/ Recent content on Hugo -- gohugo.io Tue, 21 Jul 2026 13:10:47 +0530 /tools/ Tue, 21 Jul 2026 13:10:47 +0530 /tools/ Security and general tools built by me. persisthunt A lightweight Linux persistence hunting & artifact collection script. This bash script helps speed up investigations by collecting targeted persistence-related artifacts and highlighting suspicious patterns commonly associated with Linux persistence techniques. pacecalculator.net Pace calculator and related tools for runners - a website I built and maintain bpfdoorpoc bpfdoor malware implements an interesting technique for C&C communication using BPF with raw network socket. /vulnerabilities/ Fri, 17 Jul 2026 21:38:52 +0530 /vulnerabilities/ CVEs discovered and reported by me. CVE-2026-46388 Medium Arbitrary file read in osquery osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. An unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted. If the carve targets a directory that the attacker controls, arbitrary file reads are possible (such as /etc/shadow). CVE-2025-54409 Medium NULL pointer dereference in AIDE /posts/hunting-linux-persistence-mechanisms-with-bash/ Wed, 20 May 2026 11:33:36 +0530 /posts/hunting-linux-persistence-mechanisms-with-bash/ Linux persistence hunting usually means running half a dozen different tools chkrootkit, rkhunter, a cron audit script, a manual ss review, maybe a rootkit-specific scanner and then mentally stitching the results together. I built persisthunt that takes a different approach: it’s a single, dependency-free Bash script (365 lines) that walks through the most common Linux persistence and live-compromise techniques in one pass, and dumps everything into a flat, greppable text report. /posts/bypassing-aide-file-integrity-monitoring/ Thu, 21 Aug 2025 16:27:50 +0530 /posts/bypassing-aide-file-integrity-monitoring/ This is a writeup on two vulnerabilities I reported in AIDE (Advanced Intrusion Detection Environment) - CVE-2025-54389 and CVE-2025-54409. AIDE is a classic host-based file integrity monitoring (FIM) tool: it snapshots a baseline of the filesystem (hashes, permissions, ownership, xattrs, symlink targets, etc.), and on every subsequent run compares the live system against that database, printing a report of everything that’s been added, removed, or changed. It’s exactly the kind of tool an incident responder reaches for after a breach to answer “what did the attacker touch? /posts/bypassing-stack-canaries/ Wed, 26 Mar 2025 16:13:05 +0530 /posts/bypassing-stack-canaries/ Over the weekend, I participated in Cyber Apocalypse CTF 2025 by HackTheBox. One of the “very easy” challenge in PWN section called Quack Quack requires exploiting a stack buffer overflow and bypass stack canaries to hijack code flow. After downloading the challenge files, we see ./ ├── flag.txt ├── glibc │ ├── ld-linux-x86-64.so.2 │ └── libc.so.6 └── quack_quack We also spawn the challenge docker in the CTF platform to interact with the challenge. /posts/malloc-and-the-heap/ Wed, 26 Mar 2025 16:13:05 +0530 /posts/malloc-and-the-heap/ Another fun challenge from Cyber Apocalypse CTF 2025 by HackTheBox under pwn section — blessing In this challenge we explore the heap and how malloc works. We get to exploit a unique malloc behaviour to achieve arbitrary write access on the heap. Looking at the challenge files, we have an x86 binary blessing, flag.txt and dynamically loaded libc library. Seems like another case of code redirection to force the binary to read the flag. /posts/compromising-zammad-helpdesk-from-agent-to-root/ Thu, 21 Jul 2022 14:37:42 +0530 /posts/compromising-zammad-helpdesk-from-agent-to-root/ Last year, I spent some time digging into Zammad, the open-source help desk platform, and reported three separate vulnerabilities to the maintainers. All three were fixed in Zammad 4.1.1 / 5.0.0, and the maintainers were responsive and handled disclosure well. I’m publishing the details now, long after the fixes shipped, because the full chain is a good illustration of how “medium severity in isolation” bugs compound into “an Agent-level user can get a shell on your server. /posts/ptrace-a-post-exploitation-primitive-on-linux/ Thu, 12 May 2022 21:03:03 +0530 /posts/ptrace-a-post-exploitation-primitive-on-linux/ Most Linux developers know ptrace as the system call behind tools like gdb and strace. ptrace gives one process the ability to inspect—and even modify—the execution of another process. That makes it an incredibly useful debugging primitive, but it also makes it a valuable post-exploitation tool once an attacker gains code execution as a user. In this post we’ll look at: What ptrace actually does Why it is such a powerful attack primitive Two common abuse cases Reading sensitive process memory Injecting code into another process How sudo credential caching can amplify the impact Defensive mitigations /posts/hackthebox_remote/ Wed, 10 Jun 2020 13:50:17 +0530 /posts/hackthebox_remote/ In 2020 (thanks to COVID lockdowns), I started working on HackTheBox challenges. It is too much fun! I finally got some time to go through my notes and decided to write this brief walkthrough to the Remote machine. This is not going to be a detailed walkthrough, rather I am just going to skip over to most interesting findings. It goes without saying that there was hours of research between each stage and a lot of learning. /home/ Mon, 01 Jan 0001 00:00:00 +0000 /home/ Hello, my name is Rajesh Pangare, I’m a Security Engineer. I enjoy understanding how systems work under the hood and applying that knowledge to make software more secure. I have had the opportunity to work across multiple cybersecurity domains, including application security, vulnerability management, Linux/macOS security, detection engineering, and digital forensics & incident response. I primarily write Python and Bash, but particularly enjoy auditing C and C++ code for security vulnerabilities.