/ Recent content on Think Love Share Hugo -- gohugo.io en Sat, 07 Feb 2026 00:00:00 +0000 /offenskill/enketo-auth-bypass-ssrf-xxe-and-file-read/ Sat, 07 Feb 2026 00:00:00 +0000 /offenskill/enketo-auth-bypass-ssrf-xxe-and-file-read/ Introduction This training session was focused on white-box code review, application, and system runtime introspection. We wanted to work on a JavaScript backend framework and Enketo Express seemed to be a good candidate. The source code is available on GitHub - enketo/enketo-express and the version we assessed was the version 6.2.1, built with the official Dockerfiles. Enketo is a cross platform software used to (quoting): Deploy and conduct surveys that work without a connection, on any device. /offenskill/invoice-ninja-5.10.43-ssrf-and-file-read/ Fri, 14 Feb 2025 00:00:00 +0000 /offenskill/invoice-ninja-5.10.43-ssrf-and-file-read/ Hey, Happy Valentine’s day! 😽 Introduction This article is the result of an OffenSkill lvl-30 training focused on a white-box code review, tooling, and applicative introspection. The picked lab was Invoice Ninja, version 5.10.43. It is a Laravel based software and its vendor page can be found here. The source code is available on their Github. This software/product is introduced as follows: A source-available invoice, quote, project and time-tracking app built with Laravel. /offenskill/chamilo-1.11.26-post-auth-rce-via-phar-unserialize-polyglot/ Mon, 18 Nov 2024 00:00:00 +0000 /offenskill/chamilo-1.11.26-post-auth-rce-via-phar-unserialize-polyglot/ Quick update: I gave a cute rump about this training, report, and patch at GreHack 2024, feel free to check it out! ;) Chamilo 1.11.26 - Post-Auth RCE This article is the result of an OffenSkill Training. It explores a post-authentication phar unserialize leading to a remote code execution (RCE) within Chamilo (Learning Management System) 1.11.12 up to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. /hacking/spip_preauth_rce_2024_part_2_a_big_upload/ Wed, 04 Sep 2024 00:00:00 +0000 /hacking/spip_preauth_rce_2024_part_2_a_big_upload/ Hello dear reader, This article is the continuation of my Spip research, with a twist! One Spip Unauth RCE Challenge player (@Vozec1) came to me with an extra question after solving my initial challenge: “I think I found another similar bug, are you already aware of this issue?” And I was not (code changes fast)! We therefore worked together to make the most out of it, here’s our co-written story! /hacking/spip_preauth_rce_2024_part_1_the_feather/ Fri, 16 Aug 2024 00:00:00 +0000 /hacking/spip_preauth_rce_2024_part_1_the_feather/ Hi dear Sir, Madam. Please be informed that this is the third article dedicated to Spip 0-day research, if you haven’t read the first ones, I’d recommend reading them first! RCE on Spip and Root-Me RCE on Spip and Root-Me, v2! This article will cover the issue and exploit for an Unauthenticated Remote Code Execution found on Spip, it has been patched in the releases for 4-3-0-alpha2, 4-2-13, and 4. /offenskill/maarch-courrier-21.03-2nd-order-cmd-injecton-to-rce/ Sun, 16 Jul 2023 00:00:00 +0000 /offenskill/maarch-courrier-21.03-2nd-order-cmd-injecton-to-rce/ Maarch Courrier 21.03 - Remote Code Execution Introduction This training session was focused on white-box code review and runtime introspection. A few labs were suggested, but the one that peaked our attention was a web php solution named Maarch Courrier. The source code is available in their MaarchCourrier Gitlab, and the version we assessed was the dockerhub image maarch/maarchcourrier:21.03. The software is described as follows: Maarch Courrier is an Electronic Correspondence Manager (postal mail, email, etc. /hacking/kong-konga-exploitation-and-hardening/ Wed, 10 May 2023 00:00:00 +0000 /hacking/kong-konga-exploitation-and-hardening/ What is kong & why we’re relying on it If you’re an occasional reader of the manomano-tech Medium blog, you might already be familiar with Kong API Gateway thanks to previous articles more developer-focused like this one: Improve your Kong Plugin Experience (https://medium.com/manomano-tech/improve-your-kong-plugin-experience-2e4bad9d6178?source=friends_link&sk=e362d5926727f4eac35ff76584060048). If not, you can either read past blog posts as an introduction, or consider Kong as a “huge black-box that uses nginx & lua to create a clean approach to reverse-proxying” 🙂 /hacking/php-internalog-introspection-for-0day-research/ Fri, 18 Nov 2022 00:00:00 +0000 /hacking/php-internalog-introspection-for-0day-research/ This article is the transcript of a talk (FR) @Groumpf_ and I gave for the RumpARennes and GreHack events in 2022, kudos to the staff! Slides: Custom-php-Introspection-for-0-Day-Research.pdf Like previous conference-related articles, this one will sound more like a transcript than a regular “technical & in depth presentation”. Read the slides first, their explanation will be written below. 1. Whoami || Whoarewe If you’re here, you already know me. /hacking/preauth_remote_code_execution_web_page_test/ Fri, 23 Sep 2022 00:00:00 +0000 /hacking/preauth_remote_code_execution_web_page_test/ As I joined ManoMano early in April 2022 (and due to the coordinated vulnerability disclosure timeline), I’m pleased to welcome you to my first ManoMano related article! A mirror of this article is also (will soon be) available on ManoMano’s Tech Blog on Medium! https://medium.com/manomano-tech This talk was also given (english) on a @defconParis meetup in Paris the 19th of September 2022, 0. Context for this research You read it, I’m now part of the ManoMano Security-Team! /hacking/rce_on_spip_and_root_me_v2/ Tue, 16 Aug 2022 00:00:00 +0000 /hacking/rce_on_spip_and_root_me_v2/ Hello there, This is the second article dedicated to Spip 0-day research, if you haven’t read the first one, I recommend reading it first. Even though it’s not required to follow along, it’s always better to have the full context for a specific research. Here, I won’t detail again the setup process, we’ll just go through issues from the past, and the newly found issues! Oh, and if you’re here wondering if these issues were generic enough to break into Root-Me again… Yup, they were! /hacking/1001_ways_to_pwn_prod/ Thu, 14 Jul 2022 00:00:00 +0000 /hacking/1001_ways_to_pwn_prod/ This article is the transcript of a talk (FR) I gave for the HitchHack in May 2022, kudos for the staff! Event: https://hack2g2.fr/hitchhack-2022/ Slides: https://docs.google.com/presentation/d/1bkrkAJLuDjfZfsf-9A62rygWe6zR_uiOq_Yd_8X_NGY Like previous conference-related articles, this one will sound more like a transcript than a regular “technical & in depth presentation”. Read the slides first, their explanation will be written below. 1. What’s in this talk ? Every vulnerability introduced during this talk will respect the following criteria: /hacking/pty4all_the_shells_you_deserve/ Sat, 29 Jan 2022 00:00:00 +0000 /hacking/pty4all_the_shells_you_deserve/ This article is the transcript of a talk (FR) I gave at the opening of the CTF platform TheBlackSide on 29th January 2022. https://github.com/laluka/pty4all Hi there, long time no see! :) I hope you like tooling, bash scripting, and uber-duper shells, because we’re going to enhance the sad shells we had to happy automated multiplexed encrypted fully interactive PTYs with push notification and automatic persistency! Hyped? I hope so. /hacking/failed02_pulse_secure_vpn_guacamole_websocket_hooking/ Sat, 18 Dec 2021 00:00:00 +0000 /hacking/failed02_pulse_secure_vpn_guacamole_websocket_hooking/ Second article of the Failed series! We often read articles or research that explain how to exploit X or how Y works. Most of the time this seems straightforward, and yet we all struggle doing our own research. We “know” that failing is “normal”, it’s part of the process, yet it can hurt or make you feel bad. The path I now want to take, is the wrong one. /hacking/hacking_guacamole_to_trigger_avocado/ Sat, 20 Nov 2021 00:00:00 +0000 /hacking/hacking_guacamole_to_trigger_avocado/ While doing research on various topics, I stood upon Guacamole, a software that can be used as a connection bastion or protocolar gateway. It has many original vulnerabilities that lead to a Remote Code Execution once chained. Let’s begin, shall we? What the doc says Apache Guacamole is a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH. Setup the test environment There is a clear documentation that explains the setup process both with and without docker, you can read it here: /hacking/shells_with_jolokia_exploitation_toolkit/ Fri, 29 Oct 2021 00:00:00 +0000 /hacking/shells_with_jolokia_exploitation_toolkit/ TL;DR: I’m finally releasing JET, a Jolokia Exploitation Toolkit! To introduct this tool & repo, I’ll explain in detail how to get code execution with jolokia and Tomcat/Catalina Mbeans! :) Oops, I did it again. I spent too much time on Jolokia, this is a fact. Now, I want you to be able to get shells as well, and I also would like the community to contribute to this project so no jolokia can never ever survive to its pentester again. /hacking/failed01_dos_to_rce_in_jolokia/ Sun, 03 Oct 2021 00:00:00 +0000 /hacking/failed01_dos_to_rce_in_jolokia/ First article of a new series! Exciting isn’t it? We often read articles or research that explain how to exploit X or how Y works. Most of the time this seems straightforward, and yet we all struggle doing our own research. We “know” that failing is “normal”, it’s part of the process, yet it can hurt or make you feel bad. The path I now want to take, is the wrong one. /the_rest/salut_ca_va/ Fri, 24 Sep 2021 00:00:00 +0000 /the_rest/salut_ca_va/ Salut ! Ca va ? Ca va ! Et toi ? Ca va ! What a useless proloque, right? Riiight? Well, not exaclty. What if I told you that this quick chat is in fact useful, and probably one of the most used, daily, worldwide? Remember of this bad boy? This is him now :) This is this same kind of exchange used in TCP to establish a connection between a client and a server. /hacking/ssrf_to_rce_with_jolokia_and_mbeans/ Sun, 28 Feb 2021 00:00:00 +0000 /hacking/ssrf_to_rce_with_jolokia_and_mbeans/ Okey, here’s a funny one I’ve been given to exploit recently. The cause of this bug is simple: The lack of input sanitization Overview of our target A linux host (pick your favourite) A tomcat server on 127.0.0.1:8080 Basic-Auth in place Jolokia installed / deployed A php server on 0.0.0.0:8443 Php source code analysis, the root-cause Source code wasn’t provided, but luckily, directory listing was enabled, and a . /hacking/rce_on_spip_and_root_me/ Tue, 29 Sep 2020 00:00:00 +0000 /hacking/rce_on_spip_and_root_me/ Hi there, This article is about Spip, root-me.org, XSS, SQLi, and Remote Code Execution. Ever wondered how secure is your daily website ? Welcome. To. Php. Quick disclaimer before we start: In May the 23rd 2020, someone took over an admin account on root-me by password reuse and threatened to leak solutions and flags. There is no beauty in this act, no technical skill required, nor good purpose. This is just part of the “be an asshole” mindset. /hacking/a_helping_hand/ Sun, 03 May 2020 00:00:00 +0000 /hacking/a_helping_hand/ From time to time, I help friends to troubleshoot issues. Coding, system administration, hacking, pretty much anything as it’s a good opportunity to learn from what they are doing, and teach cool tricks at the same time. One big issue though is that I really rarely have a decent connection. Thus, using common tools such as TeamViewer, Anydesk, RDP, on anything else isn’t really working well, crashing, extra slow, … So. /hacking/reverse_xsshell/ Sat, 22 Feb 2020 00:00:00 +0000 /hacking/reverse_xsshell/ The initial idea While auditing a website, I found out they were using websockets to transmit data. I didn’t kow much about it so I had to ReadTheFancyManual. Once I understood that it was… Well… A socket one could use with web technologies, I asked myself “What do I usually do with sockets?” Tunnels! Transfer files! Or… Spawn reverse shells?! Or… Spawn a reverse XSShell?? What do we need? A websocket server import asyncio import websockets async def hello(websocket, path): print("WebSocket received") while True: cmd = input("cmd > ") await websocket. /hacking/infosec_made_easy/ Mon, 03 Feb 2020 00:00:00 +0000 /hacking/infosec_made_easy/ Cross Site Scripting (XSS) Quand quelqu’un t’envoie un message mais qu’en fait ce message contient une petite bestiole qui se barre avec tes clés de maison, mais en profite quand même pour te piquer 20e. Après tout, pourquoi pas ? XSSXSSXSS XSSXSSXSS XSSXSSXSS eXternal Xml Entity (XXE) Tu vois ce qu’il y a derrière les ombres au loin ? Tu ne dois jamais y aller, c’est l’out of bound, et ca risque de voler tes haches. /hacking/wordpress_subpath_auditor/ Sat, 25 Jan 2020 00:00:00 +0000 /hacking/wordpress_subpath_auditor/ About a month ago, I had to audit a wordpress website. As it was one of my first real-life pentest, I was really hyped and ready to try extra-super-hard to compromise this target. But after a few hours, I realised that : Wordpress is up to date Every plugin or theme is up to date There is no custom code (At least, I found none using gobuster and big wordlists) There is no weak credentials (Same, I found none doesn’t mean there’s none. /the_rest/sshrc_and_telegram_apis/ Fri, 17 Jan 2020 00:00:00 +0000 /the_rest/sshrc_and_telegram_apis/ The root cause While casually chatting with a colleague, he told me about the sshrc feature of sshd. He explained to me that he was using telegram’s API to get ssh login notifications on his phone. My first thought was “Yeah, sure, but it’s just a .rc file (custom settings), it’s usually quite easy to bypass with the right option… While saying that, I had in mind the trick with bash --noprofile --norc that can allow a new bash process to be spawned without using any configuration file. /hacking/ngrok_your_dockersploit/ Sun, 15 Dec 2019 00:00:00 +0000 /hacking/ngrok_your_dockersploit/ Hey, you! Aren’t you tired of always having broken tools relying on broken software? Pissed off because you just broke your system (againnn…) trying to fix your previously broken tools and now everything’s fucked-up and you want to raise penguins out of the tech world? Or even worse, you want a reverse shell but you’re : At your grandparents place and they lost the router password so you can’t expose ports So broke that you can’t buy nor rent a virtual private server Well that’s oddly specific but you’re on the exact right place on earth (and on the web)! /the_rest/a_linux_caca_story/ Sat, 06 Apr 2019 00:00:00 +0000 /the_rest/a_linux_caca_story/ The root cause Here’s the thing, I was doing some cleaning in my computer’s home directory after solving some hacking challenge. To see what kind of files where still present I ran the command ta, which is aliased (in my system) to the following function. ta () { tree -ah "$@" | lolcat; } It lists my files recursively, showing hidden files and putting some neat rainbow colors at the same time. /the_rest/new_york_datadog_and_i_week_3_to_6/ Sat, 16 Mar 2019 00:00:00 +0000 /the_rest/new_york_datadog_and_i_week_3_to_6/ Datadog parties A few times a month, parties are organized either at work, or in cool places nearby by the company. So far, I joined three times. Once to taste some whiskey, once to build our own terrarium and eat hand-made sushis, and once to go to a big-games bar. And every event was a huge success! :D There are many interns, and the vibes are always chill / funny. /the_rest/new_york_datadog_and_i_week_2/ Sat, 16 Feb 2019 00:00:00 +0000 /the_rest/new_york_datadog_and_i_week_2/ Have you seen my home? During the first week, I’ve been living with Tatiana and Mateo in a flat just below Central Park, the flat itself was really nice, but still had one problem: the building have a very strict guests policy. It was forbidden to sublease a room due to recent regulations in New-York (mainly because of RBNB’s overnight guests and… MONEY of course!). Each night, going back to the building was easy, but reaching the flat was pretty challenging. /the_rest/new_york_datadog_and_i_week_1/ Sat, 09 Feb 2019 00:00:00 +0000 /the_rest/new_york_datadog_and_i_week_1/ Before I start… You’ve been quite a lot (I wasn’t expecting that much to be honest) to ask me for news. I’d like to spend hours speaking with each of you, but the thing is that with all I have to do during the first week (register into administrative stuff, open a bank account, get well in the place, start work, socialize a bit, recover some sleep, …) and the fact that I don’t have the right phone package yet. /the_rest/website_migration/ Sun, 09 Dec 2018 00:00:00 +0000 /the_rest/website_migration/ 2024 Update Henlo! We now live in github pages, yet we keep this article for legacy. The setup doesn’t change much, just read the doc yo! Why change ? I used to write from time to time on thinkloveshare.blogspot.com which will soon be retired, replaced by thinkloveshare.com. I decided to change for quite a few reasons, here’s the story: Code format There was no easy way to display code snippets. /hacking/grehack_2018/ Fri, 16 Nov 2018 00:00:00 +0000 /hacking/grehack_2018/ Before I start… One year ago was my first on-site hacking event : GreHack 2017 ! The conferences were great, I met a few cool people there, and the CaptureTheFlag was awesome, even tho I had almost no knowledge, there’s always a starting point huh ? I spent the whole year doing my best to gain hacking knowledge, meet people into infosec, solve challenges, join events, conferences, CTFs, … /hacking/algebra/ Sun, 16 Sep 2018 00:00:00 +0000 /hacking/algebra/ Description Are you a real math wiz? nc misc.chal.csaw.io 9002 TL;DR This challenge consists in equations being thrown at us that we have to solve and send the result in order to get the flag. Python and sage, I invoke you ! Methology A friend I was talking with while solving this chall told me : Well, the equations are simple, let’s write a quick script to solve it ! /hacking/big_boi/ Sun, 16 Sep 2018 00:00:00 +0000 /hacking/big_boi/ Description Only big boi pwners will get this one! nc pwn.chal.csaw.io 9000 You can download the ELF here TL;DR This challenge is a simple buffer overflow with a check that may lead to code execution. It’s an easy pwn, so one liner is the way to go ! Methology Step 1 : Use IDA to decompile the program and avoid losing time, then overflow it with the good value many time to access the “/bin/bash” statement. /hacking/shell_code/ Sun, 16 Sep 2018 00:00:00 +0000 /hacking/shell_code/ Description Linked lists are great! They let you chain pieces of data together. nc pwn.chal.csaw.io 9005 You can download the ELF file : here TL;DR This challenge uses linked list and leaks an address, the stack is executable, a short shellcode and a relative jump will do the trick ! Methology Step 1 : Use IDA to decompile the program, find the two useful functions that fills the linked list and expose the buffer overflow. /hacking/short_circuit/ Sun, 16 Sep 2018 00:00:00 +0000 /hacking/short_circuit/ Description Start from the monkey’s paw and work your way down the high voltage line, for every wire that is branches off has an element that is either on or off. Ignore the first bit. Standard flag format. -Elyk TL;DR This challenge consists in the analysis of a lovely electronic scheme. It is composed of diodes, wires, wires, wires and wires. The goal is to extract bits of data from the circuit. /hacking/excess_ess_1/ Mon, 04 Jun 2018 00:00:00 +0000 /hacking/excess_ess_1/ This challenge is called “Excess Ess 1”, a funny name for XSS, which is an attack that consists in forcing our victim’s browser to execute code (most of the time javascript) without its consent. This challenge was proposed by the 2018’s edition of the SecurityFest CTF. The goal Most of the time, to prove that an XSS is possible, the hacker provides a payload that pops an alert. And that’s exactly what we’re asked to do. /hacking/pwn_4of4_stak_pivot_to_ze_moon/ Thu, 10 May 2018 00:00:00 +0000 /hacking/pwn_4of4_stak_pivot_to_ze_moon/ Small edit after the initial publication of the articles: These four articles lead me to give an “pwn introductory” conference at the HitchHack 2018. It summarizes the first 3 articles but goes less into detail. If this format suits you better, the slides are downloadable here and the video (French only) here : Pwn Road, last introductory article! I promised you some heavy stuff for the final, and what is said, is due! /hacking/pwn_3of4_saperliropette/ Wed, 09 May 2018 00:00:00 +0000 /hacking/pwn_3of4_saperliropette/ Small edit after the initial publication of the articles: These four articles lead me to give an “pwn introductory” conference at the HitchHack 2018. It summarizes the first 3 articles but goes less into detail. If this format suits you better, the slides are downloadable here and the video (French only) here : Pwn Road, third stop, welcome aboard! Yesterday, the simple buffer overflow and ret2libc, today, ROP, or Return Oriented Programming, and tomorrow… Tomorrow the conquest of the world! /hacking/pwn_2of4_ret2libc/ Tue, 08 May 2018 00:00:00 +0000 /hacking/pwn_2of4_ret2libc/ Small edit after the initial publication of the articles: These four articles lead me to give an “pwn introductory” conference at the HitchHack 2018. It summarizes the first 3 articles but goes less into detail. If this format suits you better, the slides are downloadable here and the video (French only) here : Welcome to this 2nd article dedicated to pwning linux executables! On the list today, the ret2libc, or return to lib C. /hacking/pwn_1of4_buffer_overflow/ Thu, 03 May 2018 00:00:00 +0000 /hacking/pwn_1of4_buffer_overflow/ Small edit after the initial publication of the articles: These four articles lead me to give an “pwn introductory” conference at the HitchHack 2018. It summarizes the first 3 articles but goes less into detail. If this format suits you better, the slides are downloadable here and the video (French only) here : printf(“Mr, Ms %s, bonjour. “, lecteur); Today, I want to offer you an article more sophisticated than usual, the first of new kind, an article dealing with heavy stuff, in short, an article that blows ass! /the_rest/a_question_of_standards/ Sat, 01 Apr 2017 00:00:00 +0000 /the_rest/a_question_of_standards/ Hello dear reader, Today, I would like to talk to you about a deep subject, but in a very superficial way. I would like to talk to you about our society, the groups that are born, live and die in it. Groups, of course, but focused on the individuals who compose them, or who oppose to them. As usual, I will try to share with you a way of seeing things: mine. /the_rest/une_histoire_de_coquelicot/ Thu, 30 Mar 2017 00:00:00 +0000 /the_rest/une_histoire_de_coquelicot/ Et si, pour varier un peu, on prenait le large ? Et si on laissait la technologie de côté un petit instant, histoire de se divertir ? Et si on lisait un peu ? Le concept est simple, je reçois un début de texte, d’histoire, quelques mots, une idée, et je brode dessus tant bien que mal, en espérant que le rendu final soit sympathique ! =] Texte proposé Une femme furieuse vêtue d’une robe rouge sort du bus. /the_rest/reasoning_without_headache/ Tue, 07 Mar 2017 00:00:00 +0000 /the_rest/reasoning_without_headache/ Today, I propose to take a step back on how to approach problems, research, or even…. Life in general? Prologue What I am going to tell you here is common sense to me, but it took me years to adopt these few methods, and even then, sometimes I forget to use them and quickly regret it. I will therefore present some ideas and techniques that will serve you in your studies (cuckoo math and physics that hurts! /about/ Sat, 01 Jan 2000 00:00:00 +0000 /about/ ThinkLoveShare Here you’ll find all kind of information, mainly IT security and development related but not only. I sometime like to share random thoughts, reflections, tools, songs, writings, travels, … Whoami PDF Resume here: english.pdf || french.pdf Everything else: linktr.ee/TheLaluka Hello there ! My name is Louka Jacques-Chevallier, also known as Laluka. I love learning, teaching and sharing tips. I lived here for quite a while, and this is the place I like the most on earth, so while you’re here, enjoy the view ! /sponso/ Sat, 01 Jan 2000 00:00:00 +0000 /sponso/ ThinkLoveShare Writing InfoSec BlogPosts & Streaming takes time and requires a decent setup (and work-life balance). If you like the work done here and want to help me moving forward with new research & projects (thanks! ❤️ ), here are a few options! Sponsor a Stream-Episode twitch.tv/thelaluka or BlogPost You can suggest a topic, guest, tool or feature to PoC Your logo & links will be reflected Live & in the Wall of Support below Make a one-shot or reccurent small donation through one of Tipeee - tipeee. /streaming/ Sat, 01 Jan 2000 00:00:00 +0000 /streaming/ Stream @ twitch.tv/thelaluka Replays @ youtube.com/@TheLaluka Alerts @ twitter.com/TheLaluka Community @ discord/ThinkLoveShare Everything @ linktr.ee/TheLaluka Past Streams Stream Replayz 2024 Pentest Role Play Game Stream Replayz 2023 OffenSkill-Related