A diary of security exploration.
I played Google CTF last weekend and there was a fun Python jail challenge, PyCalc. Connecting to the provided host and port gives us a limited Python shell. We can evaluate basic arithmetic expressions, like so: $~ ncat pycalc.2024.ctfcompetition.com 1337 == proof-of-work: disabled == Simple calculator in Python, type 'exit' to exit > 1+1 Caching code validation result with key…
While poking around Parallels Desktop I found a script which is invoked by a setuid-root binary, which has the following snippet: local prl_dir="${usr_home}/Library/Parallels" if [ -e "$prl_dir" -a ! -d "$prl_dir" ]; then log warning "'${prl_dir}' is not a directory. Renaming it." mv -f "$prl_dir"{,~} continue fi Here ${usr_home} represents the home directory of the user for which Parallels…
This post details two bugs I found, a plist injection (CVE-2023-27328) and a race condition (CVE-2023-27327), which could be used to escape from a guest Parallels Desktop virtual machine. In this post I’ll break down the findings.
A while ago I was browsing the Python bug tracker, and I stumbled upon this bug - “memoryview to freed memory can cause segfault”. It was created in 2012, originally present in Python 2.7, but remains open to this day, 10 years later. This piqued my interest, so I decided to take a closer look.