Flomb's Avatar

Flomb

@fl0mb.bsky.social

blog.flomb.net

68 Followers  |  898 Following  |  1 Posts  |  Joined: 02.12.2024  |  1.6588

Latest posts by fl0mb.bsky.social on Bluesky

Preview
OBS WebSocket to RCE | Jorian Woltjer Disabling password authentication of your OBS WebSocket server can have devastating consequences. We'll attack from the browser to construct an RCE payload on Windows formed from the pixels of an imag...

Just pushed a new frontend for my site, and a new post!
This one's about an tricky file write vulnerability on Windows in OBS. By crafting an image with very specific pixels, we can plant a backdoor on your PC all from an attacker's site by misconfiguring:
jorianwoltjer.com/blog/p/resea...

05.06.2025 18:48 β€” πŸ‘ 5    πŸ” 2    πŸ’¬ 1    πŸ“Œ 0
MrBruh's Epic Blog One-Click RCE in ASUS’s Preinstalled Driver Software Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard fo...

One-Click RCE in ASUS’s Preinstalled Driver Software
mrbruh.com/asusdriverhub/

11.05.2025 05:07 β€” πŸ‘ 6    πŸ” 5    πŸ’¬ 0    πŸ“Œ 1
CODE WHITE | Analyzing the Attack Surface of Ivanti's DSM Ivanti's Desktop & Server Management (DSM) product is an old acquaintance that we have encountered in numerous red team and internal assessments. The main purpose of the product is the centralized dis...

Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-...

13.05.2025 06:45 β€” πŸ‘ 9    πŸ” 9    πŸ’¬ 0    πŸ“Œ 1
GFI MailEssentials - Yet Another .NET Target What is this product GFI MailEssentials all about? We’re living the future, right? So let’s ask the GFI AI.

My blog post on some vulns in GFI MailEssentials

frycos.github.io/vulns4free/2...

28.04.2025 17:34 β€” πŸ‘ 7    πŸ” 7    πŸ’¬ 0    πŸ“Œ 0
Exploiting IngressNightmare: A Deep Dive Wiz recently discovered an unauthenticated remote code execution (RCE) vulnerability in the Ingress NGINX admission controller. I found the exploit chain particularly intriguing and decided to recreat...

blog.flomb.net/posts/ingres...

31.03.2025 14:28 β€” πŸ‘ 5    πŸ” 3    πŸ’¬ 0    πŸ“Œ 0
Walkthrough 2023

Ever wondered how Kurts Maultaschenfabrikle got hacked in 2023? The full story, all technical details, out now ;-) apply-if-you-can.com/walkthrough/...

21.02.2025 10:31 β€” πŸ‘ 7    πŸ” 10    πŸ’¬ 0    πŸ“Œ 0

@fl0mb is following 20 prominent accounts