From One Wazuh Agent to the Whole Fleet
Two Wazuh reports exposed a path from one enrolled agent to a root write on the manager, then root execution across the agents it controls.
The notebook
Blog.
Security research, vulnerability disclosures, and things learned along the way.
13 articles
CVE-2026-78413: LocalSystem Executable Dispatch Through SysmonLogForward
A client-monitoring permission gap let an investigator select the executable path used by SysmonLogForward and dispatch it as LocalSystem.
CVE-2026-78411: Writing Velociraptor Server Metadata Through a Weaker RPC
The VQL path protected reserved server metadata with SERVER_ADMIN, but the RPC accepted the same update with only LABEL_CLIENT.
CVE-2026-77798: One Missing Unlock Wedged Velociraptor Authentication
A missing unlock on an error path let an authenticated analyst deadlock Velociraptor's shared user storage while the frontend still appeared alive.
CVE-2026-64954: Shadowing Velociraptor's Authorization Context
An analyst could replace the ordinary $acl scope variable and turn missing authorization state into a permissive collection path.
CVE-2026-19584: Stored VQL Execution During Velociraptor Notebook Restore
A notebook editor could store Go-template syntax that executed server-side VQL when an administrator later restored a normal backup.
CVE-2026-19583: Turning Velociraptor Client Monitoring into Recurring Fleet Execution
An investigator could bypass artifact type and EXECVE checks by placing an ordinary executable artifact in the client-monitoring table.
CVE-2026-19200: When Velociraptor verify() Changed the Live Repository
A validation helper loaded analyst-controlled YAML into Velociraptor's shared artifact repository, allowing trusted built-ins to be replaced in memory.
CVE-2026-19072: From Velociraptor Investigator to SuperUser
How caller-controlled compiled hunt arguments and EffectivePrincipal produced server-side VQL execution as VelociraptorServer.
CVE-2026-18972: How an HTTP Header Became a Trusted Velociraptor Identity
A code-level analysis of the metadata collision that let a reader become a Velociraptor administrator.
ParsingPeas: Automating LinPEAS Collection
Why I built ParsingPeas to collect LinPEAS and WinPEAS output and turn it into categorized HTML reports.
OSWP Certification Review: Fast-Track to Wireless Penetration Testing
A personal account of preparing for OSWP, the exam experience, and the value of the certification.
OSCP+ Certification Review: My Journey from SOC Analyst to Offensive Security
My OSCP+ preparation, study resources, exam experience, and transition from SOC work to offensive security.
No articles match. Try another search or clear the filters.