ATT&CKing TACACS+ to Pwn Your Network via a Pre-Auth RCE - elttam

Details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.

Ruby Marshal Kick-off Gadgets - elttam

This post surveys everything Marshal.load calls on its own, on Ruby 4.0.6, and finds six kick-off gadgets, hash, eql?, <=>, to_str, to_s and respond_to?, that were never written for deserialisation...

Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam

This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.

Cruising for Shells in Flowise - elttam

After reviewing Flowise, a popular AI agent/workflow platform, and its history of critical security advisories, we uncovered 6 new remote code execution vulnerabilities in v3.1.1/v3.1.2.

Your House Has an FFmpeg Problem - elttam

How we went hunting for attack chain primitives on Home Assistant and ended up with an interesting exploit by abusing FFmpeg input streams.

Exploiting Auth0 Defaults in XSS Attacks - elttam

Jupyter Enterprise Gateway - From Notebook to Kubernetes Cluster Admin - elttam

Three critical vulnerabilities in Jupyter Enterprise Gateway allow a notebook user to escalate privileges and fully compromise the underlying Kubernetes cluster.

Golang code review notes II - elttam

New Method to Leverage Unsafe Reflection and Deserialisation to RCE on Rails - elttam

A new RCE gadget chain discovered in the sqlite3 gem affects all default Rails installations. Learn how unsafe reflection leads to remote code execution.

A Monocle on Chronicles - elttam

Explore Talkback Chronicles, browse historical snapshots of trending infosec content and subscribe to the new weekly security newsletter.

DUCTF 2024 ESPecially Secure Boot Writeup - elttam

Full writeup of the DUCTF 2024 ESPecially Secure Boot challenge exploiting CVE-2018-18558 to bypass ESP32 secure boot.

plORMbing your Django ORM - elttam

Understand ORM Leak vulnerabilities and how attackers exploit Django's ORM to extract sensitive data from your application.