/posts/ Recent content in Posts on Hugo -- gohugo.io Wed, 20 May 2026 11:33:36 +0530 /posts/hunting-linux-persistence-mechanisms-with-bash/ Wed, 20 May 2026 11:33:36 +0530 /posts/hunting-linux-persistence-mechanisms-with-bash/ Linux persistence hunting usually means running half a dozen different tools chkrootkit, rkhunter, a cron audit script, a manual ss review, maybe a rootkit-specific scanner and then mentally stitching the results together. I built persisthunt that takes a different approach: it’s a single, dependency-free Bash script (365 lines) that walks through the most common Linux persistence and live-compromise techniques in one pass, and dumps everything into a flat, greppable text report. /posts/bypassing-aide-file-integrity-monitoring/ Thu, 21 Aug 2025 16:27:50 +0530 /posts/bypassing-aide-file-integrity-monitoring/ This is a writeup on two vulnerabilities I reported in AIDE (Advanced Intrusion Detection Environment) - CVE-2025-54389 and CVE-2025-54409. AIDE is a classic host-based file integrity monitoring (FIM) tool: it snapshots a baseline of the filesystem (hashes, permissions, ownership, xattrs, symlink targets, etc.), and on every subsequent run compares the live system against that database, printing a report of everything that’s been added, removed, or changed. It’s exactly the kind of tool an incident responder reaches for after a breach to answer “what did the attacker touch? /posts/bypassing-stack-canaries/ Wed, 26 Mar 2025 16:13:05 +0530 /posts/bypassing-stack-canaries/ Over the weekend, I participated in Cyber Apocalypse CTF 2025 by HackTheBox. One of the “very easy” challenge in PWN section called Quack Quack requires exploiting a stack buffer overflow and bypass stack canaries to hijack code flow. After downloading the challenge files, we see ./ ├── flag.txt ├── glibc │ ├── ld-linux-x86-64.so.2 │ └── libc.so.6 └── quack_quack We also spawn the challenge docker in the CTF platform to interact with the challenge. /posts/malloc-and-the-heap/ Wed, 26 Mar 2025 16:13:05 +0530 /posts/malloc-and-the-heap/ Another fun challenge from Cyber Apocalypse CTF 2025 by HackTheBox under pwn section — blessing In this challenge we explore the heap and how malloc works. We get to exploit a unique malloc behaviour to achieve arbitrary write access on the heap. Looking at the challenge files, we have an x86 binary blessing, flag.txt and dynamically loaded libc library. Seems like another case of code redirection to force the binary to read the flag. /posts/compromising-zammad-helpdesk-from-agent-to-root/ Thu, 21 Jul 2022 14:37:42 +0530 /posts/compromising-zammad-helpdesk-from-agent-to-root/ Last year, I spent some time digging into Zammad, the open-source help desk platform, and reported three separate vulnerabilities to the maintainers. All three were fixed in Zammad 4.1.1 / 5.0.0, and the maintainers were responsive and handled disclosure well. I’m publishing the details now, long after the fixes shipped, because the full chain is a good illustration of how “medium severity in isolation” bugs compound into “an Agent-level user can get a shell on your server. /posts/ptrace-a-post-exploitation-primitive-on-linux/ Thu, 12 May 2022 21:03:03 +0530 /posts/ptrace-a-post-exploitation-primitive-on-linux/ Most Linux developers know ptrace as the system call behind tools like gdb and strace. ptrace gives one process the ability to inspect—and even modify—the execution of another process. That makes it an incredibly useful debugging primitive, but it also makes it a valuable post-exploitation tool once an attacker gains code execution as a user. In this post we’ll look at: What ptrace actually does Why it is such a powerful attack primitive Two common abuse cases Reading sensitive process memory Injecting code into another process How sudo credential caching can amplify the impact Defensive mitigations /posts/hackthebox_remote/ Wed, 10 Jun 2020 13:50:17 +0530 /posts/hackthebox_remote/ In 2020 (thanks to COVID lockdowns), I started working on HackTheBox challenges. It is too much fun! I finally got some time to go through my notes and decided to write this brief walkthrough to the Remote machine. This is not going to be a detailed walkthrough, rather I am just going to skip over to most interesting findings. It goes without saying that there was hours of research between each stage and a lot of learning.