02 / ARCHIVE
Browse every note, from the newest experiments back to the earliest research.
No matching articles found.
Replacing an LLM with a 307M encoder for tagging personal data in API traffic, at 0.93 macro-AP. Covers data splits, sliding windows, DAPT, long context vs. windows, a GPU memory fix, and the label-suppression problem I only found right before release.
A retrospective on the development of Zbot, an LLM-driven web vulnerability scanner, covering its architectural evolution, sub-agent design, tooling decisions, benchmark results, lessons learned, and unresolved challenges.
This article describes integrating SQLMap into an MCP-based AI workflow to validate SQL injection vulnerabilities efficiently, preserve complete authenticated HTTP requests, and handle long-running scans asynchronously.
What is LOSS? LOSS is a differentiable mathematical function that quantifies the error between a model’s predictions and the ground truth. A larger value indicates a larger error. Note that loss is not necessarily related to the actual effectiveness of model fine-tuning; it is only used to observe whether the fine-tuning process is proceeding normally. During fine-tuning, it serves as the optimization objective, guides parameter updates, evaluates training performance, and helps determine when to stop training.
An overview of the key hyperparameters for model fine-tuning, including learning rate, epochs, batch size, LoRA rank, and validation set size, with recommended values and practical considerations.
Set up a Python environment, develop and test an MCP service locally, and build and publish the package to PyPI.
An introduction to SecGPT-Distill, an experimental open-source model that uses fine-tuning and knowledge distillation to overcome existing models’ restrictions when handling security-related questions.
Fine-tuning and RAG can often achieve similar results, so the right choice depends on practical requirements such as data freshness, latency, explainability, general-purpose capabilities, and cost.
This is an important question because modern large language models are already highly capable and may not require fine-tuning; goals can often be achieved through RAG or prompt engineering, depending on the scenario.
This article explains why human preference alignment was omitted when training a small security-focused model and compares traditional RLHF with DPO in terms of workflow, complexity, data requirements, resource demands, and performance.
Training a small model from scratch: an introduction to LoRA fine-tuning, its mathematical principles, advantages, implementation frameworks, and medical fine-tuning results.
Training a small model from scratch: an introduction to supervised fine-tuning (SFT), dataset preparation, training, and preliminary test results.
Training a small model from scratch is an important part of my study of large language models (LLMs). By reproducing a small-scale model with a minimal implementation, I can gain an in-depth understanding of the basic training process while systematically learning its core principles and actual operating mechanisms.
This article reviews affordable open-source alternatives to ChatGPT, including ChatGLM, LLaMA, Alpaca, Vicuna, and their Chinese variants, and discusses common model fine-tuning approaches and challenges.
This article explains how to use llama.cpp to quantize and deploy the LLaMA model locally for CPU inference, including running it on a Mac with an M1 Pro chip.
This vulnerability surfaced a few months ago. Since no one had analyzed it, I investigated it and wrote an article about NoSQL injection. While recovering at home recently, I finished this half-written analysis and decided to publish it.
0x00 Prerequisites: I have recently been testing issues related to my company’s OAuth authentication and needed to familiarize myself with it again, so I decided to write about it. 0x01 OAuth 2.0 Concepts: OAuth is an open web standard for authorization and is currently the most common and widely used authorization protocol. Where is OAuth 2.0 used? It is actually very common…
A recently disclosed ImageMagick vulnerability can lead to arbitrary file reads and has a broad impact. This article reproduces and examines the vulnerability.
This article explains Cross-Site WebSocket Hijacking (CSWSH), its characteristics, and how the vulnerability can be reproduced and analyzed in an online lab.
0x00 Scanning Linux with D-Shield via a Mounted Drive This method solves the problem of being unable to use D-Shield to detect and remove webshells on Linux. Mount the Linux file system on Windows over SSH, and then scan it. 0x01 Environment Setup Install D-Shield D-Shield is commonly used during incident response to scan for Webshells. D-Shield download address: D-Shield Firewall \(d99ne…
The article has been encrypted. Finally, I’d like to share a quote that resonated deeply with me this year:
Notes on configuring a MacBook Pro with an M1 Pro chip running macOS Ventura 13.1, including Homebrew, Command Line Tools, Oh My Zsh, plugins, themes, and the Java environment.
Recently, I have mainly been looking into the YApi injection vulnerability, which is also a MongoDB injection vulnerability. NoSQL injection is becoming increasingly common as many distributed and newer systems make extensive use of NoSQL databases, and it differs slightly from traditional relational database injection. A practice lab will be uploaded to GitHub later.
A concise record of the most important concepts and practices from recent research into SDLC security.
Other vulnerabilities encountered during Go code auditing, including file operations, path traversal, redirects, and CORS, demonstrated through a Go web vulnerability lab built on go-gin-example.
A Go-based web vulnerability lab for reinforcing knowledge through hands-on practice, covering vulnerability code analysis and remediation for SQL injection, command execution, and SSRF in the Gin framework.
This article explains Java class loading fundamentals, custom ClassLoader implementations, BCEL-based class loading, Fastjson applications, URLClassLoader usage, and related security research scenarios.
An introduction to basic QL syntax, including query structure, predicates, sources and sinks, data flow, sanitizers, additional taint steps, batch scanning commands, and method queries.
VMware released a security advisory on March 31 addressing a remote code execution vulnerability in Spring Framework (CVE-2022-22965), which can allow an unauthenticated attacker to write malicious files and execute arbitrary code on a target system running JDK 9 or later.
After discovering that Gitee had restricted external links and the blog’s images could no longer load, the image repository was cloned, uploaded to Qiniu Cloud, and the Markdown image URLs were replaced.
An introduction to manually setting up and using CodeQL, a popular code analysis technology reportedly used to discover vulnerabilities in Log4j and Spring Cloud Gateway.
Explains the difference between MyBatis parameter syntaxes, the limitations of prepared statements when handling variable table names and ORDER BY clauses, and the underlying mechanism by which precompilation prevents SQL injection.
DirtyPipe \(CVE-2022-0847\) is a vulnerability in the Linux kernel since version 5.8 that allows data in arbitrary read-only files to be overwritten. Exploitation requires kernel version 5.8 or later.
Spring Cloud Gateway is an API gateway built on Spring Framework and Spring Boot that provides simple, effective, and unified API routing management for microservice architectures; Huawei Cloud advises users to promptly perform self-checks and apply security hardening.
This article explains how WAFs use JA3 and JA3S to identify TLS fingerprints and explores two ways to modify Python Requests behavior to avoid being blocked.
A DingTalk RCE vulnerability affecting version 6.3.5, including the trigger method, successful reproduction, a POC reference, and remediation by upgrading to version 6.3.25.
Spring Boot Actuator unauthorized access vulnerabilities are still encountered during routine testing and can lead to RCE under certain conditions, making them worth investigating; this article reproduces a series of these vulnerabilities, primarily with reference to LandGrey/SpringBootVulExploit.
An overview of an unauthorized access vulnerability in SonarQube that may expose sensitive configuration information and source code repository credentials through an API endpoint lacking access controls.
Polkit’s pkexec contains a privilege escalation vulnerability that allows a local attacker to manipulate environment variables and execute arbitrary code as root on affected Linux systems.
0x00 Phishing in Red Team/Blue Team Exercises: As traditional web-layer N-day exploitation has become more difficult in large-scale attack-and-defense exercises, more offensive teams have begun incorporating phishing operations. This article introduces conventional email phishing, with effective methods such as IM to be covered later.
When pushing a Docker image I created to Docker Hub, I encountered the “denied: requested access to the resource is denied” error. The cause was that when tagging the image during the build process, the tag needed to begin with my Docker Hub username.
Apache ShenYu Admin contains an authentication bypass vulnerability (CVE-2021-37580) with a CVSS score of 9.8. Incorrect use of JWT in ShenyuAdminBootstrap allows attackers to bypass authentication and directly access the system administration backend.
Apache Druid’s HTTP InputSource allows authenticated users to read files from other sources, including the local file system, with the privileges of the Druid server process, potentially bypassing application-level restrictions.
A walkthrough of reproducing and exploiting a JumpServer remote command execution (RCE) vulnerability, including its underlying mechanism, affected versions, environment setup, exploitation, and post-exploitation.
GitLab versions after 11.9 use the ExifTool image-processing utility, which is affected by CVE-2021-22204. An attacker can exploit an unauthenticated upload endpoint to submit a maliciously crafted image and achieve remote code execution.
In routine penetration testing exercises, proxies are indispensable. Common choices include Cobalt Strike’s built-in SOCKS4 proxy and the SOCKS5 protocol used by proxy tools. Traffic detection evasion must also be considered, making it necessary to examine the underlying protocol in detail and analyze and modify traffic characteristics.
Learn how Go uses structs and bound methods to implement classes, along with capitalization-based visibility, inheritance, interfaces, and type assertions.
0x00 Prerequisites — An old technique revisited: after obtaining root access to a target Linux host through RCE, privilege escalation, or similar means, public-key authentication can be used for a direct connection when no password is available, the hash cannot be cracked, and the host cannot access the internet.
A shadow user backdoor enables direct desktop access by cloning an account through the Windows registry while hiding the user from standard account listings and the login screen.
0x00 Background — Intended primarily for developers who want to learn Golang quickly and at low cost, focusing on the syntax, usage, and concepts that distinguish it from other languages. Familiarity with a backend language is recommended, as programming concepts are transferable; experienced developers can quickly get started by learning Go’s unique features. Each topic below is explained through comments alongside code examples.
Environment setup, exploitation requirements, and a CTF example demonstrating how PHP session upload progress can be combined with file inclusion to upload a webshell.
This article explains how to install ADB, Python 3, Frida Tools, and Frida Server, then use Python and JavaScript scripts to hook an Android application and bypass a basic root-detection check.
A guide to unpacking, decompiling, and debugging WeChat Mini Program front-end packages using Node.js, wxappUnpacker, WeChat Developer Tools, an Android 6 MuMu emulator, and MT Manager.
Use iftop to monitor network traffic and the total transmission rate, including installation on macOS, basic usage, configuration options, and shell scripts.
Switch Homebrew repositories, package repositories, and Bottles repositories to Chinese mirrors on macOS.
0x00 Arsenal is a front-end/back-end separated red team arsenal platform that includes commonly used red team capabilities and integrates other useful tools. It is still under development and is not yet fully open source due to numerous bugs and subpar code quality. The back end uses Django and Django REST Framework, while the front end uses Vue and Element UI.
An introduction to using Celery as a distributed asynchronous task queue in Django, including brokers, result backends, task registration, invocation, and command-line startup.
Notes on quickly setting up an Oracle database with Docker and importing a DMP database backup file for code auditing.
0x01 CVE-2021-3156: A heap-based buffer overflow was discovered in the way sudo parses command-line arguments. Any local user—including regular and system users, sudoers, and non-sudoers—can exploit it without authentication or knowing the user’s password. Successful exploitation can grant root privileges. 0x02 Affected versions…
0x00 Introduction: OA A8 is a popular collaborative management application widely used by medium-sized and large enterprises and organizations. Because certain endpoints in older versions can be accessed without authorization and some functions have insufficient filtering, attackers can craft malicious requests to bypass authentication and upload malicious script files without logging in, thereby taking control of the server. 0x01 Affected Versions: OA V8.0, OA V7.1…
0x01 Vulnerability Overview: Apache Flink is an open-source stream-processing framework with powerful stream and batch processing capabilities. CVE-2020-17518 is an arbitrary file write vulnerability affecting Apache Flink.
Apache Flink is an open-source stream-processing framework with powerful stream and batch processing capabilities. CVE-2020-17519 allows attackers to read arbitrary files from the JobManager’s local file system through its REST API.
An exploration of common PHP webshell detection-evasion techniques, including string transformations, function and class features, arrays, variable variables, special-character obfuscation, and letterless payloads.
WordPress xmlrpc.php contains an SSRF vulnerability that allows server-side request forgery and remote port scanning through Pingback, affecting WordPress versions earlier than 3.5.1.
On October 29, 2020, 360CERT detected a critical WebLogic Console HTTP protocol code execution vulnerability, tracked as CVE-2020-14882 and CVE-2020-14883, with a CVSS score of 9.8. A remote attacker can craft a special HTTP request to take control of WebLogic and execute arbitrary code without authentication.
A detailed, beginner-friendly guide to using domain fronting, a CDN, and certificates to route Cobalt Strike traffic through CDN nodes to a C2 server.
An introductory lesson on auditing PHP code for variable-overwrite vulnerabilities, covering common functions and techniques as well as practical examples.
This article analyzes the cause and code flow of the Apache Shiro 550 RememberMe deserialization vulnerability, explains its encryption and decryption processes, and demonstrates how to develop a proof of concept.
This article explains the principles behind the CommonsCollections1 Java deserialization RCE chain, its core classes, chain construction, trigger mechanism, and final proof of concept.
A self-study article on Java code auditing that introduces Java deserialization, compares it with PHP deserialization, explains ysoserial and the URLDNS chain, and documents the author’s debugging and analysis process.
A self-study note on Java code auditing that introduces XXE vulnerabilities, relevant XML and entity concepts, auditing functions, vulnerable code examples, exploitation methods, and remediation.
A self-study article on Java code auditing that examines file path traversal, insecure file uploads, arbitrary file reading, and directory traversal, along with relevant audit functions and remediation approaches.
0x01 Vulnerability Overview: SCP (secure copy) is a Linux command that securely copies files and directories between Linux systems over SSH. OpenSSH versions earlier than 8.3p1 contain a command injection vulnerability in the SCP command. When a file is copied to a remote server, its path is appended to the local scp command, potentially triggering command injection.
This article documents a self-directed approach to learning Java code auditing, beginning with building a Java GUI-based web crawler and progressing to an examination of SSRF vulnerabilities, exploitation scenarios, limitations, and remediation.
0x00 Introduction: This article records and shares the author’s approach to self-studying Java code auditing, making it easier to summarize and reflect on the learning process in the future. If the author ultimately gains meaningful knowledge, the ideas will be reorganized to provide other self-learners with a useful path forward, leading to this series on self-studying Java code auditing. The article begins with P Niu’s discussion of Java security.
This article documents a self-directed approach to learning Java code auditing, focusing on SQL injection principles, vulnerable SQL construction, incorrect use of prepared statements in MyBatis and Hibernate, remediation methods, and practical auditing techniques.
This article documents the principles and implementation of buffer overflows, then explores low-level shellcode development using a vulnerable C program.
0x01 Vulnerability Introduction: Fastjson is an open-source JSON parser developed by Alibaba. Its excellent performance has led to widespread use in Java projects from major vendors. Fastjson introduced a deserialization whitelist after version 1.2.24, but in versions earlier than 1.2.48, attackers can bypass whitelist checks using specially crafted JSON strings and successfully execute arbitrary commands. 0x02 Affected Versions…
This older walkthrough explores the new features of CS4 through a relatively simple but complete internal-network penetration-testing workflow using Vulnstack ATT&CK Lab 5 from Red Sun Security.
Definitions of number systems: binary consists of 0 and 1; octal consists of 0 through 7; decimal consists of 0 through 9; and hexadecimal consists of 0 through 9 and A through F. Units of measurement: 1 by…
A quick reference for gathering information from a Linux host on an internal network, covering system type, network details, sensitive files, kernel versions, users, processes, network interfaces, services, configurations, logs, command history, software, locally stored SSH keys, Linux backdoor generation, Metasploit configuration, exploit listeners, and scanning.
0x00 Background: After being asked about a PHP pseudo-protocol, I realized that my understanding was still too shallow, so I decided to study and summarize PHP stream wrappers and their use with file inclusion vulnerabilities.
Reproduction of the Microsoft SMBv3 Client/Server remote code execution vulnerability CVE-2020-0796, including affected Windows versions, environment requirements, common pitfalls, and the process of obtaining a shell without triggering a blue screen.
Apache Shiro RememberMe deserialization (Shiro550) affects applications when the RememberMe AES key is compromised, while Shiro-721 exploits a padding oracle vulnerability affecting specific Shiro versions.
An introduction to SPNs, methods for discovering SPN services within a domain, the principles and execution of Kerberoasting attacks, offline service-ticket cracking, and defensive measures.
Explains the principles, usage, prerequisites, WebShell implementation, Cobalt Strike integration, and advantages of Juicy Potato privilege escalation.
An overview of the history and evolution of Potato privilege-escalation techniques, from Hot Potato and Rotten Potato to JuicyPotato, PrintSpoofer, RoguePotato, and SweetPotato.
I encountered a Docker environment that I needed to bring back for local debugging, so this article records the general process: locate the running container, package it as an image, copy it locally, and import the image.
An overview of the NTLM authentication process and the principles behind Pass the Hash (PTH), covering local and network authentication, LM and NTLM hashes, NTLMv2, and patch bypasses.
This article explains the Kerberos domain authentication process, including how TGTs, session keys, and server tickets are generated and used, as well as the principles and forgery of Silver Tickets and Golden Tickets.
After reading a write-up for the Wangding Cup AreUSerialz deserialization challenge, I learned some new details about PHP deserialization, including bypassing the ASCII validation function, weak type comparison, and representing protected properties with hexadecimal strings.
An overview of outbound protocol identification, network-, transport-, and application-layer tunneling, port forwarding, SSH forwarding, DNS tunneling, and SOCKS proxy tools.
An overview of commonly used search engine syntax for information gathering during penetration testing, including examples for locating admin panels, educational targets, database errors, physical paths, database versions, and server probe files.
A collection of one-liners for downloading payloads using JavaScript and cscript on Windows, fileless remote execution with PowerShell, and download-and-execute operations using curl and wget.
A guide to identifying Safedog WAF keyword filters, using MySQL syntax to bypass them, and writing and testing sqlmap tamper scripts.
The assessment consisted of objective questions and hands-on tasks covering source code analysis, PHP weak typing bypasses, webshell detection and decoding, IP spoofing, Struts2 exploitation, PostgreSQL, SQL injection, and Wireshark packet analysis.
Analysis of an unauthenticated remote code execution vulnerability in Tongda OA that can be exploited through log file inclusion or by bypassing authentication to upload a file and then include it.
An introduction to SSRF principles, vulnerability impact, testing methods, bypass techniques, PHP code auditing, and using a WebLogic SSRF vulnerability to attack Redis and obtain a reverse shell.
RCE approach: unauthenticated JPG file upload, followed by PHP code inclusion to achieve RCE; theoretically affects all versions, although the 2015 edition appears to lack file inclusion functionality.
An introduction to generating a basic Cobalt Strike payload, compromising a Windows 7 PC, and using Beacon, including its communication modes, types, commands, and sleep interval.
Internal network security learning from beginner to prison: collecting basic information about workgroups and domains, checking the local host, enabling remote connection services, gathering domain information, identifying domain controllers, and detecting live hosts and open ports.
Python can use the prettytable module to display content in polished tables, and progressbar can add a progress bar for an iterator or list.
An overview of XXE vulnerabilities, XML and DTD fundamentals, exploitation principles, common payloads, testing, and defenses.
Notes on the fundamentals of Cobalt Strike \(CS\), including its architecture, core terminology, setup process, and basic usage.
Article contents: intranet penetration testing fundamentals, basic terminology, workgroups, domains, Active Directory (AD), domain controllers (DCs), DNS servers, security zone segmentation, DMZs, computers in a domain, and permission classifications within a domain.
An introduction to installing Docker on macOS, logging in, verifying the environment, optionally installing Kitematic, and configuring registry mirrors to accelerate image pulls.
On January 10, 2020, the ThinkPHP team released a patch for an arbitrary file operation vulnerability caused by an insecure SessionId, which affects ThinkPHP 6.0.0–6.0.1 and may allow arbitrary file creation, deletion, and, under certain conditions, gaining a shell when sessions are enabled.
Django database operations in settings.py, including creating data, data types, the three steps required to create a database, and synchronizing model changes to the database.
Create a project and add an app module. For example, if your project has a login feature, you can name the module login. Generate and configure the app using commands, start the service, configure routes in urls.py, use static files, and add the required settings at the bottom of the root settings.py file…
A quick reference to Python regular expressions, covering match counts, common syntax, pattern objects, searching, matching, splitting, finding, replacing, anchors, and use in web crawlers.
Use Python’s built-in and third-party libraries to run scheduled tasks, pass arguments, and execute tasks concurrently with threading.
A walkthrough of creating a fake Flash download site, bundling a payload with the Flash installer, hosting it on a server, and using XSS to lure users to it.
Installing the IPRotate Burp Extension: configure Jython in Burp Suite, install the boto3 module for Python, and import the Python file.
Download the Jython Standalone package, then configure its JAR file and Python module path in Burp Suite.
An analysis of PHP serialization, deserialization object injection, magic methods, CVE-2016-7124, and the construction and exploitation of POP chains.
An overview of the k-nearest neighbors (kNN) algorithm, which classifies a sample according to the categories of its nearest neighbors in the feature space.
Concept of a process: First, a process is an entity. Each process has its own address space, generally including a text region, data region, and stack region. The text region stores the code executed by the processor; the data region stores variables and dynamically allocated memory used during process execution; the stack region stores instructions and local variables for active procedure calls...
The project requires testing a mini program, but no packets can be captured despite trying multiple methods. This article explains the certificate trust behavior of different Android and WeChat versions and presents an emulator-based solution.
Runtime environment: PhpStorm 2019.3 (Chinese-localized), PHP 7.0.12 NTS, and php_xdebug 2.6.0beta1 for PHP 7.0 VC14 NTS; the PHP and Xdebug versions must match.
Common reasons XDebug fails to work in phpStudy include incorrect paths, incompatible extension versions, and incomplete configuration, followed by the correct process for enabling it.
An in-depth analysis of ThinkPHP deserialization covering environment setup, prerequisite concepts, the vulnerability entry point, RCE execution flow, and the final proof of concept.
This vulnerability exists in the BeanShell component of the e-cology OA system. Because the component permits unauthorized access, attackers can use it to execute arbitrary Java code and system commands. Affected versions include, but are not limited to, 7.0, 8.0, and 8.1.
Environment setup, vulnerability principles, affected versions, and the exploitation process for CVE-2019-14234, a Django JSONField SQL injection vulnerability.
Unlike traditional macro-enabled documents, this technique uses a seemingly harmless .docx file to load a malicious remote template and execute its macros, making the attachment less likely to be blocked by extension-based filtering or static detection.
A tutorial covering how to download, install, configure, and use ZGrab on Linux, including scanning IP addresses and retrieving web page source code.
When running “make” during installation on Linux, the build fails because the golang.org/x/crypto/curve25519 package cannot be found; the package must be downloaded manually from GitHub.
This article covers the environment, underlying mechanism, affected versions, backdoor detection, and exploitation of the PHPStudy backdoor.
【Research】WebLogic vulnerability series covering weak passwords, credential decryption, arbitrary file read exploitation, and webshell deployment.
A reproduction and analysis of the Shellshock vulnerability (CVE-2014-6271), covering the environment, underlying cause, affected versions, and exploitation process.
A mind map summarizing arbitrary password reset vulnerabilities.
【Research】An overview of the environment, underlying principles, affected versions, and exploitation process for the Heartbleed vulnerability.
Mind Map — New Changes — On Common PHP Vulnerabilities, by ′ Rain, January 14, 2015 at 10:08
[Research] WebLogic vulnerability series: the 'wls-wsat' XMLDecoder deserialization vulnerability (CVE-2017-10271), covering the environment, underlying mechanism, affected versions, and exploitation process.
An analysis and reproduction of a WebLogic SSRF vulnerability that can send arbitrary HTTP requests, probe internal network services, and potentially target vulnerable components such as Redis and FastCGI.
Discuz ML v3.x front-end getshell technique, covering the vulnerability description, underlying cause, affected versions, exploitation process, and getshell POC; not for illegal use.
A real-world reproduction of a 0-day remote command execution vulnerability in Seeyon OA A8, including affected versions, reproduction steps, remediation references, and a POC provided solely for research and learning.
Introduces the environment, underlying principle, affected versions, exploitation process, POC, and POC considerations for the Struts2 S2-016 vulnerability.
【Research】A reproduction and analysis of the Struts2 S2-008 vulnerability, covering environment setup, underlying principles, affected versions, the exploitation process, and working POCs that return command output.
A study of the Struts2 S2-005 vulnerability, including environment setup, underlying principles, affected versions, exploitation process, and a working proof of concept.
This article describes the S2-001 vulnerability environment, underlying OGNL expression parsing flaw, affected Struts versions, exploitation process, and PoC.
This article describes a Coremail 0-day vulnerability that exposes sensitive server configuration files and provides a proof of concept, affected version information, and a batch detection script.
A tutorial on using the popular Android decompilation toolkit consisting of apktool, dex2jar, and JD-GUI. The tools have been packaged and configured together so they can be used directly, avoiding the trouble of collecting them separately. Download address: …
Since the previous installation tutorial on 52 was deleted, I recorded the process again for future use in my own Ubuntu 2019 and Xshell environment.
After trying EternalBlue, I saw someone using a Trojan, so I am adding the remaining steps. The environment is the same as in the previous article.
A test of the MS17-010 EternalBlue vulnerability using MSF against an unpatched Windows 7 host with port 445 open, covering information gathering, vulnerability scanning, and exploitation.
Ubuntu — But… at the very first step, sudo apt-get autoremove open-vm-tools told me that open-vm-tools wasn’t installed, so… I just installed open-vm-tools directly… sudo apt-get install open-vm-tools-desktop — …
This article documents a uWSGI installation failure on CentOS 7 and explains how to resolve it by using Python 3 or installing the required compilation tools and Python development dependencies.