Techblog and Security

RE: DC-932L Reversing a Webcam Part 3 – Building the Firmware 

In my last post I described how to extract the firmware, this was quite easy. But to rebuild a firmware is something different. This is a three part long story I need to be honest here, just remembering back to this process is painful, I will just describe some problems about the whole process that

RE: DC-932L Reversing a Webcam Part 1 – Getting a Shell

Introduction and Story I remember, more then a year ago I watched this fantastic video from stacksmashing about reverse engineering and rebuilding a custom firmware for a webcam. I was absolutely stunned that this is possibile and thought about to try this some time on a device I have at home. As usual, time passes

NTLM Attack in Metabase CVE-2022-24853

Metabase GeoJSON API Endpoint Back in September 2021, Metabase released a security announcement regarding its GeoJSON API endpoint: GeoJSON URL validation can expose server files and environment variables to unauthorized users We’ve discovered a potential security issue with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables).

gMSA Passwords

Doing one of the recent HTB Boxes i came across the tool and learned how you can retrieve gMSA passwords with it: Additional to the howto from NetTools you can change the encoding for the desired attribute to only retrieve the current password this will print you only the current password as hex

PHP Voting System – Unauthenticated Remote Code Execution

Today i just found another exploit in the PHP Voting System. The file /admin/candidates_add.php is vulnerable against unauthenticated file upload which can use for RCE. Exploit DB entry: Vulnerable file candidates_add.php You just need to send a POST with multipart/form-data so you can upload any file you wish. There is no cookie or file

PHP Voting System – Admin Authentication Bypass (SQLI)

Today i found a new exploit in the PHP Voting System. Exploit-DB entry: The /admin/login.php is vulnerable against SQL injections and so you can bypass the admin authentication. login.php As you can see the first check if($query->num_rows < 1)against the username is only checking the number of rows. With the following statement you always

Research Valheim Server Passwords

In version 0.147.3 of valheim there is a possibility to receive and extract the passwords entered by the user. Responsible disclosure: I send an Email to the developer Team of irongatestudio, but unfortunately they didd’t respond to me. This is only possible if you control the server binaries! at this moment there was no possibility