Mike Vedete

For cyber adversaries, Ivanti is the gift that keeps on giving. The latest vulnerabilities in Ivanti VPN devices have been actively exploited, leading to several critical security concerns. Here’s a summary of the key vulnerabilities and related information. [Read More]

Astronaut from ProvingGround Practice, is a warmup machine that has a short exploitation path. Rooting the box requires a known exploit and an simple privledege escalation. As always, good enumeration is key. [Read More]

Beep from Hackthebox, is a fairly easy machine that multiple exploitation paths. The first path we will take is direct to root and involves a little enumeration, identifying an exploit and a few good guesses. The second path, will involve examining a second exploit that does not work in its default configuration. A key piece of information is required for the exploit to be successful and return a reverse shell. From there the privilege escalation is straightforward to escalate to the root user. Enumeration [Read More]

Bashed from Hackthebox, is a fairly easy machine without too many rabbit holes. Exploitation involves performing good enumeration, not overlooking the quick wins, a bit of curiosity. Overall its a good box for and serves as a good reminder not to over complicate it. [Read More]