Recent content on Greg Scharf
Summary 
 A vulnerability has been identified in Obsidian Scheduler that allows for bypassing multi-factor authentication (MFA) enforcement and gaining unauthorized administrative access. Critically, this bypass also allows login to accounts that have been locked out due to MFA non-enrollment after 7 days, effectively defeating the application’s account protection mechanism. This flaw is…
This guide walks through how to get Burp Suite Professional working inside Exegol without burning through your allotted number of Burp Pro license activations. You will install and activate Burp Pro once and the host, and then with every new container you’ll have Burp Pro ready to use without installaing and activating again. This is possible because on Linux Burp maintains activation…
A security vulnerability has been identified in Obsidian Scheduler (version 5.0.0 through 6.3.0). The issue involves improper enforcement of access controls that may allow unauthorized access in certain configurations. 
 The vendor has acknowledged the issue and is tracking it internally. A patch is expected in an upcoming release. 
 This page will be updated with full technical details,…
If you’re looking for a method to quickly gather employee names for a password spray, the script below will work within your browser’s Web Developer console from a company’s LinkedIn People page. Since it utilizes the UI as a typical user would via automatically simulating a click to lazy-load all of the employees available on the People page you will not have to worry about a…
This is a tool I wrote in Rust that is an updated CLI version of the python tool RTFM . It’s rough and a work in progress but I have found it useful and I use it often. I wanted to learn Rust and this is the project I decided on. If you want something similar to this that is really nice, check out Arsenal . It is a more feature rich and better executed version of this same concept. I imagine…
In addition to jon.snow’s hash captured with Responder and then cracked, we also captured the hash of eddard.stark. Eddard.stark’s hash can’t be cracked, however if a hash captured with Responder can’t be cracked all is not necessarily lost. Under the right circumstances that hash can be used in conjunction with ntlmrelayx and passed to another host to ultimately gain…
The following is an example of using shell parameter expansion to overcome the limitation of using spaces in a command injection vulnerability found in a web application parameter. 
 A simple test to try if you suspect a parameter is being passed to a shell script, binary or executable on the system would be to add ;whoami after the final parameter, or test for a blind injection by adding…
If you want to follow along you can read my instructions for installing GOAD 
 Winterfell 
 The first two machines, winterfell.north.sevenkingdoms.local (a Domain Controller) at 192.168.56.11 and castelblack.sevenkingdoms.local (a SQL Server and a Web Server) at 192.168.56.22 had some very obvious paths to initial compromise and privilege escalation. Running Responder captured the hash of…
GOAD is an Active Directory lab consisting of multiple Windows virtual machines containing many common misconfigutations and vulnerabilites that you might find in an Active Directory environment. A visual representation of the entire AD network on Orange Cyberdefense’s GitHub provides an overview of the configuration along with the users, groups and running services. 
 I installed GOAD…
OWASP’s Description of Command Injection: 
 
 Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating…
Code injections typically occur when a web application, script or some other program allows untrusted user input to be directly included in code. By ‘directly included’, I mean that the input supplied by the user is not filtered or sanitized in any way before being passed to, for example, an eval function within a web application. A common CTF example is a calculator embedded in a web…
The example below is from the Hack the Box machine named Agile, but all of the principles outlined are the same when attempting to reverse engineer a Flask Werkzeug console PIN. 
 When testing a Flask app, there are a few key things to check for. First, look for SSTI (server-side template injection) since Flask uses the Jinja2 templating engine. Second, check if the secret key used to sign…
Last Updated: 7-27-2025 
 Exegol is a containerized penetration testing environment built with Docker, Git, and Python that can be installed on Windows, Linux, and Mac. It comes preloaded with the same level of tooling you’d get from a Kali or Parrot install, along with some convenient ease-of-use features like an extensive, pre-populated command history and a solid set of custom…
You will need a somewhat fast flash drive. If you paid around $10 then your drive will probably be too slow to be usable. Samsung 128 GB 400mbs flash drives have worked well for me over the past few years. They’re often on sale at Amazon for $20. Regularly they’re around $40. 
 The first thing I do is backup my applications and files from the usb I’m about to decommission. That would include…
If you’re unsure of the shift value the following script will find that for you. If you already know it’s a ROT 13, simply run the following Bash one liner: 
 cat cipher.txt | tr '[a-z]' '[n-za-m]' | tr '[A-Z]' '[N-ZA-M]' 

The following is a breakdown of solving a simple challenge named “enc” from PicoCTF 2021. It’s a useful introduction to bit shifting, character encoding and conversion between different base numbering systems. 
 The challenge starts with a file containing a string of character glyphs: 灩捯䍔䙻ㄶ形楴獟楮獴㌴摟潦弸彤㔲挶戹㍽ 
 In addition to the file containing that string, the python one liner below was…
The following focuses primarily on a Linux system compromise via a cronjob running a bash script as the root user. In that script, Tar is invoked to bundle and gzip all files in a single directory using the * wildcard, which leads to arbitrary code execution. 
 Initial Foothold and Pivot to User 
 This example is taken from the Vulnnet box on 
 tryhackme
 . It features a chain of…