Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The author of this post was at a live hacking event for Meta, doing recon. During recon, they found a hardcoded API key and thought it was interesting to give access to the GraphRAG endpoints. On its own, it wasn't much, but it was an entry point. The endpoint was NOT shy about returning lots, and lots of data about AI jobs that had been running.

The endpoint could be used to ingest new datasets into the knowledge base or delete existing ones, straight from S3, and DynamoDB. This was already a good find but not exactly what they wanted. While reviewing the endpiont load_datasources, the code takes a project_path before saving them. This path was never sanitized when it was downloaded for AI model processing (written in Python), so it can climb up the folder structure for the AI models to access the file. This allowed it to climb up the folder structure so the AI models could access the file.

In particular, site-packages can be traversed into with Python code on the module search path. The file write is awesome but NOT code execution by itself. While reviewing the application some more, they found the endpoint /visualize that loads a serialized object called pickle in Python. They used this to get RCE on the server but it was blind because of server restrictions. So the pickle file had to send an HTTP request with information like EC2 instance metadata.

The AWS role contained S3 read and write, DynamoDB read and write, and read access to 17 secrets in Secrets Manager. So, pretty impactful! The secrets contained a JWT secret, OAuth secrets, and more. At this point, they decided to stop and report the bug. After evaluating the impact, they only got $500 for the bug. The program claimed that the impact simply wasn't there. After getting root on a machine and access to a ton of creds, they were surprised by the ant-sized payout.