Recent content on firefart
Some time ago I stumbled across a HackerOne report about abusing Slacks TURN server for proxy functionality inside their internal network. I found this interesting and decided to take a look at our videoconferencing software at work, which happened to be Cisco Expressway. Since there are currently no public tools available, I developed a tool to help others in testing. You can get the tool over…
Dockerhub recently removed the autobuild feature for all free users. This means that every docker image that relies on docker hub to auto build the images on new pushes or new releases will not be updated anymore. Users now need to build those images manually and push them to Docker Hub. Thankfully you can use Github Actions to build the images for you and push them to the docker hub registry.
With the newly introduced Github Actions it’s now possible to run your unit tests and other automation tasks automatically on Githubs infrastructure based on events. This is a short blog post describing how to use the MySQL / MariaDB services with Github Actions. The Ubuntu image already contains a preconfigured MySQL server but if you want to use a specific or newer version or even a…
Lately I came across the problem of running cron jobs in a docker based environment when we migrated wpvulndb.com to a docker based install. So how should we execute cron jobs when the application is running with docker or docker-compose? You have two choices of running cron jobs with docker: Execute them on the host system with docker exec or docker run in your application container Create a…
RHme2 (Riscure Hack me 2) was a hardware based CTF challenge started back in 2016. Although it’s already over you can download the challenges from their Github page. All you need is an Arduino (or Arduino compatible) board with an atmega328p chip (Arduino UNO or Arduino Nano). In this post we will solve this challenge by brute forcing it using a second Arduino. Stuff needed to solve this…
On a recent pentest I got root access to a MySQL database hosting a PHP web application and also an instance of Piwik. I was able to extract the credentials from the database and crack them really fast because they were only hashed using MD5. It looks like Piwik introduced stronger hashes in Piwik 3 but luckily this target is still running version 2. Edit: Piwik now disabled custom plugin uploads…
Fortress is the last of 4 DC416 VMs by @superkojiman. Here are my other writeups for the DC416 challenges: DC416 Basement DC416 Baffle DC416 Dick Dastardly information gathering A nmap scan of the machine reveals a FreeBSD server with a webserver present. root@kali:~# nmap -sS -p- -A 192.168.56.2 Nmap scan report for 192.168.56.2 Host is up (0.00064s latency). Not shown: 65532 filtered ports PORT…
New evening, new VM: DC416 Dick Dastardly by the famous @_RastaMouse. Here are my other writeups for the DC416 challenges: DC416 Basement DC416 Baffle DC416 Fortress information gathering As every DC416 VM there is an information page hosted on port 80 with informations about it: Engagement Rules: No username/password bruteforcing is necessary This box has 4 flags Flags are in flag{} format Have…
After I finished DC416 - Basement I wanted to give the next VM a try: DC416 - baffle by @superkojiman. Here are my other writeups for the DC416 challenges: DC416 Basement DC416 Dick Dastardly DC416 Fortress Information Gathering As always I started with a netdiscover to get the machines IP-Address and viewed the instructions on Port 80 in a browser. Engagement Rules: No username/password…
Basement is the first of 4 VMs from the DC416 CTF by @barrebas on Vulnhub. There are 5 flags on this machine but I was only able to get 4 of them. Here are my other writeups for the DC416 challenges: DC416 Baffle DC416 Dick Dastardly DC416 Fortress information gathering Before you start with a portscan you need to wait a few minutes because there are several binaries executed by cronjobs.
I was bored today so I thought it would be a good chance to try any of the current VulnHub VMs. I decided to try the latest HackDay: Albania from @R-73eN. At first I imported the VM into VirtualBox, did a quick netdiscover in kali to get the IP address and fired up nmap: root@kali:~# nmap -sS -T4 -A -p- 192.168.56.101 Starting Nmap 7.31 ( https://nmap.org ) at 2016-11-24 10:12 CET Nmap scan report…
Inspired by Blasty and his UPC Wifi key generator I decided to take a look at my UPC router too. It’s a Ubee EVW3226 with a custom firmware built by UPC providing a modified web interface and a lot of other stuff. First I tried to identify some debug pins on the board and found multiple possible UART connectors. I connected my Buspirate to the first UART and got a login shell protected by a…
In this blog post I will cover some quick basics about NFC, Mifare Classic and how to set up everything for reading and writing a NFC tag. At the end I show you how to reprogram a vending machine’s NFC tag to contain more credits. NFC stands for Near Field Communication and is used to communicate over short distances. For more Infos on NFC you can read the Wikipedia article. NFC nowadays is…
Because I have installed Wordpress for testing purposes way too often, i decided to write my setup down so I can reference it and others can benefit from the install. The installation was tested with Ubuntu 14.04 LTS 64bit. Here are my steps to get a Wordpress VM up and running in Ubuntu: Get the Ubuntu ISO image from their download site http://www.ubuntu.com/download/server Install it in your…
In a recent security audit I spotted a file on the server which caught my attention: loader-wizard.php. After calling the file via a Browser I noticed it’s part of ionCubes encoding and obfuscation software. The software can be found on ionCubes Homepage. The software compiles your php code into custom bytecode and performs some obfuscation on variable names, class names and so on. This way…
During a recent security audit I found multiple vulnerabilities in the Wordpress plugin “all-in-one-event-calendar”. There is a lite version provided through the Wordpress site (http://wordpress.org/plugins/all-in-one-event-calendar/), and a standard version provided through a third party site (http://time.ly/). Both versions were tested and are vulnerable to the reported issues. PS:…
Today I got my hands on a HP t510 Thinclient and wanted to analyze the OS and running services (apparently it’s running Ubuntu 10.04.4 LTS). Here is my solution to run the Firmware in a VMware Infrastructure, or simply mount the image for browsing. First you need to download the ThinPro Firmware for your Thinclient model from HP’s Downloadcenter. Here is the link for the T510:…
firefart [at] gmail [dot] com Twitter Github Linkedin Certifications