https://initblog.com/posts/ Recent content in Posts on initblog.com https://initblog.com/images/papermod-cover.png https://initblog.com/images/papermod-cover.png Hugo -- 0.151.0 en initstring Thu, 04 Dec 2025 00:00:00 +0000 https://initblog.com/2025/abrt-root/ Thu, 04 Dec 2025 00:00:00 +0000 https://initblog.com/2025/abrt-root/ In October 2025, I discovered CVE-2025-12744, a local privilege escalation affecting Fedora Linux. This post details how I chained a 12-byte command injection in the ABRT daemon into a three-stage exploit to escape the systemd sandbox and gain root. https://initblog.com/2025/ollama-driveby/ Tue, 19 Aug 2025 00:00:00 +0000 https://initblog.com/2025/ollama-driveby/ A vulnerability in the Ollama desktop GUI’s cross-origin controls allowed malicious websites to reconfigure local application settings, redirecting all private AI conversations to attacker-controlled servers. https://initblog.com/2023/nuclei-cloud-enum/ Sat, 30 Dec 2023 00:00:00 +0000 https://initblog.com/2023/nuclei-cloud-enum/ Nuclei, the open-source vulnerability scanner, now supports enumerating public cloud resources across AWS, Azure, and GCP using new self-contained templates. https://initblog.com/2021/rtl-driveby/ Sat, 31 Jul 2021 00:00:00 +1000 https://initblog.com/2021/rtl-driveby/ Ride the Lightning is a popular add on for Bitcoin full-node distributions like Umbrel. A recent bug would have allowed remote attackers to empty Bitcoin wallets via malicious JavaScript, due to an overly permissive HTTP CORS header. https://initblog.com/2020/firefox-android/ Tue, 15 Sep 2020 00:00:00 +0000 https://initblog.com/2020/firefox-android/ The SSDP engine in Firefox for Android (68.11.0 and below) can be tricked into triggering Android intent URIs with zero user interaction. This attack can be leveraged by attackers on the same WiFi network and manifests as applications on the target device suddenly launching, without the users’ permission, and conducting activities allowed by the intent. https://initblog.com/2020/oslogin-privesc/ Thu, 04 Jun 2020 00:00:00 +0000 https://initblog.com/2020/oslogin-privesc/ Google Cloud Platform provides OS Login for managing SSH access to compute instance using IAM roles. I discovered multiple ways to escalate privileges from the non-administrative IAM role to the administrative one. These vulnerabilities manifest as local root exploits, allowing non-administrative users to execute commands as the root user. https://initblog.com/2019/switcheroo/ Fri, 09 Aug 2019 00:00:00 +0000 https://initblog.com/2019/switcheroo/ Unauthenticated attackers on a local network can force stock Windows systems to perform arbitrary HTTP GET requests, including to the target’s localhost interface. No user interaction is required. No IIS installation is required. https://initblog.com/2019/lxd-root/ Mon, 20 May 2019 00:00:00 +0000 https://initblog.com/2019/lxd-root/ Linux systems running LXD are vulnerable to privilege escalation via multiple attack paths, two of which are published in my lxd_root GitHub repository. This blog will go into the details of what I think is a very interesting path - abusing relayed UNIX socket credentials to speak directly to systemd’s private interface. https://initblog.com/2019/dirty-sock/ Wed, 13 Feb 2019 00:00:00 +0000 https://initblog.com/2019/dirty-sock/ In January 2019, I discovered a privilege escalation vulnerability in default installations of Ubuntu Linux. This was due to a bug in the snapd API, a default service. Any local user could exploit this vulnerability to obtain immediate root access to the system. https://initblog.com/2019/servu-privesc/ Fri, 08 Feb 2019 00:00:00 +0000 https://initblog.com/2019/servu-privesc/ I found an interesting way to achieve remote code execution on a recent test. I ended up submitting a detailed description of manual exploitation to the vendor, and I thought it might be interesting to share here. https://initblog.com/2018/redteam-lanyards/ Sun, 09 Dec 2018 12:00:00 +0000 https://initblog.com/2018/redteam-lanyards/ I noticed a nice, cheap, low-tech alternative to badge cloning on a recent physical security engagement and thought I’d share. This post is going to be short and sweet. https://initblog.com/2018/phishing-for-screenshots/ Sun, 02 Dec 2018 12:00:00 +0000 https://initblog.com/2018/phishing-for-screenshots/ When performing social engineering engagements, it’s tricky to find a payload that demonstrates the gravity of the attack without going full-on red team and shelling boxes. I’ve developed something for a recent test that I think finds a nice balance - an Excel macro that will take a screenshot of the user’s desktop and leverage their local Outlook profile to email it back to a predefined address. https://initblog.com/2018/ntlm-mobile-app-relay/ Mon, 01 Oct 2018 12:00:00 +0000 https://initblog.com/2018/ntlm-mobile-app-relay/ Working on hacking a mobile app that uses NTLM to authenticate to a back-end web service? Make sure to check out Part 1 first. In this blog, we’ll assume we could not crack the password and instead need to relay the Challenge/Response to interact with the API. https://initblog.com/2018/ntlm-mobile-app-crack/ Sun, 30 Sep 2018 12:00:00 +0000 https://initblog.com/2018/ntlm-mobile-app-crack/ Doing a black-box test of a mobile app that uses NTLM authentication to speak to the web service? You may find your typical tools won’t work. Read on for information on intercepting, inspecting, and modifying the API calls. You might even get lucky and crack a clear-test master password. https://initblog.com/2018/plex-xxe/ Wed, 01 Aug 2018 00:00:00 +0000 https://initblog.com/2018/plex-xxe/ The XML parsing engine for Plex Media Server’s SSDP/UPNP functionality was vulnerable to an XML External Entity Processing (XXE) attack. This would have allowed attackers to access arbitrary files and capture NetNTLM challenge/response. https://initblog.com/2018/bitcoin2-cracking-wallets/ Mon, 05 Feb 2018 12:00:00 +0000 https://initblog.com/2018/bitcoin2-cracking-wallets/ This is part two in a series of blogs on cryptocurrencies and security. The goal is to show how passwords can be recovered for encrypted Bitcoin Core (or Satoshi Client) wallets. https://initblog.com/2018/bitcoin1-cracking-usb/ Thu, 18 Jan 2018 12:00:00 +0000 https://initblog.com/2018/bitcoin1-cracking-usb/ This is part one in a series of blogs on cryptocurrencies and security. The goal show how your private keys could be extracted from an encrypted USB stick, like a Tails OS persistent volume. https://initblog.com/2017/pentesting-flash/ Sun, 17 Sep 2017 15:04:23 +0000 https://initblog.com/2017/pentesting-flash/ In this post, we will walk through detailed steps to intercept, review, modify, and replay flash-based web apps. For demonstration purposes, I’ve selected a blackjack-style card game. https://initblog.com/2017/pizza-hacking/ Sun, 03 Sep 2017 00:00:00 +0000 https://initblog.com/2017/pizza-hacking/ A real-life example of bypassing UI restrictions in a web application. https://initblog.com/2017/android-burpsuite/ Fri, 28 Jul 2017 00:00:00 +0000 https://initblog.com/2017/android-burpsuite/ Beginners guide to intercepting HTTP traffic on Android. https://initblog.com/2017/lyricpass/ Wed, 26 Apr 2017 00:00:00 +0000 https://initblog.com/2017/lyricpass/ Generate targeted password wordlists based on song lyrics for specific artists.