In this blog, I’ll walk through how an unauthenticated command injection in a WD MyCloud NAS gave me a reverse shell as root, how I bootstrapped a persistent SSH backdoor on a device that didn’t even have SSH running, and how I turned that NAS into a covert SOCKS proxy with a single SSH flag. Prologue “There is no cloud. It’s just someone else’s computer.” - Common saying in information security ...
In this blog, I’ll walk through how a single unpatched out-of-band management interface let me take full control of a physical server — from one unauthenticated HTTP request, to a remote console, to a pre-OS root shell, to a permanent SSH backdoor — without ever knowing a single operating-system credential. Prologue “Power belongs to the people that take it.” — Mr. Robot Every serious server has a second, smaller computer bolted onto its motherboard whose entire job is to let an administrator control the machine as if they were standing in front of it — power it on, watch it boot, type at its console — over the network, whether or not the real operating system is even running. It is the most powerful interface on the box, and it is the one people forget to patch. ...
In this blog, I’ll walk through how a single exposed IPMI/BMC interface let me take full control of a physical server — and how that server turned out to be a Proxmox hypervisor, handing me every virtual machine and container running on top of it, along with the backups behind them. Prologue “A bug is never just a mistake. It represents something bigger. An error of thought that makes you who you are.” — Elliot Alderson, Mr. Robot ...
In this blog, I’ll walk through how I escalated my privileges from a low-privileged user to root on a remote server by abusing an insecurely configured NFS export (no_root_squash). Prologue “Control is an illusion.” — Mr. Robot NFS has a habit of trusting whoever knocks on the door — and trust, as always, is the real vulnerability. Initial Foothold At this stage I already had a shell as a regular, low-privileged user. The interesting part began while I was looking for a way up to root. ...
In this blog, I will demonstrate how a simple directory listing vulnerability led to full system compromise during a penetration test. Prologue “The best exploits are the ones that never feel like exploits at all.” — Mr. Robot I discovered that a web server was exposing its directory contents. Several configuration and compressed files were visible, indicating possible sensitive information leakage. Source Code Analysis After downloading and analyzing the exposed files, I found a PHP configuration file containing PostgreSQL database credentials. ...