404‑to‑RCE: Unauthenticated PHP Exec in Ethereum’s retesteth
I challenged myself to hack the next system I stumbled into and ended up with unauthenticated RCE on Ethereum’s retesteth. This is the exploit, the race, and the human side.
Mav Levin Security Research
Zero-Day Vulnerability Hunting
Latest posts
Billion-Dollar Bait & Switch: Exploiting a Race Condition in Blockchain Infrastructure
My 3 am realization exposed a vulnerability in blockchain infrastructure handling billions in cryptocurrency transactions. This vulnerability writeup details a critical race condition I found in the Flashbots Ethereum MEV-Boost relay that allowed attackers to hijack MEV auctions and trick validators.
Compromising Critical Infrastructure: Unauthenticated RCE on Scada-LTS (CVE-2022-35420)
How I turned a competition distraction into a 0-day. This writeup covers the discovery and exploitation of CVE-2022-35420, an auth bypass in Scada-LTS that exposes critical industrial control systems to unauthenticated account takeover.
Stanford Website HTML Injection Vulnerability
Here’s a fun html-injection vulnerability in one of Stanford University’s websites and how I found it. Screenshot of HTML-injection vulnerability proof of concept:
Source Snapshot: Overview of Code Repository At A Glance
Announcing my latest developer tool: Source Snapshot – A source code directory visualizer for your browser.
Data Type Size Matters: Solidity Integer Range Cheatsheet From uint8 To uint256
A simple cheatsheet for Solidity Integer ranges, from uint8 to uint256. In data types, size does matter :0.
D-Link Router CVE-2021-27342 Timing Side-Channel Attack Vulnerability Writeup
I recently bought a new DIR-842 home router, and immediately (as any hacker would) started toying with it - I can’t call it mine until I pop a shell on it. Rather quickly I found I can enable telnet through the admin web gui, and then connect to telnet with an admin user. But that was too easy, so let’s see if we can find a bug/vulnerability.
Python2 to Python3 Hex/Str/Byte Conversion Cheatsheet
If you too have been personally victimized by Python3’s 'str' object has no attribute 'decode' exception and other string/bytes-related exceptions, I feel your agony. Trauma from such errors have stopped me from using Python3 for code handling buffers, like POCs for vulnerabilities or CTF exploits. Here’s a reference guide on how to convert between Python3’s hexstr/str/bytes/bytearray.
uTorrent CVE-2020-8437 Vulnerability And Exploit Overview
The world’s most popular torrent client, uTorrent, contained a security vulnerability — later to be called CVE-2020-8437— that could be exploited by a remote attacker to crash and corrupt any uTorrent instance connected to the internet.
How I Compile Reverse Engineering Exercises For Maximum Learning And Minimum Noise
Imagine if your first reverse engineering exercise was to reconstruct an encrypted IAT – if you don’t fully know what that means, that’s the point: beginner reverse engineering exercises should be clear (and fun)!