RCE in Strix Agent: A practical guide to getting prompt injections with impact Prompt injection is still a topic that raises many opinions and different understandings of impact and how to exploit it. This is why I took a short detour to look at the Strix AI Pentester to see …
Introduction Recently we dived into Fortinet EMS for vulnerability research, as we like to use our spare time to hone skills and keep customers safe by addressing zero-days. We succeeded in chaining a simple img tag into a fully fledged remote code execution. This is not a 0-click pop the …
Introduction AI, vibecoding. This is the talk everywhere. But how secure is it actually to trust your favorite AI tooling to build the security features of your product? And what does it take to actually have it generate secure code? We'll explore this by trying to vibecode our way to …
Summary A spoofing vulnerability was discovered in the Media Component of Google Chrome and all Chromium-based browsers.
Introduction This post details the process of going from absolutely nothing to achieving a fully unauthenticated remote code execution exploit as root in a Mitel IP phone. We've discovered several zero-days which chained together gives the privilege of completely owning the phone. This serves as a guideline on how you …
Security vulnerability in Mitel product line (Mitel Advisory ID 24-0006) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0006. This vulnerability could allow an attacker to compromise system security.
Security vulnerability in Mitel product line (Mitel Advisory ID 24-0007) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0007. This vulnerability could allow an attacker to compromise system security.
Security vulnerability in Mitel product line (Mitel Advisory ID 24-0008) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0008. This vulnerability could allow an attacker to compromise system security.
Security vulnerability in Mitel product line (Mitel Advisory ID 24-0009) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0009. This vulnerability could allow an attacker to compromise system security.
Security vulnerability in Mitel product line (Mitel Advisory ID 24-0010) Summary A security vulnerability was discovered in Mitel products, identified under Mitel Advisory ID 24-0010. This vulnerability could allow an attacker to compromise system security.
Introduction This post illustrates the importance of manual code review when doing application security. Relying heavily on automated tools can give you some grim blind spots that pose a significant risk to the application. This is not a post that states that automated application tools are useless, but merely an …
Table of Contents Introduction Doscember 1 Doscember 2a Introduction During the course of the last two weeks danish NC3 has held their annual CTF competition. We found some time for looking at two of the tasks in the binary category. We want to extend our thanks to NC3, for a …
Table of Contents Introduction Setting up our development environment Buiding the exploit for CVE-2023-32781 Using CmdStager to run Meterpreter Submitting the module to metasploits public repository Introduction People regularly use metasploit for utilizing exploits written by others. But what is actually the process of writing an exploit and since getting …
Introduction This blog post uncovers a serious bug in WithSecure Elements, detailing how a seemingly simple issue had a major impact. Exploiting this bug allowed us to isolate all machines in a company's network, leading to an unstoppable and devastating Denial of Service (DoS) attack. The incident highlights the importance …
Introduction This post details the process of exploiting CVE-2023-32782 in PRTG to gain remote code execution. PRTG Network Monitor, developed by Paessler, enables businesses to monitor their networks. It's commonly used in corporate networks and achieving Remote Code Execution (RCE) on this system can potentially compromise the entire organization, since …
Remote code execution in Dicom Query sensor as SYSTEM
Remote code execution in HL7 sensor as SYSTEM
CSRF allowing the leakage of cleartext windows credentials over the network.
Utilize regex feature for leaking sensitive configuration files
Path traversal in SQL sensor
Path traversal in WMI sensor
A path traversal vulnerability was discovered in the HL7 sensor of PRTG allowing for exfiltatration of system files
The vulnerability allows a remote attacker to bypass authentication process. The vulnerability exists due to application is using weak authentication tokens and salts. A remote attacker can bypass authentication process and gain unauthorized access to the application.
The vulnerability allows a remote attacker to redirect victims to arbitrary URL. The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain. Successful exploitation of this vulnerability may …
The vulnerability allows a remote attacker to bypass authentication process. The vulnerability exists due to insecure ticket authentication. A remote attacker can use timing attack to potentially bypass authentication process and gain unauthorized access to the application.
Unauthed memory corruption in the fsicapd component leads to DoS
Unauthenticated arbitrary filewrite as SYSTEM
Multiple Cross-Site (XSS) Scripting vulnerabilities
Unauthed memory corruption in the fsicapd component leads to DoS
XSS which leads to a leaked private key allowing wallet control
Global CSRF bypass due to RFC incompliance in HTTP header
Heap Based buffer overflow leads to Remote Code Execution
Cerberus FTP login XSS leads to RCE
Remote Code Execution in F-secure Server Security
Fortinet IPC permission leads to local privilege escalation as SYSTEM