Application Security on Christoph Kemetmüller

Hackers took 300 GB from the AfD's provider in two visits

Sat, 31 Oct 2026 00:44:52 +0100

Lilith Wittmann reconstructs (in German) how about 300 GB left Alternita, the party-owned provider that runs more than 300 AfD domains. According to the hackers and the provider’s circle, the way in was a poorly protected WordPress at wahlkampf.afd.de, where they installed a plugin (WP-Console) for a shell; they reset officials’ mailbox passwords and pulled mail out via one-click hosters and IMAP batch requests. The intrusion was noticed on 9 September after about 180 GB, but by the hackers’ account the code they left behind was not, and they came back on 14 September for another 120 GB. The AfD’s own statement dates the attack to late September and blames the scandals on a crude AI keyword search. The dump includes member-database extracts and register-office data on first-time voters in Mecklenburg-Vorpommern, which registry offices had emailed unencrypted, and the party’s claim that it informed the data-protection authority immediately sits awkwardly with the Berlin authority logging the report at 18:59, two hours after the 16:51 press release.

CVE-2026-109618 - PHP RCE CVEs leaked before the patch was out

Thu, 29 Oct 2026 18:00:00 +0100

On 20 October Kevin Beaumont noticed two PHP CVE IDs circulating before any patch existed, and by that evening Will Dormann had spotted a Calif video of a proof of concept called php2shell working against WordPress. The PHP Foundation’s account fills in the rest: no technical details leaked, just a wrong release time and a wrong CVSS of 10.0 (it is 9.2), but the early pre-announcement led Calif to publish that video by mistake, Chainguard shipped patched images more than six hours before the embargo lifted, and the release was pulled forward a day to 21 October. The advisory describes two unauthenticated RCEs: hitting memory_limit at the wrong moment leaves half-initialised request data that cleanup treats as valid (CVE-2026-109618), and a fatal error can leave global state pointing into a previous request’s freed memory (CVE-2026-109619), with the first triggerable on Apache with mod_php before any application code runs. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; the stopgaps Dormann passed on (memory_limit=-1, session.upload_progress.enabled=0, a small post_max_size) each close only specific paths. The Foundation is also unusually frank that the OOM problem was first spotted in 2024 and the fix stalled for months, “a structural failure”, until Calif and OpenAI reported the same root cause on 11 August. Meanwhile a pre-patch “weaponized” write-up has since demoted its own bug to a non-RCE CVSS 5.3, proving that leaked CVE numbers attract confident guesses long before they attract facts.

Since the release, Arctic Wolf lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected too, and saw wide scanning but only a few attempts to fetch second-stage payloads from a host serving the Mirai-derived Potassium botnet. The Delft Threat Intelligence Lab’s live tracker counted 66,494 requests from 645 IPs by 27 October, 47,900 of them probes only. A Show HN challenge put a bitcoin key worth about $502 on a server running pre-patch PHP 8.4.26, and KillaBoi got it out on 25 October. The released PoC lands about seven runs in ten in a lab; the stored key did not derive the prize address, and the operator paid out anyway. Dream Group says a custom PHP2Shell build, chained with the Fragnesia kernel privilege escalation (CVE-2026-46300), rooted 24 Palo Alto Networks PAN-OS firewalls with internet-facing management interfaces in the US, Japan, Taiwan and South Korea, plus the internal firewall management server of a US government-affiliated organisation, from which the attacker went after its Active Directory. Per Dream, Unit 42 has verified the tooling and tracks the activity as CL-UNK-1280, a Chinese-speaking actor in UTC+8, while Dream’s own “AI-assisted” label rests on Claude Code and a DeepSeek and Kimi driven offensive platform (aiscan) found on the attacker’s infrastructure, plus the scripts’ commenting style.

Update 2026-10-30: A week on, Hunt.io’s look at the tooling finds php2shell mostly crashing on the open web, with PAN-OS as the exception.

CVE-2026-110264 - Unauthenticated GitLab RCE via a crafted .org file

Thu, 22 Oct 2026 21:30:00 +0200

GitLab’s October 21 patch release fixes CVE-2026-110264: rendering a crafted .org file lets an unauthenticated attacker run code on the server, CVSS 10.0. Ikesan’s analysis traces it to Onigmo, Ruby’s regex engine. The #+TODO: keywords of an Org mode file go unescaped into Regexp.new, and an integer overflow while compiling that pattern ends with commands running as the git user. Every self-managed CE/EE release since 7.0 is affected; GitLab.com and Dedicated are already patched.

The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. 18.10 and older get no fix, so those instances have to follow the upgrade path to 18.11.13 or later. If you just installed the October 12 releases (19.4.2, 19.3.5, 19.2.8), congratulations, you get to do it again. The bug is the third GitLab regex find from joaxcar via HackerOne, and GCVE already links a proof-of-concept repository, so this one shouldn’t wait for the next maintenance window.

Offensive Security Web Expert

Tue, 14 Jul 2020 15:55:18 +0200

Note: OSWE is one of three certifications required for OSCE3 (along with OSED and OSEP), which replaced the original OSCE in 2020.

I passed the Offensive Security Web Expert exam in July 2020. Now, I would like to share my thoughts.

SANS Holiday Hack Challenge 2017 Solution

Mon, 01 Jan 2018 01:23:27 +0000

Letters to Santa app contains a reference to a development system in a HTML comment section.

<!-- Development version -->
<a href="http://dev.northpolechristmastown.com" style="display: none;">Access Development Version</a>

The development interface is based on Apache struts. The utilized version is vulnerable to CVE 2017-9805. A respective script can be found on github.

The 2015 SANS Holiday Hack Challenge - Solution

Tue, 05 Jan 2016 01:23:27 +0000

Which commands are sent across the Gnome’s command-and-control channel?
EXEC:iwconfig in packet 363
EXEC:cat /tmp/iwlistscan.txt in packet 573
What image appears in the photo the Gnome sent across the channel from the Dosis home?

A tidy children’s room is depicted in the photo. The photo includes something like legs that are probably attached to the camera. At the bottom is a label with “GnomeNet-NorthAmerica”.

What operating system and CPU type are used in the Gnome? What type of web framework is the Gnome web interface built in?
OpenWRT (r47650) on ARM
NodeJS with Mongodb
What kind of a database engine is used to support the Gnome web interface? What is the plaintext password stored in the Gnome database?
MongoDB
The following credentials are stored in the firmware image
admin : SittingOnAShelf
user : user
What are the IP addresses of the five SuperGnomes scattered around the world, as verified by Tom Hessman in the Dosis neighborhood?
SG-01 52.2.229.189 (United States, Ashburn)
SG-02 52.34.3.80 (United States, Boardman)
SG-03 52.64.191.71 (Australia, Sydney)
SG-04 52.192.152.132 (Japan, Tokyo)
SG-05 54.233.105.81 (Brazil)
Where is each SuperGnome located geographically?
Describe the vulnerabilities you discovered in the Gnome firmware.
Storage of clear text passwords in the MongoDB database.
Local file inclusion via directory traversal in routes/index.js:195

The code checks whether the requested file path contains a “.png”.
The file upload can be utilized to create a temporary folder with a suitable name.

Possible NoSQL injection for the login post in routes/index.js:109.

Might not possible as “extended = false” for the firmware as described in bodyParser is deprecated express 4

Possible server side javascript injection for file upload in routes/index.js:166

The user provided parameter: posproc is utilized in an unsanatized eval()

Stack based buffer overflow in sgnet_readn that is utilized in sgstatd.c:147:

The stack canary is static and can easily be repaired.
The stack canary includes a JMP ESP as a partial command. This assembly instruction is crucial for exploitation.

Describe the technique you used to gain access to each SuperGnome’s gnome.conf file.
SG-01: Administrative credentials from the firmware image provided full access.
SG-02: A path traversal vulnerability allowed to download arbitrary files in the context of a standard user.
SG-03: A NoSQL injection in the login form was exploited in order to login as admin user.
SG-04: The system was compromised via server side javascript injection in NodeJS.
SG-05: Weaponize remote exploit for sgstadt (4242/tcp) in order to a reverse shell.

The packet capture includes mostly traffic on port 53/udp. A client system at 52.2.229.189 is querying the dns server at 10.42.0.18 for a TXT record. In packet 363 the server responds with a base64 encoded string EXEC:iwconfig. Subsequently, the client starts sending TXT responses with base64 encoded data to the server. The response starts with a start marker EXEC:START_STATE. The end of the exec output is marked by an encoded EXEC:STOP. In packet 573 another command is scheduled by the server: EXEC:cat /tmp/iwlistscan.txt. Finally, in packet 875 the server requests a file with FILE:/root/Pictures/snapshot_CURRENT.jpg.