https://th3b0ywh0l1v3d.github.io/tags/rce/ Recent content in Rce on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/plant-photographer/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/plant-photographer/ SSRF via a pycurl download endpoint chains into file:// LFI, Werkzeug debug PIN cracking, and full RCE on a Dockerised Flask app. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/cat-gifs/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/cat-gifs/ A PHP upload app re-encodes every GIF through PHP-GD as sanitization but never validates the filename — a payload smuggled inside the GIF color palette survives the re-encode, yielding a GIF/PHP polyglot webshell and RCE. https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ A Pyodide client serializes requests with pickle obfuscated by a hardcoded XOR key, letting the server pickle.loads attacker data for unauthenticated root RCE, then hooking the live handler to capture the adminbot’s plaintext login password. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/paradise-nut/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/paradise-nut/ Abusing pnut-sh’s C-to-shell codegen, where a C local named REPLY aliases the tainted shell $REPLY from gets() and detonates command execution via bash arithmetic to run the setuid nl on /flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/volatile-component/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/volatile-component/ Exploiting a GitHub Actions workflow that interpolates an untrusted issue body into a run block, gaining RCE to dump the FLAG secret from the Runner.Worker process memory and exfiltrating it as hex to bypass log masking.