Gill.Singh.A

In this blog, I’ll walk through how the STUN protocol and WebRTC can expose a caller’s real IP address during a WhatsApp call, and how I built a tool that captures STUN packets to extract and geolocate the other participant’s IP in real time. The idea for this came from reading Analyzing WhatsApp Calls by Schirrmacher, which breaks down the network-level behavior and low level workings of WhatsApp calls. That analysis made me want to build something that automates the entire process: from packet capture to IP extraction to geolocation, all in one tool. ...

In this blog, I’ll show how an unauthenticated Android Debug Bridge (ADB) port on a Smart TV gave me an instant root shell on the device, and how I turned that shell into a covert SOCKS proxy using chisel, routing my network traffic through a television set sitting in a room somewhere on the network. Prologue “The telescreen received and transmitted simultaneously.” - George Orwell, 1984 The smart TV in the corner of the room is always on, always connected, and always trusted. It sits on the network alongside everything else, pulling firmware updates, streaming content, phoning home to telemetry servers. Nobody monitors its traffic, nobody patches its firmware, and nobody thinks to ask what else it might be doing. Under the hood, it runs Android on a full Linux kernel, and if someone left its debug port open, you don’t need a vulnerability at all. You just need to connect. ...

In this blog, I’ll show how a single unauthenticated vulnerability in a Hikvision CCTV camera gave me not just a root shell on the device, but a covert network proxy, routing my traffic through the camera so every packet appeared to come from a surveillance device instead of my machine. Prologue “Quis custodiet ipsos custodes?” (Who watches the watchmen?) - Juvenal A CCTV camera’s entire purpose is to watch. It records everything in its field of view, day and night, trusting that nobody will turn the lens around. But nobody watches the watcher. Behind the lens is a computer, an embedded Linux system, with its own processor, its own network stack, and its own firmware. If that firmware carries an unpatched vulnerability, the device built to expose intruders becomes the perfect place to hide. ...

In this blog, I’ll walk through how an unauthenticated command injection in a WD MyCloud NAS gave me a reverse shell as root, how I bootstrapped a persistent SSH backdoor on a device that didn’t even have SSH running, and how I turned that NAS into a covert SOCKS proxy with a single SSH flag. Prologue “There is no cloud. It’s just someone else’s computer.” - Common saying in information security ...

In this blog, I’ll walk through how a single unpatched out-of-band management interface let me take full control of a physical server — from one unauthenticated HTTP request, to a remote console, to a pre-OS root shell, to a permanent SSH backdoor — without ever knowing a single operating-system credential. Prologue “Power belongs to the people that take it.” — Mr. Robot Every serious server has a second, smaller computer bolted onto its motherboard whose entire job is to let an administrator control the machine as if they were standing in front of it — power it on, watch it boot, type at its console — over the network, whether or not the real operating system is even running. It is the most powerful interface on the box, and it is the one people forget to patch. ...