Offensive security writeups and research.https://aeth3ron.io/enhttps://aeth3ron.io/en/research/react2shell-cve-2025-55182/https://aeth3ron.io/en/research/react2shell-cve-2025-55182/Complete technical analysis of CVE-2025-55182 (React2Shell): insecure deserialization in the RSC Flight protocol of React 19 enabling pre-auth RCE with CVSS 10.0.Wed, 10 Dec 2025 00:00:00 GMTrcecriticalwebCVE-2025-55182https://aeth3ron.io/en/research/langflow-rce-cve-2025-3248/https://aeth3ron.io/en/research/langflow-rce-cve-2025-3248/Technical analysis of CVE-2025-3248: unauthenticated remote code execution in Langflow through the Python code validation endpoint with CVSS 9.8.Tue, 06 May 2025 00:00:00 GMTrcecriticalaiCVE-2025-3248https://aeth3ron.io/en/writeups/vault/https://aeth3ron.io/en/writeups/vault/Guest SMB write access exploited via malicious LNK file to capture NTLMv2 hash; cracked for WinRM foothold, then GenericWrite on Default Domain Policy abused with SharpGPOAbuse for admin.Thu, 20 Feb 2025 00:00:00 GMTwindowsactive-directorysmbntlm-theftresponderhashcatgenericwritegpo-abusesharphoundbloodhoundhttps://aeth3ron.io/en/writeups/editor/https://aeth3ron.io/en/writeups/editor/Exploiting XWiki (CVE-2025-24893) for RCE and privilege escalation via SUID abuse on ndsudo (CVE-2024-32019).Mon, 17 Feb 2025 00:00:00 GMTlinuxxwikicve-2025-24893suidcve-2024-32019rcecredentials-exposurehttps://aeth3ron.io/en/writeups/resourced/https://aeth3ron.io/en/writeups/resourced/Credentials leaked in LDAP description field give access to ntds.dit backup; hashes dumped for WinRM foothold, then RBCD attack via GenericWrite on DC for SYSTEM.Wed, 12 Feb 2025 00:00:00 GMTwindowsactive-directoryntds-ditpass-the-hashgenericwriterbcdbloodhoundkerberoshttps://aeth3ron.io/en/writeups/heist/https://aeth3ron.io/en/writeups/heist/SSRF for NTLM hash capture with Responder, GMSA password reading for lateral movement, and SeRestorePrivilege Utilman binary hijack for SYSTEM.Mon, 10 Feb 2025 00:00:00 GMTwindowsssrfntlm-relayrespondergmsaserestoreprivilegeutilmanbloodhoundactive-directoryhttps://aeth3ron.io/en/writeups/nagoya/https://aeth3ron.io/en/writeups/nagoya/Multi-stage attack chain in AD: username harvesting, password spraying, GenericAll abuse, Silver Ticket forgery for MSSQL, and SeImpersonatePrivilege exploitation.Mon, 10 Feb 2025 00:00:00 GMTwindowsactive-directorygenericallkerberoastingsilver-ticketmssqlseimpersonateprivilegeprintspooferhttps://aeth3ron.io/en/writeups/hokkaido/https://aeth3ron.io/en/writeups/hokkaido/Multi-stage pivoting in a Windows AD environment: from SMB share discovery to MSSQL impersonation, Targeted Kerberoasting, and SeBackupPrivilege abuse.Wed, 05 Feb 2025 00:00:00 GMTwindowsactive-directorymssqlkerberoastingsebackupprivilegepivotingbloodhoundhttps://aeth3ron.io/en/writeups/slort/https://aeth3ron.io/en/writeups/slort/RFI vulnerability exploitation for foothold as rupert, then replacing a scheduled TFTP.EXE binary with an msfvenom payload to escalate to administrator.Sat, 01 Feb 2025 00:00:00 GMTwindowsrfilfifile-inclusionphpscheduled-taskmsfvenomhttps://aeth3ron.io/en/writeups/hutch/https://aeth3ron.io/en/writeups/hutch/Information disclosure in LDAP description fields for foothold, WebDAV exploitation, and LAPS password retrieval for SYSTEM.Thu, 30 Jan 2025 00:00:00 GMTwindowsldapinformation-disclosurewebdavlapsactive-directoryhttps://aeth3ron.io/en/writeups/kevin/https://aeth3ron.io/en/writeups/kevin/Exploitation of HP Power Manager 4.2 via a buffer overflow (CVE-2009-3999) for immediate SYSTEM access.Sat, 25 Jan 2025 00:00:00 GMTwindowshp-power-managerbuffer-overflowmetasploitcve-2009-3999https://aeth3ron.io/en/writeups/internal/https://aeth3ron.io/en/writeups/internal/Exploitation of the MS09-050 SMBv2 vulnerability for immediate remote code execution as NT AUTHORITY\\SYSTEM.Mon, 20 Jan 2025 00:00:00 GMTwindowssmbms09-050metasploitlegacy-windowsrcehttps://aeth3ron.io/en/writeups/intentions/https://aeth3ron.io/en/writeups/intentions/Leverage SQL injection for authentication bypass, exploit PHP Imagick for RCE, recover hardcoded Git credentials, and perform a side-channel attack using file capabilities.Thu, 15 Aug 2024 00:00:00 GMTlinuxsqliapi-manipulationimagickgitside-channelcapabilitieshttps://aeth3ron.io/en/writeups/sau/https://aeth3ron.io/en/writeups/sau/Exploiting Request Baskets 1.2.1 SSRF (CVE-2023-27163) chained with Maltrail v0.53 command injection for RCE, and privilege escalation via sudo abuse on systemctl.Sun, 10 Dec 2023 00:00:00 GMTlinuxrequest-basketscve-2023-27163ssrfmaltrailcommand-injectionsystemctl