Collaborate Disseminate
Well, I’ve done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don’t have a deep enough knowledge to pick up the wisest possible solution for my problem.
We’re curre… Continue reading Using SUID program to avoid having entries in sudoers
Welcome to Part 3! A quick recap of where we’ve been. In Part 1: Buzzwords and Hash Function we talked about some foundational cryptography vocab and were introduced to hash functions, how they’re used, and some drawbacks. In Part 2: Symmet… Continue reading Ease Me Into Cryptography Part 3: Asymmetric Ciphers
Let me please explain the question a bit more through an example:
There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs with its Private Key (sa… Continue reading Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?
I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance.
When asked to remove the root key, he said it’s disabled now so what’s the difference.
I don’t want to get … Continue reading What is the impact of leaving disabled root key on AWS instance?
Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with regular user) with tiny-core Linux version 4.2.9, I´ve readed before that the ver… Continue reading Exploit a tinycore Linux 4.2.9 with DirtyCow remote from Kali Linux
Rigol’s test gear has something of a history of being hacked. Years ago the DS1022C oscillocope was hacked to increase bandwidth, and more recently the DS1054Z was hacked to unlock licensed features. Now, it’s the MSO5000’s turn.
Over on the EEVBlog forums a group has been working on hacking another Rigol, the MSO5000, a 70 MHz oscilloscope which can be upgraded to 350 MHz via software licensing. Various other features including a two channel, 25 MHz arbitrary waveform generator are also built-in, but locked out unless a license key is purchased. The group have managed to enable all the locked …read more
I use Windows 10 Home on my PC and SSHing to up to five different Linux IaaS-modeled machines environments with Debian/ArchLinux.
I use Ansible to orchestrate and continuously integrate and continuously upgrade data in these… Continue reading Using the same private key for both WSL-Ansible and Putty (or WSL-OpenSSH for that matter)
So I’m doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that is part of the exercise.
… Continue reading Leveraging curl to spawn a shell
The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed “homebrew” in Safari search bar, pressed return, and clicked into the first link. He copied the command on the webpa… Continue reading Does it make sense to check command integrity after running it as root?
In the first article in this series on the basics of crypto, “Ease Me Into Cryptography Part 1: Buzzwords and Hash Function”, we learned some lingo and talked about the different aspects of hash functions. Remember that hash functions are one-way ̵… Continue reading Ease Me Into Cryptography Part 2: Symmetric Ciphers