Extending MySQL functionality with UDFs — Banzai, Proving Grounds
Functions are a block of queries and statements that take inputs and return values. All popular database systems provide a wide range of built-in functions to perform operations and tasks related to their systems.
Sometimes, there is a need to create…
PostgreSQL access lead to command execution. Supported versions: v9.3–v14
Recently, I came across a way to get a shell in a Postgres database that doesn’t require importing additional libraries or running any scripts, only leveraging the natively available commands.
The command we will discuss today is the COPY command; we…
Network File Shares, Network Exploitation, Metasploitable
NFS is a Network File Sharing protocol that allows users to share directories and files over the network across different operating systems. In addition, it will enable remote systems to be accessible locally when the shares are mounted. …
Rsync Enumeration and Exploitation
Rsync is a Unix/Linux utility for transferring and syncing files across different directories on the same machine or another machine on the network. The great thing about Rsync is that it only syncs and transfers the different files — no duplicates.
If you are backing up…
Gain a foothold to unprotected Redis instances
Redis is a type of database that runs in memory. It is structured similarly to the NoSQL database in terms of key-value pairs in the form of JSON objects.
It is generally used for caching data that is frequently used or takes a…
Obtain NTLM hashes in Windows Domain Controller machines
In this article, we will go over abusing the SeBackupPrivilege to escalate on a Windows machine. This privilege provides users with full read permissions and the ability to create system backups. …
Linux Logrotate Exploitation - affected versions 3.8.6, 3.11.0, 3.15.0.
In this quick post, I will go over a privilege escalation technique using a logging utility called Logrotate to obtain a root shell. The version 3.15.1 …
Inject Server-Side XSS into dynamically generated PDFs
While working on the Book machine of hack the box (Scripting Track), I came across a web application that uses user-controlled inputs to generate PDF files. The user enters an input that gets rendered into a PDF file when downloaded.
I was aware…
Injection Attacks, SQL Truncation, OWASP Top 10
SQL truncation is a web application vulnerability in which an input is truncated (deleted) when added to the database due to surpassing the maximum defined length. …
Local Privilege Escalation through overwriting ld.so.preload file
Shared libraries are files that contain objects and functions needed to run programs properly, and they are loaded first in memory before the processes of executing the programs start. These libraries are the most common way to manage dependencies on Unix and Linux…
