/categories/exploit-dev/ Recent content in Exploit-Dev on unixawy.com | Security Blog Hugo en-us Fri, 01 Aug 2025 13:02:40 +0000 /sccm-tampering-with-deployment-boundaries-for-eop/ Fri, 01 Aug 2025 13:02:40 +0000 /sccm-tampering-with-deployment-boundaries-for-eop/ An in-depth analysis of how automated software deployment mechanisms in Microsoft Endpoint Configuration Manager (SCCM / MEM) introduce local privilege escalation vectors via DLL hijacking, race conditions, and WMI triggering. /enterprise-admin-golden-ticket/ Sun, 24 May 2020 03:20:32 +0000 /enterprise-admin-golden-ticket/ How compromising a child Active Directory domain leads to complete forest takeover by injecting the forest Enterprise Admins SID into a forged Golden Ticket (SID History abuse). /dynamic-memory/ Fri, 22 May 2020 04:27:54 +0000 /dynamic-memory/ A deep dive into Linux dynamic memory management: malloc internals, ptmalloc chunk headers, free chunk structures, bins, and allocation syscalls (brk/sbrk vs mmap). /gdb-init/ Mon, 04 Feb 2019 22:35:25 +0000 /gdb-init/ How to configure native GDB stop hooks and Intel disassembly syntax in ~/.gdbinit to automatically display registers, opcodes, and stack memory on break without third-party plugins. /shellcode-validation-via-c-pointer/ Mon, 15 Oct 2018 17:19:50 +0000 /shellcode-validation-via-c-pointer/ A minimal C harness to test, validate, and debug raw assembly shellcode by casting a byte array into an executable function pointer. /port-forward-pivoting-meterpreter/ Thu, 08 Jan 2015 22:55:55 +0000 /port-forward-pivoting-meterpreter/ How to pivot through compromised multi-homed hosts into isolated internal networks using Meterpreter's portfwd and Metasploit autoroute. /metasploit-payload-executable-exe/ Thu, 08 Jan 2015 17:22:37 +0000 /metasploit-payload-executable-exe/ A quick reference for generating staged and stageless Windows Portable Executable (PE) payloads using Metasploit's msfvenom. /smash-stack-level6/ Fri, 05 Dec 2014 00:28:10 +0000 /smash-stack-level6/ A walkthrough of Level 6 on Smash The Stack IO, exploiting struct alignment, language localization buffers, and environment variable shellcode injection. /get-environment-variable-memory-address/ Thu, 04 Dec 2014 19:32:27 +0000 /get-environment-variable-memory-address/ How to reliably determine the memory address of environment variables on the Linux stack during binary exploitation and ret2env attacks. /smash-the-stack-level-5/ Wed, 03 Dec 2014 13:59:04 +0000 /smash-the-stack-level-5/ A walkthrough of Level 5 on Smash The Stack IO, developing a classic stack-based buffer overflow exploit with shellcode and NOP sled. /smash-the-stack-level4/ Wed, 03 Dec 2014 13:27:27 +0000 /smash-the-stack-level4/ A walkthrough of Level 4 on Smash The Stack IO, exploiting an unquoted binary call via PATH variable hijacking. /underc0de-3-walkthrough/ Wed, 03 Dec 2014 10:37:59 +0000 /underc0de-3-walkthrough/ A comprehensive Boot2Root walkthrough of the Underc0de 3 challenge: base64 Local File Inclusion (LFI), SSH key discovery, command injection in a Python cronjob, and SUID stack buffer overflow. /smash-the-stack-level3/ Mon, 01 Dec 2014 18:09:38 +0000 /smash-the-stack-level3/ A walkthrough of Level 3 on Smash The Stack IO, exploiting a stack buffer overflow with memcpy to overwrite a function pointer. /smash-the-stack-level2/ Mon, 01 Dec 2014 00:48:04 +0000 /smash-the-stack-level2/ A walkthrough of Level 2 on the Smash The Stack IO wargame, exploiting signed integer overflow with SIGFPE to spawn a privileged shell. /smash-the-stack-level1/ Mon, 01 Dec 2014 00:08:03 +0000 /smash-the-stack-level1/ A walkthrough of Level 1 on the Smash The Stack IO wargame, analyzing a SUID binary using strings and GDB to extract the passcode.