May 24Review of past year HTB Lina’s invitation CTF challenge walkthroughLina’s invitation was a forensics challenge based on the Follina msdt vulnerability with CVE-2022–30190. There are tons of information related and PoCs available where we can see the way the vulnerability was exploited: https://github.com/chvancooten/follina.py https://github.com/JohnHammond/msdt-follina https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug # The challenge4 min read4 min read
Oct 23, 2022Text4Shell CVE-2022–42889 brief vulnerability analysis and exploitationThis month an arbitrary code execution in Apache Commons Text was reported by Álvaro Muñoz. The vulnerability exists in the StringSubstitutor interpolator object in Apache Commons Text versions 1.5–1.9. Using prefix lookups “script”, “dns” and “url” in strings lookups ${prefix:name}would allow a crafted string to execute arbitrary scripts when passed…Text4shell2 min readText4shell2 min read
May 20, 2022Spring4Shell CVE-2022–22965 vulnerability analysis and exploitationLet’s talk about an interesting vulnerability that came out on the end of march 2022 named Spring4Shell. …Spring4shell5 min readSpring4shell5 min read
Mar 18, 20221337UP live Intigriti CTF 2022https://www.intigriti.com/1337uplive The challenges were amazing, though I have not the chance to actively participate much during the competition. The CTF remained alive for quite a bit, so as a note to myself I came up with some brief writeups of the challenges I tried. There are a lot of online…Ctf9 min readCtf9 min read
Jun 14, 2020OWASP LATAM at Home CTF 2020 write-upParticipé del evento de OWASP LATAM @ Home donde una gran comunidad de apasionados y apasionadas por la seguridad nos vimos reunidos. Conferencias y talleres de muy alto nivel y CTFs desafiantes. …Ctf13 min readCtf13 min read
Apr 22, 2020WPI CTF 2020 write-upHere we are again! Thanks for reading, I leave the solutions for some of the challenges I made of this awesome CTF. Stego: Luna (150)Ctf6 min readCtf6 min read
Apr 12, 2020Deep CTF 2020 write-upHi and thanks for reading! I will be writing about this great CTF I played last weekend and the way I solved many challenges. Thanks to the community for always being there! I learn a lot from all of you. Well, let’s go to the point ;) Forensics: Warm Up (50)Ctf13 min readCtf13 min read
