https://Gill-Singh-A.github.io/post/ Recent content in Posts on Gill.Singh.A Hugo en-us Fri, 07 Aug 2026 13:00:00 +0530 https://Gill-Singh-A.github.io/p/the-nas-nobody-patched-from-unauthenticated-rce-to-network-proxy-via-wd-mycloud/ Fri, 07 Aug 2026 13:00:00 +0530 https://Gill-Singh-A.github.io/p/the-nas-nobody-patched-from-unauthenticated-rce-to-network-proxy-via-wd-mycloud/ In this blog, I walk through how an unauthenticated command injection in a WD MyCloud NAS gave me a reverse shell as root, how I bootstrapped a persistent SSH backdoor on a device that didn't even have SSH running, and how I turned that NAS into a covert SOCKS proxy with a single SSH flag. https://Gill-Singh-A.github.io/p/from-an-exposed-ilo-to-persistent-root-via-cve-2017-12542/ Fri, 31 Jul 2026 13:05:00 +0530 https://Gill-Singh-A.github.io/p/from-an-exposed-ilo-to-persistent-root-via-cve-2017-12542/ In this blog, I walk through how a single unpatched out-of-band management interface (HP iLO 4) let me take full control of a physical server — from one unauthenticated request to a pre-OS root shell and a permanent SSH backdoor — without ever knowing an operating-system credential. https://Gill-Singh-A.github.io/p/from-ipmi-to-full-infrastructure-compromise-via-proxmox/ Fri, 31 Jul 2026 13:00:00 +0530 https://Gill-Singh-A.github.io/p/from-ipmi-to-full-infrastructure-compromise-via-proxmox/ In this blog, I walk through how a single exposed IPMI/BMC interface let me take full control of a physical server — which turned out to be a Proxmox hypervisor — handing me every virtual machine, container, and backup running on top of it. https://Gill-Singh-A.github.io/p/privilege-escalation-via-insecure-nfs-mounts/ Sun, 26 Jul 2026 19:13:00 +0530 https://Gill-Singh-A.github.io/p/privilege-escalation-via-insecure-nfs-mounts/ In this blog, I walk through escalating from a low-privileged user to root on a remote server by abusing an insecurely configured NFS export (no_root_squash) — planting a root-owned SUID binary to earn a root shell, along with practical mitigations for defenders. https://Gill-Singh-A.github.io/p/from-directory-listing-to-root-shell/ Sat, 07 Feb 2026 16:45:00 +0530 https://Gill-Singh-A.github.io/p/from-directory-listing-to-root-shell/ In this blog, I demonstrate how a simple directory listing vulnerability led to full system compromise during a penetration test — from exposed configuration files and PostgreSQL credentials to remote code execution, SSH access, privilege escalation, and lateral movement. https://Gill-Singh-A.github.io/p/dumping-source-code-and-accessing-internal-databases-via-a-phpunit-vulnerability/ Thu, 06 Nov 2025 14:01:03 +0530 https://Gill-Singh-A.github.io/p/dumping-source-code-and-accessing-internal-databases-via-a-phpunit-vulnerability/ Exposed PHPUnit `eval-stdin.php` (CVE-2017-9841) under a web-accessible `vendor` folder allowed file-read payloads to dump site source and reveal DB credentials. Using the compromised host as a pivot, I accessed internal databases and extracted data — ends with practical defensive mitigations for defenders. https://Gill-Singh-A.github.io/p/cracking-linux-hashes-and-expanding-access/ Fri, 21 Mar 2025 23:30:23 +0530 https://Gill-Singh-A.github.io/p/cracking-linux-hashes-and-expanding-access/ In this blog, I’ll walk through how I gained access to multiple machines within an organization by cracking Linux user hashes and leveraging Shodan to identify additional targets. This post will focus on the post-exploitation phase, including hash extraction, cracking, and lateral movement. https://Gill-Singh-A.github.io/p/exploiting-unencrypted-private-keys-and-misconfigured-ssh-settings-to-breach-multiple-systems/ Mon, 24 Feb 2025 00:50:12 +0530 https://Gill-Singh-A.github.io/p/exploiting-unencrypted-private-keys-and-misconfigured-ssh-settings-to-breach-multiple-systems/ In this post, I'll walk through how I was able to gain unauthorized access to multiple machines by exploiting unencrypted private keys and misconfigured SSH settings. https://Gill-Singh-A.github.io/p/lateral-movement-through-ssh-command-tampering/ Wed, 19 Feb 2025 02:54:39 +0530 https://Gill-Singh-A.github.io/p/lateral-movement-through-ssh-command-tampering/ In this blog, we will explore how I performed lateral movement and gained access to multiple machines on a private network by logging SSH credentials. https://Gill-Singh-A.github.io/p/building-a-heat-map-for-iit-kanpurs-computer-labs/ Tue, 24 Sep 2024 04:24:41 +0530 https://Gill-Singh-A.github.io/p/building-a-heat-map-for-iit-kanpurs-computer-labs/ In this blog, I’ll walk through how I created a heat map for the Linux computer labs at IIT Kanpur. This approach can be applied to any institute or organization with a similar setup. https://Gill-Singh-A.github.io/p/using-social-engineering-for-privilege-escalation/ Mon, 23 Sep 2024 05:28:07 +0530 https://Gill-Singh-A.github.io/p/using-social-engineering-for-privilege-escalation/ This blog explores how I successfully escalated privileges to root on a remote server through social engineering, highlighting the techniques used and offering mitigation strategies to prevent such attacks. https://Gill-Singh-A.github.io/p/getting-remote-root-shell-on-devices-via-portainer/ Mon, 23 Sep 2024 05:21:38 +0530 https://Gill-Singh-A.github.io/p/getting-remote-root-shell-on-devices-via-portainer/ In this blog, we explore how to gain remote root access on devices via Portainer, covering OSINT techniques, brute-force attacks, and exploiting misconfigurations, while offering mitigation strategies to enhance security. https://Gill-Singh-A.github.io/p/compromising-cctvs-101/ Mon, 23 Sep 2024 05:13:06 +0530 https://Gill-Singh-A.github.io/p/compromising-cctvs-101/ How attackers can gain access to CCTV devices via the RTSP protocol, using tools like Shodan, Google Dorking, and port scanning. https://Gill-Singh-A.github.io/p/password-cracking/ Mon, 23 Sep 2024 04:56:45 +0530 https://Gill-Singh-A.github.io/p/password-cracking/ This blog dives into password cracking techniques like brute force and dictionary attacks, highlighting how attackers exploit weak passwords and the importance of strong security measures