Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The authors of this post reviewed the libheif library, used in all sorts of libraries, to get RCE via memory corruption. Here's a link to that post.

They decided to attack a deployment of OpenAI discourse. This was because A) it was self-hosted, and B) it has a Sign in with OpenAI on auth.openai.com. Because Discourse was a hardened target, they decided to review some dependencies that it used.

HEIC, and HEIF images were transformed with a weird path. Notably, it uses FastImage, which falls back to the magick command for that version because it doesn't support it. libheif had a buffer overflow from last year that was fixed, but was never assigned a CVE. So most systems used an older version that still had the vulnerability.

After a day of work, they crafted a reliable RCE bug on Opus 4.8 with ASLR disabled. With Opus 5 released, they got a full exploit working on Discourse in 3 hours on ARM, then ported it to x86. Using the script, they got RCE on the OpenAI instance. Once they had RCE, they compromised an employees account, and made a simple PR on an internal repository.

Opus wouldn't do the exploit on the remote instance. So they proxied it through rce.ee/ctf-forum to make it look like a CTF forum and exploit it. The agent took a few days, costing only $3K in tokens, with three security researchers guiding it. For each vulnerable deployment, the AI would start blind on the exploit (versions matter for memory corruption) but succeed within a few days. The models even helped with privilege escalation!

Hacktron making the PR got some backlash. Although this wasn't necessary, it did have an impact. There are times were a company says that no impact was proven because you didn't do things you were NOT supposed to do. Hmmm. OpenAI was very angry and hostile toward the Hacktron. At the end of the day, they are good actors. If they were bad actors, they wouldn't have reported the bug.

The fact that the vulnerability was known interested me. It shows that the disclosure process still matters. It's cool that the AI found this, and exploited it.