Security Researcher
Hiding Behind a CCTV - Turning a Hikvision RCE into a Covert Network Proxy
In this blog, I’ll show how a single unauthenticated vulnerability in a Hikvision CCTV camera gave me not just a root shell on the device, but a covert network proxy, routing my traffic through the camera so every packet appeared to come from a surveillance device instead of my machine. Prologue “Quis custodiet ipsos custodes?” (Who watches the watchmen?) - Juvenal A CCTV camera’s entire purpose is to watch. It records everything in its field of view, day and night, trusting that nobody will turn the lens around. But nobody watches the watcher. Behind the lens is a computer, an embedded Linux system, with its own processor, its own network stack, and its own firmware. If that firmware carries an unpatched vulnerability, the device built to expose intruders becomes the perfect place to hide. ...
The NAS Nobody Patched - From Unauthenticated RCE to Network Proxy via WD MyCloud
In this blog, I’ll walk through how an unauthenticated command injection in a WD MyCloud NAS gave me a reverse shell as root, how I bootstrapped a persistent SSH backdoor on a device that didn’t even have SSH running, and how I turned that NAS into a covert SOCKS proxy with a single SSH flag. Prologue “There is no cloud. It’s just someone else’s computer.” - Common saying in information security ...
From an Exposed iLO to Persistent Root via CVE-2017-12542
In this blog, I’ll walk through how a single unpatched out-of-band management interface let me take full control of a physical server — from one unauthenticated HTTP request, to a remote console, to a pre-OS root shell, to a permanent SSH backdoor — without ever knowing a single operating-system credential. Prologue “Power belongs to the people that take it.” — Mr. Robot Every serious server has a second, smaller computer bolted onto its motherboard whose entire job is to let an administrator control the machine as if they were standing in front of it — power it on, watch it boot, type at its console — over the network, whether or not the real operating system is even running. It is the most powerful interface on the box, and it is the one people forget to patch. ...
From IPMI to Full Infrastructure Compromise via Proxmox
In this blog, I’ll walk through how a single exposed IPMI/BMC interface let me take full control of a physical server — and how that server turned out to be a Proxmox hypervisor, handing me every virtual machine and container running on top of it, along with the backups behind them. Prologue “A bug is never just a mistake. It represents something bigger. An error of thought that makes you who you are.” — Elliot Alderson, Mr. Robot ...
Privilege Escalation via Insecure NFS Mounts
In this blog, I’ll walk through how I escalated my privileges from a low-privileged user to root on a remote server by abusing an insecurely configured NFS export (no_root_squash). Prologue “Control is an illusion.” — Mr. Robot NFS has a habit of trusting whoever knocks on the door — and trust, as always, is the real vulnerability. Initial Foothold At this stage I already had a shell as a regular, low-privileged user. The interesting part began while I was looking for a way up to root. ...