House of Banana
Posted on 2024-10-21
Hijack execution flow by abusing _rtld_global in ld.so
LFI, JWT Forgery, SQLi, Crontab abuse, Mercurial hook, Rsync privesc
XSS + RCE for PrestaShop & exploit SSTI on ChangeDetection.io
ORW ROP chain with magic gadgets to pwn a Sandbox
Exploit H2 Database for Java web app & abuse Apache Thrift
SQLPad RCE vulnerability & Froxlor exploit via Chrome remote debugging
LargeBin Attack is the future for heap exploitation.
RCE for CACTI monitor system, Auth bypass for Duplicati backup solution.