4 posts
How a misplaced chroot call in sudo 1.9.14 through 1.9.17 lets any local user — with no sudoers rule and no password — trick glibc into loading an attacker-controlled shared library as root. Full root cause analysis, lab reproduction, exploitation, and detection.
How GNU Make's --eval flag, $(shell), and $(file) functions turn a permissive sudo rule into full root access — shell execution, arbitrary file read, and arbitrary file write — with no vulnerability involved.
How an attacker with shell access turns the native Linux task scheduler into a persistent backdoor that survives reboots, runs silently, and blends with legitimate system operations.
Reverse engineering SpookPass (HackTheBox): analyzing an ELF binary to extract the hidden password.