https://blog.wojtek.sh/en-us© 2026 Wojtek Chwala 'w0j73k'https://blog.wojtek.sh/blog/hacklu-smollm/https://blog.wojtek.sh/blog/hacklu-smollm/Root-cause analysis and exploitation of a format string vulnerability in a C binary (Hack.lu CTF 2025), chained with a stack-based buffer overflow to defeat canary and ASLR/PIE and reach arbitrary code execution via ROP.Fri, 24 Oct 2025 00:00:00 GMTpwnpwnhack.luFormat StringELFWojtek Chwalahttps://blog.wojtek.sh/blog/hacklu-kontinuerlig/https://blog.wojtek.sh/blog/hacklu-kontinuerlig/Root-cause analysis and exploitation of a GitHub Actions CI/CD pipeline (Hack.lu CTF 2025). A pull_request_target misconfiguration is leveraged through heredoc injection into GITHUB_ENV, LD_PRELOAD hijacking, and Python module shadowing to cross a privilege boundary. From there, symlink-based Docker build-context manipulation and Problem Matcher abuse chain together to bypass secret redaction and exfiltrate a repository secret.Wed, 22 Oct 2025 00:00:00 GMTmischack.luGithub ActionspwnrequestLD_PRELOAD hijackingheredoc injectionWojtek Chwalahttps://blog.wojtek.sh/blog/when-vue-forgets-to-escape-cve-2025-64112/https://blog.wojtek.sh/blog/when-vue-forgets-to-escape-cve-2025-64112/Part II of the CVE-2025-64112 writeup: weaponizing a stored XSS in the Statamic control panel into full Superadmin takeover. Admin-editable fields are rendered by Vue without v-pre or output encoding, so a {{constructor.constructor(...)}} payload executes JavaScript in a Superadmin's session. Two proof-of-concept chains are shown — a silent password change on versions ≤5.21.0, and an email swap on 5.22.0 (after password changes were hardened) to hijack the account via password reset.Mon, 25 Aug 2025 00:00:00 GMTwebcveresearchinjectionprivilege escalationWojtek Chwalahttps://blog.wojtek.sh/blog/when-vue-forgets-to-escape-stored-xss/https://blog.wojtek.sh/blog/when-vue-forgets-to-escape-stored-xss/Part I of the CVE-2025-64112 research: multiple stored XSS vectors in the Statamic control panel, rooted in Vue rendering admin-editable fields without the v-pre directive. Because Vue compiles mustache {{ }} expressions client-side, unescaped stored input is treated as executable template code — a {{this.constructor.constructor('alert(document.cookie)')()}} payload runs in an admin's browser. Six control-panel sections (collections, navigation, taxonomies, asset containers, globals, forms) were affected on versions ≤4.42.0. Part II chains this into full Superadmin takeover.Tue, 15 Jul 2025 00:00:00 GMTwebcveresearchinjectionprivilege escalationWojtek Chwalahttps://blog.wojtek.sh/blog/htb-dyplesher/https://blog.wojtek.sh/blog/htb-dyplesher/WriteupSat, 07 Nov 2020 00:00:00 GMThtbamqpgogslinuxluamemcachedrabbitmqsqlitevhostsbukkitjavacuberiteWojtek Chwala