Mobile challenge solutions from TCP1P CTF: exported activity exploitation, implicit intent hijacking, and a WebView/JS interface/content provider chain.

#ctf #android #intent #webview #content-provider

2022-04-06 mobile 13 min research

InsecureShop — Android App Exploitation, pt. 1

Part 1: InsecureShop walkthrough covering insecure logging, hardcoded credentials, insecure data storage, SSL bypass, and URL validation issues.

#android #ctf #webview #hardcoded-credentials #ssl

2022-04-06 mobile 11 min research

InsecureShop — Android App Exploitation, pt. 2

Part 2: insecure broadcast receivers, implicit intent hijacking, intent redirection to protected components, and WebView file exfiltration.

#android #ctf #webview #intent #content-provider #broadcast-receiver

2022-04-06 mobile 2 min research

InsecureShop — Android App Exploitation, pt. 3

Part 3: arbitrary code execution via third-party package context loading; vulnerabilities 16-18 listed as stubs.

#android #ctf #rce #content-provider #file-provider

2022-03-22 linux 4 min research

HackTheBox — Pandora (Linux, Easy)

HackTheBox Pandora: SNMP credential leak → PandoraFMS unauthenticated SQLi to RCE → SUID binary path hijacking for root.

#htb #snmp #cms #sqli #privesc #suid

2021-11-12 pwn 16 min ctf

K3RN3LCTF 2021 — easy_kernel

Linux kernel exploitation for K3RN3LCTF 2021: stack buffer overflow in a kernel module, KASLR leak via sread(), ROP chain, and KPTI trampoline bypass.

#ctf #kernel #rop #kaslr #kpti #privesc

2020-12-04 pwn 12 min ctf

CoalFire CTF Notes

CoalFire CTF challenge notes covering stack shellcode injection, ret2libc, write-what-where, anti-debug bypass, and Firefox profile forensics.

#ctf #rop #ret2libc #re #forensics #shellcode