Recent content on MrBruh's Epic Blog
The RCE that AMD wouldn’t fix After being interrupted multiple times by an annoying console window that would pop up periodically on my new gaming PC, I managed to track the offending executable down to AMD’s AutoUpdate software. In my frustration, I decided to punish this software by decompiling it to figure out how it worked, and accidentally discovered a trivial Remote Code…
All vulnerability reports to MSI are bouncing due to a full mailbox Today I tried to report a critical vulnerability I found in some MSI related software, which hopefully you all will be reading soon enough. However, in the process of reporting their vulnerability I have run into an issue I think all security researchers should be aware of. All vulnerability reports to psirt@msi.com are currently…
Remote Code Execution Vulnerability in Fooocus Fooocus is the third-most popular open-source AI image generation WebUI on GitHub with 48k stars. By exposing it to the internet, you allow attackers to take control of your computer using an exploit I reported six months ago that remains unpatched. Here is the story of how I found it. Why Fooocus? As part of a university project, I was asked to…
Finding a RCE in my old TP-Link router I was eating lunch one day in late December (2025), and was reading an article by Simone Margaritelli about several TP-Link vulnerabilities he found in his IP Camera. After finishing both the article and my toast, I realised two things: I had my own TP-Link router collecting dust in a cupboard. The firmware blobs for it were stored on an open S3 bucket, which…
1.4 Billion user records exposed by insecure Firebase instances in top Android apps TLDR: Out of the top 1.5 Million Android apps on the Play Store, 11,126 were insecure and exposed users’ PII. In total these 11 thousand apps exposed 1.43 Billion user records. This includes 5 apps with 100 Million downloads and 10 apps with 50 Million downloads. Two years ago, along with a few friends, we…
1.4 Billion user records exposed by insecure Firebase instances in top Android apps TLDR: Out of the top 1.5 Million Android apps on the Play Store, 11,126 were insecure and exposed users’ PII. In total these 11 thousand apps exposed 1.43 Billion user records. This includes 5 apps with 100 Million downloads and 10 apps with 50 Million downloads. Two years ago, along with a few friends, we…
ASUSpicious Flaw - Millions of Users’ Information Exposed Since 2022 Please note that it’s not particularly suspicious, it just made for a good play-on-words title. Introduction What do most people do when they’re mistreated by a multi-billion dollar company after reporting a zero-day RCE to them? Certainly not find another zero-day exploit, but that’s exactly what I ended…
One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by default silently install software into my OS in the background. But it could…
Note: The name of local company asked very politely to have their name redacted so it has been replaced with KiwiServices as suggested by ChatGPT Pwning a major New Zealand service provider On the evening of the 19th February 2025 I had an itch, an itch to do good in the world and to continue to polish my pen testing skills. First I went through a list of trending apps on the Google Play Store,…
How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event. With an upbeat pling my console alerted me that my script had finished running, to be precise it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups. This was achieved through a public list of sites using the .ai TLD and parsing the site…
Unplugged Some months ago, I was watching Mental Outlaw’s video talking about the UP Phone. Overall it definitely sparked some interest in me as it seemed to be very similar to the infamous Freedom Phone and Anom phone honeypot made by the feds. The only difference being that I actually had the opportunity to investigate it before it inevitably crumbled back into dust. TL:DR Overpriced phone…
Dismantling a Crappy Malware Operation The Discovery I had been made aware of a malware spreading site called obspremium.com. This site is claiming to offer a so-called “premium” version of the popular open source recording and streaming program Open Broadcaster Software at obsproject.com. “OBS Premium” hosts a direct rip of it’s legitimate counterparts landing page…
List of CVEs I have found, including dupes. 2025-05-09 - CVE-2025-3463 - 9.4 CRITICAL - https://mrbruh.com/asusdriverhub/ 2025-05-09 - CVE-2025-3462 - 8.4 HIGH - https://mrbruh.com/asusdriverhub/ 2025-07-21 - CVE-2025-4569 - 7.7 HIGH - https://mrbruh.com/asus_p2/ 2025-07-21 - CVE-2025-4570 - 6.9 MEDIUM - https://mrbruh.com/asus_p2/ 2026-02-25 - CVE-2026-27848 - 9.8 CRITICAL - (Linksys, blog post…
Bold is Albums, non bold is singles. The ♥️ tag means that this is one of my favourite artists. The 🔥 tag means that I am currently binging this Artist/Album/Song. The 🌀 tag means that this Artist/Album/Song is considered Psychedelic or Psychedelia Pop / Indie Crumb - Jinx, Locket ♥️🌀 Melody’s Echo Chamber - Self-Titled, Unfold ♥️🌀 Men I Trust - Oncle Jazz ♥️ Alt-J - An Awesome Wave…
TP-Link 2 - Electric Boogaloo This writeup is a counterpart to my “Finding a RCE in my old TP-Link router” vulnerability, and was originally planned to be released alongside it, however TP-Link lost my report and didn’t triage it until I followed up months later. You should read my other TP-Link writeup before continuing to read this, as it provides useful context. Reverse…