Cybersecurity notes on offensive security, Active Directory and red teaming.https://0xr3iko.com/enhttps://0xr3iko.com/blog/sea/https://0xr3iko.com/blog/sea/Sea is an easy Linux machine: a WonderCMS XSS (CVE-2023-41425) hijacks the admin session and leads to RCE via a malicious theme, a Blowfish hash gives SSH access, and a log-reading LFI with command injection gives root.Fri, 16 Aug 2024 00:00:00 GMThttps://0xr3iko.com/blog/curling/https://0xr3iko.com/blog/curling/Curling is an easy Linux machine: a Joomla site leads to admin access and RCE through a template webshell, a hexdump reveals SSH credentials, and PwnKit (CVE-2021-4034) gives root.Sun, 26 May 2024 00:00:00 GMThttps://0xr3iko.com/blog/openadmin/https://0xr3iko.com/blog/openadmin/OpenAdmin is an easy Linux machine: an outdated OpenNetAdmin panel gives RCE, credential reuse and a hidden internal service lead to an SSH key, and a sudo nano misconfig gives root via GTFOBins.Sat, 11 May 2024 00:00:00 GMThttps://0xr3iko.com/blog/heist/https://0xr3iko.com/blog/heist/Heist is an easy Windows machine: a leaked Cisco config exposes crackable password hashes, a password spray gets a foothold, and dumping Firefox from memory with Procdump reveals the admin credentials.Mon, 06 May 2024 00:00:00 GMThttps://0xr3iko.com/blog/jab/https://0xr3iko.com/blog/jab/Jab is a medium Windows AD machine: Kerbrute user enumeration and AS-REP Roasting give a foothold, an Openfire XMPP chat room leaks credentials, and CVE-2023-32315 on the Openfire console leads to SYSTEM.Mon, 06 May 2024 00:00:00 GMThttps://0xr3iko.com/blog/codify/https://0xr3iko.com/blog/codify/Codify is an easy Linux machine: a vm2 sandbox escape gives RCE, a SQLite database yields a crackable hash, and a bash pattern-matching pitfall in a sudo script (with pspy) reveals the root password.Mon, 15 Apr 2024 00:00:00 GMThttps://0xr3iko.com/blog/cozy-hosting/https://0xr3iko.com/blog/cozy-hosting/Cozy Hosting is an easy Linux machine: an exposed Spring Boot Actuator leaks a session cookie, an admin panel allows command injection bypassing whitespace with IFS, and sudo ssh gives root via GTFOBins.Sun, 14 Apr 2024 00:00:00 GMThttps://0xr3iko.com/blog/analytics/https://0xr3iko.com/blog/analytics/Analytics is an easy Linux machine: an unauthenticated Metabase RCE (CVE-2023-38646) lands us in a Docker container, environment variables leak SSH credentials, and GameOver(lay) gives root.Sat, 23 Mar 2024 00:00:00 GMThttps://0xr3iko.com/blog/keeper/https://0xr3iko.com/blog/keeper/Keeper is an easy Linux machine: default credentials on a Request Tracker instance expose an SSH password, and a KeePass memory dump (CVE-2023-32784) plus a PuTTY key lead to root.Sat, 23 Mar 2024 00:00:00 GMThttps://0xr3iko.com/blog/forensics-instructions/https://0xr3iko.com/blog/forensics-instructions/Forensics writeup: analyzing a malicious .docm with oletools (olevba) to extract a VBA macro and decode the obfuscated Chr()/ASCII payload that hides the flag.Mon, 04 Mar 2024 00:00:00 GMThttps://0xr3iko.com/blog/firensics/https://0xr3iko.com/blog/firensics/Forensics writeup: recovering a leaked flag from Firefox browser artifacts (places.sqlite and formhistory.sqlite) to unlock a password-protected Pastebin note.Sun, 03 Mar 2024 00:00:00 GMThttps://0xr3iko.com/blog/broken-production/https://0xr3iko.com/blog/broken-production/Writeup of the Broken Production web challenge: forging an admin session from a Base64 cookie, bypassing an LFI filter with ....//, and turning it into RCE through log poisoning.Sat, 02 Mar 2024 00:00:00 GMThttps://0xr3iko.com/blog/interdimensional-calculator/https://0xr3iko.com/blog/interdimensional-calculator/Writeup of the Interdimensional Calculator web challenge: from a hidden /debug route to remote code execution in a Flask app that runs user input through exec().Fri, 01 Mar 2024 00:00:00 GMT