Yuval Miller / Security research
Vulnerability research, disclosures, and technical notes. A closer look at how software works and where it breaks.
Why I built ParsingPeas to collect LinPEAS and WinPEAS output and turn it into categorized HTML reports.
Read article
Tools / 4 min read
Two Wazuh reports exposed a path from one enrolled agent to a root write on the manager, then root execution across the agents it controls.
A client-monitoring permission gap let an investigator select the executable path used by SysmonLogForward and dispatch it as LocalSystem.
The VQL path protected reserved server metadata with SERVER_ADMIN, but the RPC accepted the same update with only LABEL_CLIENT.
A missing unlock on an error path let an authenticated analyst deadlock Velociraptor's shared user storage while the frontend still appeared alive.