Ghidra Sink Finder – Automated Tracking User-Controlled Data to Security-Relevant Functions

When performing Reverse Engineering or binary analysis, one of the most common questions is: "Can user-controlled data reach a potentially dangerous function?" Let's try...

Palo Alto PostAuth CLI memory corruption bug

Hi, it's been a while. Long story short: below you'll find few details about the postauth bug I found in Palo Alto CLI. Here we go...

The Hack Summit 2024 - Online presentation

This year (again) I had a pleasure to present few of the topics from my research during The Hack Summit Conference in Poland[1, 2, 3]. Last time we (mostly;)) talked about one preauth RCE bug I found in ConQuest DICOM server (1.5.0d). This year we talked about one of the way to automate bug hunting using Ghidra. Below you'll find more details about it. Here we go...

Waiting for The Hack Summit 2024

During last years I had a pleasure to present few of my notes and ideas during The Hack Summit conference in Poland. This year I'll try to present few words about a new topic - more related to Ghidra. So just as a quick summary for previous years - below you'll find a 'current timeline'. ;) Here we go... 

Join Mnemonic - UD2

Below you'll find few notes about one simple RE challenge I found on Hack The Box. Here we go...

Few notes from CTF@CIT

During this weekend I had a moment to read what's new at CTFTime and that's how I found CTF@CIT prepared by HACK@CIT. Below you'll find few notes about it. Here we go...

Fuzzing Fortigate 7

Continuing my journey with the Mutiny Fuzzing Framework one of the apps I decided to test was a Fortigate 7.x VM (what I initially described during the last TheHackSummit conference). Below you'll find more details about it. Here we go... 

Protocols Mutiny

From time to time I'm posting here some of the bugs I found in the past during my (file format) fuzzing adventures. This time we'll (again) try to focus a bit more on the protocol fuzzing scenarios. To continue - we will use Mutiny Fuzzing Framework. Here we go...

Crashing GNOME shell

When I was waiting for the results of "Night Fuzzing Session" I tried to chill a bit searching for some other bugs. That's how I found one of them (CVE-2020-13160) described here and that's how in the end I landed in GNOME. ;) Details about it you will find below. Here we go...

Fuzzing FreeBSD 12.3

After last adventures with JunOS bugs I decided to learn more about FreeBSD - the base (afaik) OS for the "Juniper vSRX" I tested in the lab [1, 2]. I decided to start a quick fuzzing for the binaries inside this OS. Below you'll find few notes about it. Here we go...

Lore MIPS OOM

Few days ago I had a pleasure to present some of my ‘notes and ideas’ during TheHackSummit Conference. After (a “stage-fright” ate me alive and “ihmo - I failed”;)) the (“too fast!111”;)) presentation I decided to calm a bit and slow down with some binary exploitation topics. And that’s how I landed in the binary world of IoT and router devices… ;) Here we go…

Mobile Adventures: Fuzzing Android Browsers

In the meantime of last 3 weeks (beside looking for new projects;) of course) I was reading and learning about Android security. Below you'll find few notes about it. Here we go... 

Kernel: Jump into Device

In previous post about kernel I tried to start with some basic kernel modules. Below we'll continue - this time with so called 'devices'. Here we go...

Kernel: Introduction

Few weeks ago I was invited by one Team to participate as a "guest" during some international CTF competition. Spoiler alert: as I failed strongly during kernel pwn challenges;) (read as: 'mostly all that I tried' ;)) I decided to 'go back' and learn more (to 'try harder' "next time" ;))... Below you'll find few notes from the journey. Here we go...

Intro to Ghidra

So ;) as we already 'can write' some ASM code - this time we'll try to read it... using Ghidra. Here we go...

Linux Assembly - Simple shellcode ride

Hi ;) According to our last 'quick intro' with an example of hello_world code in ASM on Linux this time we'll try to create something else. Here we go...

Quick Intro to Linux Assembly

Some time ago I decided to get back to the ASM on Intel and refresh some of the basics. Below you'll find few notes about it. Here we go... 

Crashing QA-CAD (2019 A.04)

Hi ;) This time I tried to fuzz QA-CAD (2019 A.04). Below you will find more details about it. Here we go...

Creating Simple File Format Fuzzer

Hi ;) This time I decided to present a short draft for the small and simple 'file format fuzzer' I created some time ago. Here we go...

Returning root to userland

Since last few days I was reading a little bit more about kernel exploitation. One of the resources I found[1,2,3] was "good enough" (for me ;)) to follow it and recreate the steps on my own VM machine. Vulnerable challenge - described here by Midas - was a one presented on hxpCTF 2020 - 'kernel-rop'. Below you'll find a "quick autopsy" (but I like to think about it like a note for the 'future me' ;)). Here we go...