’t write much about my career, but this felt like a milestone worth documenting - both for myself and for anyone earlier in their journey who might find it...

CubeCart < 6.5.6 — Directory Traversal Leading to RCE (CVE-2024-34832)

2024-06-06T00:00:00+00:00

CubeCart < 6.5.6 — Directory Traversal Leading to RCE (CVE-2024-34832) TL;DR I discovered and responsibly disclosed a directory traversal vulnerability in CubeCart that affects versions before 6.5.6. By abusing the _g and node parameters, an unauthenticated attacker can reference a crafted file in an unintended location and achieve remote code execution. This issue was assigned CVE-2024-34832, and this write-up is...

Perfection Write-Up

2024-05-11T00:00:00+00:00

Perfection Write-Up Introduction First Steps We will first run an Nmap scan to discover all open ports: sudo nmap -p- -T4 --open -Pn 10.10.11.253 Starting Nmap 7.95 ( https://nmap.org ) at 2024-05-11 17:06 CEST Nmap scan report for 10.10.11.253 Host is up (0.052s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http...

Sharp Write-Up

2024-05-09T00:00:00+00:00

Sharp Write-Up Introduction Sharp is a “Hard” Windows machine on HackTheBox. The exploitation path requires reversing .NET binaries, decrypting credentials stored in a PortableKanban configuration file, exploiting an insecure .NET Remoting service via deserialization, and finally abusing a Windows Communication Foundation (WCF) service running as SYSTEM. First Steps We should start running Nmap to find out how many ports are...

Devvortex Write-Up

2024-05-09T00:00:00+00:00

Devvortex Write-Up Introduction Devvortex is an “Easy” HTB machine. The following is its description on the platform: Devvortex is an easy-difficulty Linux machine that features a Joomla CMS that is vulnerable to information disclosure. Accessing the service’s configuration file reveals plaintext credentials that lead to Administrative access to the Joomla instance. With administrative access, the Joomla template is modified to...

LockPick Write-Up

2024-05-08T00:00:00+00:00

LockPick Write-Up Introduction LockPick is an “Easy” sherlock challenge on HackTheBox. This is the scenario: Forela needs your help! A whole portion of our UNIX servers have been hit with what we think is ransomware. We are refusing to pay the attackers and need you to find a way to recover the files provided. Warning This is a warning that...

RogueOne Write-Up

2024-05-07T00:00:00+00:00

RogueOne Write-Up Introduction RogueOne is an “Easy” sherlock on HackTheBox. This is the scenario: Your SIEM system generated multiple alerts in less than a minute, indicating potential C2 communication from Simon Stark’s workstation. Despite Simon not noticing anything unusual, the IT team had him share screenshots of his task manager to check for any unusual processes. No suspicious processes were...

Recollection Write-Up

2024-05-07T00:00:00+00:00

Recollection Write-Up Introduction Recollection is an “Easy” sherlock challenge on HackTheBox. This is the scenario: A junior member of our security team has been performing research and testing on what we believe to be an old and insecure operating system. We believe it may have been compromised & have managed to retrieve a memory dump of the asset. We want...

Unit42 Write-Up

2024-05-06T00:00:00+00:00

Unit42 Write-Up Introduction Unit42 is a “Very Easy” incident response challenge on HackTheBox. We have the following scenario: In this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto’s Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC...

CubeCart < 6.5.5 - Authenticated File Upload May Lead To RCE (CVE-2024-33438)

2024-05-05T00:00:00+00:00

CubeCart < 6.5.5 - Authenticated File Upload May Lead To RCE (CVE-2024-33438) TL;DR Although the application prevents most PHP extensions (e.g. .php, .php4, .php5, .phtml, etc) from being uploaded to the web server, the .phar extension is not blocked. An authenticated user with “edit” permissions to CubeCart’s file manager can upload a web shell via File Manager > Images and...

An (Offensive) Introduction To C Pointers

2024-05-05T00:00:00+00:00

An (Offensive) Introduction To C Pointers Introduction What is a pointer? It is a question that lived rent-free in my head for some time. When I was starting in the field, in 2019/2020, it was simply too hard for me to understand what the hell a pointer was. Not only that, most people I talked to - programmers and security...