In this blog, I walk through how a single exposed IPMI/BMC interface let me take full control of a physical server — which turned out to be a Proxmox hypervisor — handing me every virtual machine, container, and backup running on top of it.
In this blog, I walk through escalating from a low-privileged user to root on a remote server by abusing an insecurely configured NFS export (no_root_squash) — planting a root-owned SUID binary to earn a root shell, along with practical mitigations for defenders.
In this blog, I demonstrate how a simple directory listing vulnerability led to full system compromise during a penetration test — from exposed configuration files and PostgreSQL credentials to remote code execution, SSH access, privilege escalation, and lateral movement.
Exposed PHPUnit `eval-stdin.php` (CVE-2017-9841) under a web-accessible `vendor` folder allowed file-read payloads to dump site source and reveal DB credentials. Using the compromised host as a pivot, I accessed internal databases and extracted data — ends with practical defensive mitigations for defenders.
In this blog, I’ll walk through how I gained access to multiple machines within an organization by cracking Linux user hashes and leveraging Shodan to identify additional targets. This post will focus on the post-exploitation phase, including hash extraction, cracking, and lateral movement.
