Hey, I'm Wojtek

Welcome to my security blog where I document my current work and achievements. My main areas of interests are reverse engineering and application security. Here you'll find some of my work.

Read My Articles About Me GitHub

Featured Articlepwn

SMØLLM - Hack.lu 2025

Root-cause analysis and exploitation of a format string vulnerability in a C binary (Hack.lu CTF 2025), chained with a stack-based buffer overflow to defeat canary and ASLR/PIE and reach arbitrary code execution via ROP.

Wojtek

Oct 24, 2025

Read Article

Recent Writing

Latest Publications

View All Articles (5)

miscOct 22, 2025

KONTINUERLIG: From Heredoc Injection to Secret Extraction via GitHub Actions - Hack.lu 2025

Root-cause analysis and exploitation of a GitHub Actions CI/CD pipeline (Hack.lu CTF 2025). A pull_request_target misconfiguration is leveraged through heredoc injection into GITHUB_ENV, LD_PRELOAD hijacking, and Python module shadowing to cross a privilege boundary. From there, symlink-based Docker build-context manipulation and Problem Matcher abuse chain together to bypass secret redaction and exfiltrate a repository secret.

#hack.lu #Github Actions

Wojtek

Read

webAug 25, 2025

When Vue Forgets to Escape: From a Missing v-pre to Superadmin Takeover (Part II) - CVE-2025-64112

Part II of the CVE-2025-64112 writeup: weaponizing a stored XSS in the Statamic control panel into full Superadmin takeover. Admin-editable fields are rendered by Vue without v-pre or output encoding, so a {{constructor.constructor(...)}} payload executes JavaScript in a Superadmin's session. Two proof-of-concept chains are shown — a silent password change on versions ≤5.21.0, and an email swap on 5.22.0 (after password changes were hardened) to hijack the account via password reset.

#cve #research

Wojtek

Read

webJul 15, 2025

When Vue Forgets to Escape: Multiple Stored XSS Vectors Caused by Missing v-pre directive

Part I of the CVE-2025-64112 research: multiple stored XSS vectors in the Statamic control panel, rooted in Vue rendering admin-editable fields without the v-pre directive. Because Vue compiles mustache {{ }} expressions client-side, unescaped stored input is treated as executable template code — a {{this.constructor.constructor('alert(document.cookie)')()}} payload runs in an admin's browser. Six control-panel sections (collections, navigation, taxonomies, asset containers, globals, forms) were affected on versions ≤4.42.0. Part II chains this into full Superadmin takeover.

#cve #research

Wojtek

Read

htbNov 7, 2020

Dyplesher Hack The Box

Writeup

#amqp #gogs

Wojtek

Read

Browse by Topic

Popular Tags

#TAGS

TOTAL TOPICS: 23Digital Garden