Check out my article on Bash: bypassing command restrictions with obfuscated commands in the latest issue of PagedOut, and all the other cool articles while you are at it.
I'm very excited to finally share the first part of the research I did into Ghostscript. This post details the exploitation of CVE-2024-29510, a classic format string bug, which we abuse to bypass the SAFER sandbox and gain RCE.
codeanlabs.com/blog/research…
If you have a Pico and an old Gameboy, try hooking its PWM output up to the GB's crystal input. Turns out this just works! (at your own risk, this might not be good for the GB's CPU long term..)
th0mas.nl/2023/12/28/overclo…
Glad to share with you my recently discovered CVE in zone minder product (CVE-2023-26039).
The vulnerability has been discovered during pb ctf 2023, thanks to @Unblvr1 for the great challenge.
Link: github.com/ZoneMinder/zonemi…
Last year, @krvalk and I uncovered a series of vulnerabilities in Feathers.js, Sequelize and SocketIO that lead to critical issues for our client. Now that everything is fixed, here's our write-up of this journey into Javascript madness.
codean.io/blog/vulnerability…
#3kCTF-2021 is over, Thank you for playing !
Final scoreboard:
1- Never Stop Exploiting
2- Black Bauhinia - @BlackB6a
3- zer0pts - @zer0pts
4- greunion - @greunion_ctf
5- zh3r0