1<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="image" href="https://cdn.hashnode.com/res/hashnode/image/upload/v1732563575464/38253db2-ea15-4ab6-a59f-995aec73fe71.png"/><link rel="stylesheet" href="/_next/static/css/0d16c72050851854.css" data-precedence="next"/><link rel="stylesheet" href="/_next/static/css/7ffcc02a3c67389b.css" data-precedence="next"/><link rel="stylesheet" href="/_next/static/css/c20e76e7d11dec32.css" data-precedence="next"/><link rel="stylesheet" href="/_next/static/css/59fefb2212bd5b60.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-55b36f0cd6c208fe.js"/>
1<script src="/_next/static/chunks/4bd1b696-100b9d70ed4e49c1.js" async=""></script>
1<script src="/_next/static/chunks/9da6db1e-8a4e8c23641c31bf.js" async=""></script>
1<script src="/_next/static/chunks/1255-a242e0ce0372fddf.js" async=""></script>
1<script src="/_next/static/chunks/main-app-bda8a52fe841b3aa.js" async=""></script>
1<script src="/_next/static/chunks/4554-984b480a9db5f3fe.js" async=""></script>
1<script src="/_next/static/chunks/7563-4dfa0994a9b0e37c.js" async=""></script>
1<script src="/_next/static/chunks/9216-9272709ba40c1cfd.js" async=""></script>
1<script src="/_next/static/chunks/2810-6b74d77b4b0dc790.js" async=""></script>
1<script src="/_next/static/chunks/3091-bf1537ff6571a1bd.js" async=""></script>
1<script src="/_next/static/chunks/app/layout-6ae7b4b583d4bba3.js" async=""></script>
1<script src="/_next/static/chunks/app/not-found-b861935655c5698b.js" async=""></script>
1<script src="/_next/static/chunks/5001-fae0bebdd93f95e3.js" async=""></script>
1<script src="/_next/static/chunks/2423-c8b1388240338d7d.js" async=""></script>
1<script src="/_next/static/chunks/652-f40dcb480b4e356f.js" async=""></script>
1<script src="/_next/static/chunks/app/page/%5Bslug%5D/page-8ebcb2eac05645c5.js" async=""></script>
1<meta name="next-size-adjust" content=""/>
1<script type="text/javascript">window.addEventListener('message',function(e){var d=e.data;if(!d||d.__hnWidget!==1||typeof d.h!=='number'||d.h<=0)return;var f=document.querySelectorAll('.hn-widget-frame');for(var i=0;i<f.length;i++){if(f[i].contentWindow===e.source){f[i].style.height=d.h+'px';break;}}});</script>
1<script src="/_next/static/chunks/polyfills-42372ed130431b0a.js" noModule=""></script>
1</head><body class="__variable_c2612a __variable_246ccd __variable_3069d5 bg-background dark:bg-background"><div hidden=""><!--$?--><template id="B:0"></template><!--/$--></div>
1<script>((a2, b2, c4, d3, e2, f2, g4, h3) => { 2 let i3 = document.documentElement, j2 = ["light", "dark"]; 3 function k2(b3) { 4 var c5; 5 (Array.isArray(a2) ? a2 : [a2]).forEach((a3) => { 6 let c6 = a3 === "class", d4 = c6 && f2 ? e2.map((a4) => f2[a4] || a4) : e2; 7 c6 ? (i3.classList.remove(...d4), i3.classList.add(f2 && f2[b3] ? f2[b3] : b3)) : i3.setAttribute(a3, b3); 8 }), c5 = b3, h3 && j2.includes(c5) && (i3.style.colorScheme = c5); 9 } 10 if (d3) k2(d3); 11 else try { 12 let a3 = localStorage.getItem(b2) || c4, d4 = g4 && a3 === "system" ? window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light" : a3; 13 k2(d4); 14 } catch { 15 } 16 })("class","theme","system",null,["light","dark"],null,true,true)</script>
16<main class="min-h-screen bg-transparent"><header class="sticky top-0 z-50 w-full py-4 bg-background backdrop-blur-sm transition-transform duration-300 translate-y-0"><a href="#main-content" class="sr-only focus:not-sr-only focus:absolute focus:left-4 focus:top-4 focus:z-50 focus:rounded-md focus:bg-background focus:px-4 focus:py-2 focus:text-sm focus:shadow">Skip to main content</a><div class="relative w-full mx-auto xl:max-w-[80rem] 2xl:max-w-[90rem] px-4 sm:px-12 md:px-18 lg:px-16 xl:px-10"><div class="flex items-center justify-between gap-3 xl:hidden"><div class="flex items-center gap-3 min-w-0 flex-1"><a class="flex items-center" href="/"><img alt="Hack to Def | From Offense to Defense" width="500" height="125" decoding="async" data-nimg="1" class="w-auto h-auto max-w-40 sm:max-w-48 max-h-10 sm:max-h-12 object-contain dark:hidden" style="color:transparent" src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732563575464/38253db2-ea15-4ab6-a59f-995aec73fe71.png"/><img alt="Hack to Def | From Offense to Defense" loading="lazy" width="500" height="125" decoding="async" data-nimg="1" class="w-auto h-auto max-w-40 sm:max-w-48 max-h-10 sm:max-h-12 object-contain hidden dark:block" style="color:transparent" src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732563525621/a1797410-b74c-4760-8556-c9e0f775b2af.png"/><span class="sr-only">Hack to Def | From Offense to Defense</span></a></div><div class="flex items-center gap-2 shrink-0"><button class="gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 hover:bg-accent py-2 h-9 w-9 px-0 flex items-center justify-center text-muted-foreground hover:text-foreground bg-transparent border-border shadow-none" aria-label="Open search (press Control or Command and K)"><i class="fa-jelly fa-search text-sm" aria-hidden="true"></i><span class="sr-only">Open search (press Control or Command and K)</span></button><button class="inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 hover:bg-accent w-9 px-3 h-9 text-muted-foreground hover:text-foreground shadow-none" type="button" id="radix-_R_kp5bsnpfalb_" aria-haspopup="menu" aria-expanded="false" data-state="closed" data-slot="dropdown-menu-trigger"><i class="fa-jelly fa-sun text-sm scale-100 rotate-0 transition-all dark:scale-0 dark:-rotate-90" aria-hidden="true"></i><i class="fa-jelly fa-moon absolute text-sm scale-0 rotate-90 transition-all dark:scale-100 dark:rotate-0" aria-hidden="true"></i><span class="sr-only">Toggle theme</span></button><button class="inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 border border-input bg-background hover:bg-accent hover:text-accent-foreground py-2 h-9 w-10 px-0 shadow-none" type="button" aria-haspopup="dialog" aria-expanded="false" aria-controls="radix-_R_sp5bsnpfalb_" data-state="closed" data-slot="sheet-trigger"><i class="fa-jelly fa-bars" aria-hidden="true"></i><span class="sr-only">Open menu</span></button></div></div><div class="hidden xl:grid gap-4 items-center xl:grid-cols-[1fr_auto_1fr] xl:gap-6 max-w-full xl:mx-auto xl:max-w-[80rem] 2xl:max-w-[90rem]"><div class="flex items-center w-full gap-3 min-w-0"><a class="flex items-center" href="/"><img alt="Hack to Def | From Offense to Defense" width="500" height="125" decoding="async" data-nimg="1" class="w-auto h-auto max-w-40 sm:max-w-48 max-h-10 sm:max-h-12 object-contain dark:hidden" style="color:transparent" src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732563575464/38253db2-ea15-4ab6-a59f-995aec73fe71.png"/><img alt="Hack to Def | From Offense to Defense" loading="lazy" width="500" height="125" decoding="async" data-nimg="1" class="w-auto h-auto max-w-40 sm:max-w-48 max-h-10 sm:max-h-12 object-contain hidden dark:block" style="color:transparent" src="https://cdn.hashnode.com/res/hashnode/image/upload/v1732563525621/a1797410-b74c-4760-8556-c9e0f775b2af.png"/><span class="sr-only">Hack to Def | From Offense to Defense</span></a></div><nav aria-label="Main navigation" class="flex justify-center w-full"><nav aria-label="Main" data-orientation="horizontal" dir="ltr" data-slot="navigation-menu" data-viewport="false" class="group/navigation-menu relative flex flex-1 items-center max-w-max justify-center"><div style="position:relative"><ul data-orientation="horizontal" data-slot="navigation-menu-list" class="group flex flex-1 list-none items-center flex-nowrap justify-center gap-1 text-muted-foreground text-sm" dir="ltr"><li data-slot="navigation-menu-item" class="relative"><a data-slot="navigation-menu-link" class="data-[active=true]:focus:bg-accent data-[active=true]:hover:bg-accent data-[active=true]:bg-accent/50 data-[active=true]:text-accent-foreground focus:bg-accent focus:text-accent-foreground [&_svg:not([class*='text-'])]:text-muted-foreground flex-col p-2 outline-none focus-visible:outline-1 [&_svg:not([class*='
16size-'])]:size-4 inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 hover:bg-accent hover:text-accent-foreground h-9 px-4 py-2" data-radix-collection-item="" href="/page/about">/whoami</a></li></ul></div></nav></nav><div class="flex items-center justify-end gap-3 text-muted-foreground"><button class="gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 hover:bg-accent py-2 h-9 w-9 px-0 flex items-center justify-center text-muted-foreground hover:text-foreground bg-transparent border-border shadow-none" aria-label="Open search (press Control or Command and K)"><i class="fa-jelly fa-search text-sm" aria-hidden="true"></i><span class="sr-only">Open search (press Control or Command and K)</span></button><div class="flex items-center gap-3"><button class="inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-hidden focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 hover:bg-accent w-9 px-3 h-9 text-muted-foreground hover:text-foreground shadow-none" type="button" id="radix-_R_1n95bsnpfalb_" aria-haspopup="menu" aria-expanded="false" data-state="closed" data-slot="dropdown-menu-trigger"><i class="fa-jelly fa-sun text-sm scale-100 rotate-0 transition-all dark:scale-0 dark:-rotate-90" aria-hidden="true"></i><i class="fa-jelly fa-moon absolute text-sm scale-0 rotate-90 transition-all dark:scale-100 dark:rotate-0" aria-hidden="true"></i><span class="sr-only">Toggle theme</span></button></div></div></div></div></header><div data-slot="dialog-header" class="flex flex-col gap-2 text-center sm:text-left sr-only"><h2 id="radix-_R_25bsnpfalbH1_" data-slot="dialog-title" class="text-lg leading-none font-semibold">Command Palette</h2><p id="radix-_R_25bsnpfalbH2_" data-slot="dialog-description" class="text-muted-foreground text-sm">Search for a command to run...</p></div><section class="pt-10 pb-16"><div class="px-4 sm:px-8"><div class="w-full xl:mx-auto xl:max-w-[80rem] 2xl:max-w-[90rem]"><article class="w-full rounded-xl border bg-card text-card-foreground"><div class="space-y-12 px-6 sm:px-10 pt-12 sm:pt-14 pb-10"><header class="space-y-4 text-center max-w-4xl mx-auto"><h1 class="text-4xl md:text-5xl font-bold text-balance text-foreground transition-colors">/whoami</h1></header><div class="prose dark:prose-invert prose-pre:bg-foreground prose-pre:text-background prose-pre:border prose-pre:border-border prose-pre:rounded prose-pre:p
16x-5 prose-pre:py-4 dark:prose-pre:bg-muted dark:prose-pre:text-foreground dark:prose-pre:border-border max-w-3xl mx-auto text-base [&>div>p:first-child]:mt-0 [&>div>p:first-child]:pt-0 min-w-0"><article class="space-y-6"><div class="prose prose-slate prose-pre:bg-foreground prose-pre:text-background prose-pre:border prose-pre:border-border prose-pre:rounded prose-pre:px-5 prose-pre:py-4 dark:prose-invert dark:prose-pre:bg-muted dark:prose-pre:text-foreground dark:prose-pre:border-border max-w-3xl mx-auto text-base lg:prose-lg [&>div>p:first-child]:mt-0 [&>div>p:first-child]:pt-0"><div><h2 id="heading-welcome">Welcome!</h2> 17<p>Welcome to HackToDef.com! Iâm Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.</p> 18<p>This is what <code>Hack to Def</code> is about. Showing relevant offensive techniques and how to defend against them.</p> 19<h2 id="heading-background">Background</h2> 20<p>I'm learning and practicing offensive cybersecurity since 2017 and I've never been bored ever since.</p> 21<p>I started in 2023 to do Cloud Security Research, I worked as a penetration tester for over 4 years, I have a Master's Degree in cybersecurity and I worked as a Web Developer for 3 years.</p> 22<p>I have extensive experience with Cloud Security (mostly AWS and focused on offensive), Web Application Security, Network Penetration Testing and Security Source Code Review. Along the way I got a few certifications such as OSCP, AWS Security Specialty, GIAC Cloud Penetration Tester and Certified Hybrid Multi-Cloud Red Team Specialist.</p> 23<h2 id="heading-research">Research</h2> 24<h3 id="heading-aws-cloudquarry-digging-for-secrets-in-public-amis-2024">AWS CloudQuarry: Digging for Secrets in Public AMIs (2024)</h3> 25<p>Money, secrets and mass exploitation: This research done in collaboration with Matei Josephs unveils a quarry of sensitive data stored in public AMIs. Digging through each AMI we managed to collect 500 GB of credentials, private repositories, access keys and more. The next article is the detailed analysis of how we did it and what the data represents.</p> 26<p>For this research we did a coordinated disclosure with AWSâs security team before publishing the article.</p> 27<p>Link: <a target="_blank" href="https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/" rel="noopener ugc">https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/</a></p> 28<h3 id="heading-7-lesser-known-aws-ssm-document-techniques-for-code-execution-2023">7 lesser-known AWS SSM Document techniques for code execution (2023)</h3> 29<p>This research is a deep dive into AWS SSM Run Command which shows that there are multiple documents attackers can use for executing code remotely on EC2 instances. In the next article I present 7 other documents that can be used when AWS-RunShellScript or AWS-RunPowerShellScript are not allowed.</p> 30<p>Link: <a target="_blank" href="https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/" rel="noopener ugc">https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/</a></p> 31<h2 id="heading-talks-and-presentations">Talks and presentations</h2> 32<p>In 2022 I gave my first talk and since then I was motivated to speak and present at security conferences or focus meetings.</p> 33<h3 id="heading-elevating-access-a-methodical-approach-to-privilege-escalation-in-aws-2024">Elevating Access: A Methodical Approach to Privilege Escalation in AWS (2024)</h3> 34<p>In this talk I show my methodology, techniques and tips from over 2 years of cloud projects where I searched and accomplished multiple and all kinds of privilege escalation vectors.</p> 35<p>Presented at:</p> 36<ul> 37<li>DefCamp Cluj-Napoca edition (Romania): <a target="_blank" href="https://www.youtube.com/watch?v=XTKtjhn3Dwc" rel="noopener ugc">https://www.youtube.com/watch?v=XTKtjhn3Dwc</a></li> 38</ul> 39<h3 id="heading-aws-cloudquarry-digging-for-secrets-in-public-amis-2024-1">AWS CloudQuarry: Digging for Secrets in Public AMIs (2024)</h3> 40<p>In this presentation I show the research done with Matei Josephs where we filtered and scanned over 3.1 public AMIs from all AWS regions. The talk shows how we managed to find a solution for mass scanning the AMIs along with the funny and not so funny results and conclusions we managed to gather.</p> 41<p>Presented at:</p> 42<ul> 43<li><p>Hacknet Barcelona edition (Spain): no recording available</p> 44</li> 45<li><p>DEF CON 32: <a target="_blank" href="https://www.youtube.com/watch?v=7k3zOylPKbM" rel="noopener ugc">https://www.youtube.com/watch?v=7k3zOylPKbM</a></p> 46</li> 47<li><p>No Hat 2024: <a target="_blank" href="https://www.youtube.com/watch?v=QYTXMJScZZk" rel="noopener ugc">https://www.youtube.com/watch?v=QYTXMJScZZk</a></p> 48</li> 49</ul> 50<h3 id="heading-cloud-security-transitioning-from-reactivity-to-proactivity-2024">Cloud Security: Transitioning from Reactivity to Proactivity (2024)</h3> 51<p>This presentation was given for the Romanian chapter of Cloud Security Alliance. Here I talk about the importance of cloud security, how cloud can also mean Kubernetes and CI/CD, and showed some examples of misconfigurations inspired by engagements.</p> 52<p>Link: <a target="_blank" href="https://www.youtube.com/watch?v=TVWCs401VIk" rel="noopener ugc">https://www.youtube.com/watch?v=TVWCs401VIk</a></p> 53<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youtube.com/watch?v=TVWCs401VIk" target="_blank" rel="noopener ugc">https://www.youtube.com/watch?v=TVWCs401VIk</a></div> 54<p> </p> 55<h3 id="heading-the-c2-tool-no-one-talks-about-aws-ssm-run-command-2023">The C2 tool no one talks about: AWS SSM - Run Command (2023)</h3> 56<p>This talk is about how the feature Run Command from the service Systems Manager (SSM) can be used as a perfect C2 tool, even if you don't have network connectivity to the instance or even if the instance is private altogether. The talk is a deep dive in how this feature can be used offensively, presenting 7 lesser-known documents for RCE along with a tool I developed called EC2StepShell.</p> 57<p>Presented at:</p> 58<ul> 59<li>Security Fest Sweden: <a target="_blank" href="https://www.youtube.com/watch?v=cn7XLaGmmCg" rel="noopener ugc">https://www.youtube.com/watch?v=cn7XLaGmmCg</a></li> 60</ul> 61<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youtube.com/watch?v=cn7XLaGmmCg" target="_blank" rel="noopener ugc">https://www.youtube.com/watch?v=cn7XLaGmmCg</a></div> 62<p> </p> 63<ul> 64<li><p>RSTCon #3 (in Romanian): <a target="_blank" href="https://www.youtube.com/watch?v=6Wymc9US4Ik" rel="noopener ugc">https://www.youtube.com/watch?v=6Wymc9US4Ik</a></p> 65</li> 66<li><p>DefCamp Romania: <a target="_blank" href="https://www.youtube.com/watch?v=SKXzwDy4vkw" rel="noopener ugc">https://www.youtube.com/watch?v=SKXzwDy4vkw</a></p> 67</li> 68</ul> 69<h3 id="heading-cloud-configuration-review-the-new-internal-pentest-2022">Cloud Configuration Review â The new internal pentest (2022)</h3> 70<p>This talk is about how the mentality around cloud security is the same as the old mentality about internal penetration testing. Meaning that, if something is in my internal network that can't be accessed by anyone from the internet, then I don't need to worry about it. As we know now, you should worry about the systems in your internal network and this mentality should be applied to cloud environments as well.</p> 71<p>Presented at DefCamp Romania:</p> 72<p>Link: <a target="_blank" href="https://www.youtube.com/watch?v=eyIQ82vvGLk" rel="noopener ugc">https://www.youtube.com/watch?v=eyIQ82vvGLk</a></p> 73<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://www.youtube.com/watch?v=eyIQ82vvGLk" target="_blank" rel="noopener ugc">https://www.youtube.com/watch?v=eyIQ82vvGLk</a></div> 74<p> </p> 75<h2 id="heading-cves-tools-and-other-articles">CVEs, tools and other articles</h2> 76<h3 id="heading-cves">CVEs</h3> 77<p><a target="_blank" href="https://github.com/advisories/GHSA-hv3m-r794-pg43" rel="noopener ugc">CVE-2023-51946</a></p> 78<blockquote> 79<p>Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.</p> 80</blockquote> 81<p><a target="_blank" href="https://github.com/advisories/GHSA-2cq5-qqj9-pr9m" rel="noopener ugc">CVE-2023-51947</a></p> 82<blockquote> 83<p>Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.</p> 84</blockquote> 85<p><a target="_blank" href="https://github.com/advisories/GHSA-99vg-whp9-cxq4" rel="noopener ugc">CVE-2023-51948</a></p> 86<blockquote> 87<p>A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.</p> 88</blockquote> 89<h3 id="heading-tools">Tools</h3> 90<p><strong>CloudShovel</strong></p> 91<blockquote> 92<p>A tool for scanning public or private AMIs for sensitive files and secrets. The tool follows the research made on AWS CloudQuarry where we scanned 20k+ public AMIs.</p> 93</blockquote> 94<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/saw-your-packet/CloudShovel" target="_blank" rel="noopener ugc">https://github.com/saw-your-packet/CloudShovel</a></div> 95<p> </p> 96<h4 id="heading-ec2stepshell">EC2StepShell</h4> 97<blockquote> 98<p>EC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.</p> 99</blockquote> 100<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/saw-your-packet/EC2StepShell" target="_blank" rel="noopener ugc">https://github.com/saw-your-packet/EC2StepShell</a></div> 101<p> </p> 102<h4 id="heading-fun-with-ssm">fun-with-ssm</h4> 103<blockquote> 104<p>A repository with resources for AWS post-exploitation scenarios where you have the permission ssm:SendCommand, but you can't use the AWS-RunPowerShellScript or AWS-RunShellScript documents.</p> 105</blockquote> 106<div class="embed-wrapper"><div class="embed-loading"><div class="loadingRow"></div><div class="loadingRow"></div></div><a class="embed-card" href="https://github.com/saw-your-packet/fun-with-ssm" target="_blank" rel="noopener ugc">https://github.com/saw-your-packet/fun-with-ssm</a></div> 107<p> </p> 108<h3 id="heading-other-articles">Other articles</h3> 109<p>Since June 2024 this is my official blogging platform, but I wrote in the past on securitycafe.ro a series of articles:</p> 110<ul> 111<li><p><a target="_blank" href="https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/" rel="noopener ugc">AWS CloudQuarry: Digging for Secrets in Public AMIs</a></p> 112</li> 113<li><p><a target="_blank" href="https://securitycafe.ro/2023/07/27/iamactionhunter-in-action/" rel="noopener ugc">IAMActionHunter in action</a></p> 114</li> 115<li><p><a target="_blank" href="https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/" rel="noopener ugc">7 lesser-known AWS SSM Document techniques for code execution</a></p> 116</li> 117<li><p><a target="_blank" href="https://securitycafe.ro/2023/03/08/ec2stepshell-reverse-shells-private-ec2-instances/" rel="noopener ugc">EC2StepShell: A Tool for Getting Reverse Shells on Instances with Network Restrictions</a></p> 118</li> 119<li><p><a target="_blank" href="https://securitycafe.ro/2023/01/17/aws-post-explitation-with-ssm-sendcommand/" rel="noopener ugc">
119AWS ssm:SendCommand or network agnostic built-in RCE as root</a></p> 120</li> 121<li><p><a target="_blank" href="https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/" rel="noopener ugc">AWS Enumeration â Part II (Practical enumeration)</a></p> 122</li> 123<li><p><a target="_blank" href="https://securitycafe.ro/2022/11/01/aws-enumeration-part-1/" rel="noopener ugc">AWS Enumeration â Part I (Where to start, Approaches and Tools)</a></p> 124</li> 125<li><p><a target="_blank" href="https://securitycafe.ro/2022/07/01/web-cache-deception-attacks/" rel="noopener ugc">Web Cache Deception attacks</a></p> 126</li> 127<li><p><a target="_blank" href="https://securitycafe.ro/2022/06/06/security-source-code-review-manual-approaches/" rel="noopener ugc">Security Source Code Review â Manual Approaches</a></p> 128</li> 129</ul> 130<h2 id="heading-get-in-touch">Get in touch</h2> 131<p>I'm open for collaborations, workshops on cloud security, mentoring and chatting. Feel free to reach me out on my social media accounts or via email ð¤</p> 132<ul> 133<li><p><a target="_blank" href="https://www.linkedin.com/in/eduard-k-agavriloae/" rel="noopener ugc">LinkedIn</a></p> 134</li> 135<li><p><a target="_blank" href="https://twitter.com/saw_your_packet" rel="noopener ugc">Twitter/X</a></p> 136</li> 137</ul> 138<p>Thanks for being here,</p> 139<p><a class="user-mention" href="https://hashnode.com/@sawyourpacket" target="_blank" rel="noopener ugc">Eduard Agavriloae</a></p> 140</div></div></article></div></div></article></div></div></section>
140<script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"/whoami","url":"https://hacktodef.com/page/about","mainEntityOfPage":{"@type":"WebPage","url":"https://hacktodef.com/page/about"},"publisher":{"@type":"Organization","name":"Hack to Def | From Offense to Defense","url":"https://hacktodef.com","logo":"https://cdn.hashnode.com/res/hashnode/image/upload/v1732563575464/38253db2-ea15-4ab6-a59f-995aec73fe71.png"},"description":"Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.","image":{"@type":"ImageObject","url":"https://cdn.hashnode.com/res/hashnode/image/upload/v1717003033353/ROalVUiQ5.jpg"}}</script>
140<footer class="px-4 pt-8 pb-20 sm:px-8 text-muted-foreground" aria-label="Footer"><div class="w-full max-w-4xl mx-auto"><div class="flex flex-col items-center gap-4 text-center text-sm"><p class="font-medium"><time dateTime="2026"><span class="font-sans">©</span> <!-- -->2026</time> <!-- -->Hack to Def | From Offense to Defense</p><nav aria-label="Footer navigation"><ul class="flex flex-wrap justify-center gap-4 text-sm tracking-wide"><li><a class="transition hover:text-foreground" href="/members">Members</a></li><li><a class="transition hover:text-foreground" href="/archive">Archive</a></li><li><a class="transition hover:text-foreground" target="_blank" rel="noopener" href="https://hashnode.com/privacy-policy">Privacy</a></li><li><a class="transition hover:text-foreground" target="_blank" rel="noopener" href="https://hashnode.com/terms">Terms</a></li></ul></nav><div class="pt-8 flex justify-center gap-6"><a target="_blank" rel="noopener" class="flex items-center gap-2 text-sm transition hover:text-foreground" title="Sitemap" href="/sitemap.xml"><i class="fa-regular fa-sitemap"></i><span>Sitemap</span></a><a target="_blank" rel="noopener" class="flex items-center gap-2 text-sm transition hover:text-foreground" title="RSS Feed" href="/rss.xml"><i class="fa-regular fa-rss"></i><span>RSS</span></a></div></div></div></footer></main><!--$?--><template id="B:1"></template><!--/$-->
140<script>requestAnimationFrame(function(){$RT=performance.now()});</script>
140<script src="/_next/static/chunks/webpack-55b36f0cd6c208fe.js" id="_R_" async=""></script>
140<script>(self.__next_f=self.__next_f||[]).push([0])</script>
140<script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[16174,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"9216\",\"static/chunks/9216-9272709ba40c1cfd.js\",\"2810\",\"static/chunks/2810-6b74d77b4b0dc790.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"7177\",\"static/chunks/app/layout-6ae7b4b583d4bba3.js\"],\"ThemeProvider\"]\n3:I[82180,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"9216\",\"static/chunks/9216-9272709ba40c1cfd.js\",\"2810\",\"static/chunks/2810-6b74d77b4b0dc790.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"7177\",\"static/chunks/app/layout-6ae7b4b583d4bba3.js\"],\"TooltipProvider\"]\n4:I[63851,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"9216\",\"static/chunks/9216-9272709ba40c1cfd.js\",\"2810\",\"static/chunks/2810-6b74d77b4b0dc790.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"7177\",\"static/chunks/app/layout-6ae7b4b583d4bba3.js\"],\"UrqlProvider\"]\n5:I[82714,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"9216\",\"static/chunks/9216-9272709ba40c1cfd.js\",\"2810\",\"static/chunks/2810-6b74d77b4b0dc790.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"7177\",\"static/chunks/app/layout-6ae7b4b583d4bba3.js\"],\"ConsentManager\"]\n6:I[9766,[],\"\"]\n7:I[98924,[],\"\"]\n8:I[33293,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"4345\",\"static/chunks/app/not-found-b861935655c5698b.js\"],\"default\"]\n9:I[21447,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"9216\",\"static/chunks/9216-9272709ba40c1cfd.js\",\"2810\",\"static/chunks/2810-6b74d77b4b0dc790.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"7177\",\"static/chunks/app/layout-6ae7b4b583d4bba3.js\"],\"Integrations\"]\na:I[35514,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"9216\",\"static/chunks/9216-9272709ba40c1cfd.js\",\"2810\",\"static/chunks/2810-6b74d77b4b0dc790.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"7177\",\"static/chunks/app/layout-6ae7b4b583d4bba3.js\"],\"Analytics\"]\nc:I[24431,[],\"OutletBoundary\"]\ne:I[15278,[],\"AsyncMetadataOutlet\"]\n10:I[24431,[],\"ViewportBoundary\"]\n12:I[24431,[],\"MetadataBoundary\"]\n13:\"$Sreact.suspense\"\n15:I[57150,[],\"\"]\n:HL[\"/_next/static/media/22a5144ee8d83bca-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/72a2a501b11d0ccb.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/8934b430a4adeb19-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/8e9860b6e62d6359-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/c4b700dcb2187787-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/e4af272ccee01ff0-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/css/0d16c72050851854.css\",\"style\"]\n:HL[\"/_next/static/css/7ffcc02a3c67389b.css\",\"style\"]\n:HL[\"/_next/static/css/c20e76e7d11dec32.css\",\"style\"]\n:HL[\"/_next/static/css/59fefb2212bd5b60.css\",\"style\"]\n0:{\"P\":null,\"b\":\"RrCGzNVHUG674hJ_sjvms\",\"p\":\"\",\"c\":[\"\",\"page\",\"about?x-host=hacktodef.com\"],\"i\":false,\"f\":[[[\"\",{\"children\":[\"page\",{\"children\":[[\"slug\",\"about\",\"d\"],{\"children\":[\"__PAGE__?{\\\"x-host\\\":\\\"hacktodef.com\\\"}\",{}]}]}]},\"$undefined\",\"$undefined\",true],[\"\",[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/0d16c72050851854.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/7ffcc02a3c67389b.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"2\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/c20e76e7d11dec32.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"3\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/59fefb2212bd5b60.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"suppressHydrationWarning\":true,\"children\":[[\"$\","])</script>
140<script>self.__next_f.push([1,"\"head\",null,{\"children\":[\"$\",\"script\",null,{\"type\":\"text/javascript\",\"dangerouslySetInnerHTML\":{\"__html\":\"window.addEventListener('message',function(e){var d=e.data;if(!d||d.__hnWidget!==1||typeof d.h!=='number'||d.h\u003c=0)return;var f=document.querySelectorAll('.hn-widget-frame');for(var i=0;i\u003cf.length;i++){if(f[i].contentWindow===e.source){f[i].style.height=d.h+'px';break;}}});\"}}]}],[\"$\",\"body\",null,{\"className\":\"__variable_c2612a __variable_246ccd __variable_3069d5 bg-background dark:bg-background\",\"children\":[\"$\",\"$L2\",null,{\"attribute\":\"class\",\"defaultTheme\":\"system\",\"enableSystem\":true,\"disableTransitionOnChange\":true,\"children\":[\"$\",\"$L3\",null,{\"children\":[\"$\",\"$L4\",null,{\"children\":[\"$\",\"$L5\",null,{\"children\":[[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"$L8\",null,{}],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}],[\"$\",\"$L9\",null,{}],[\"$\",\"$La\",null,{}]]}]}]}]}]}]]}]]}],{\"children\":[\"page\",[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[[\"slug\",\"about\",\"d\"],[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[\"__PAGE__\",[\"$\",\"$1\",\"c\",{\"children\":[\"$Lb\",null,[\"$\",\"$Lc\",null,{\"children\":[\"$Ld\",[\"$\",\"$Le\",null,{\"promise\":\"$@f\"}]]}]]}],{},null,false]},null,false]},null,false]},null,false],[\"$\",\"$1\",\"h\",{\"children\":[null,[[\"$\",\"$L10\",null,{\"children\":\"$L11\"}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]],[\"$\",\"$L12\",null,{\"children\":[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$13\",null,{\"fallback\":null,\"children\":\"$L14\"}]}]}]]}],false]],\"m\":\"$undefined\",\"G\":[\"$15\",[]],\"s\":false,\"S\":false}\n11:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\nd:null\n16:I[652,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"5001\",\"static/chunks/5001-fae0bebdd93f95e3.js\",\"2423\",\"static/chunks/2423-c8b1388240338d7d.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"652\",\"static/chunks/652-f40dcb480b4e356f.js\",\"6304\",\"static/chunks/app/page/%5Bslug%5D/page-8ebcb2eac05645c5.js\"],\"BlogHeader\"]\n17:T2fc0,\u003ch2 id=\"heading-welcome\"\u003eWelcome!\u003c/h2\u003e\n\u003cp\u003eWelcome to HackToDef.com! Iâm Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\u003c/p\u003e\n\u003cp\u003eThis is what \u003ccode\u003eHack to Def\u003c/code\u003e is about. Showing relevant offensive techniques and how to defend against them.\u003c/p\u003e\n\u003ch2 id=\"heading-background\"\u003eBackground\u003c/h2\u003e\n\u003cp\u003eI'm learning and practicing offensive cybersecurity since 2017 and I've never been bored ever since.\u003c/p\u003e\n\u003cp\u003eI started in 2023 to do Cloud Security Research, I worked as a penetration tester for over 4 years, I have a Master's Degree in cybersecurity and I worked as a Web Developer for 3 years.\u003c/p\u003e\n\u003cp\u003eI have extensive experience with Cloud Security (mostly AWS and focused on offensive), Web Application Security, Network Penetration Testing and Security Source Code Review. Along the way I got a few certifications such as OSCP, AWS Security Specialty, GIAC Cloud Penetration Tester and Certified Hybrid Multi-Cloud Red Team Specialist.\u003c/p\u003e\n\u003ch2 id=\"heading-research\"\u003eResearch\u003c/h2\u003e\n\u003ch3 id=\"heading-aws-cloudquarry-digging-for-secrets-in-public-amis-2024\"\u003eAWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\u003c/h3\u003e\n\u003cp\u003eMoney, secrets and mass exploit"])</script>
140<script>self.__next_f.push([1,"ation: This research done in collaboration with Matei Josephs unveils a quarry of sensitive data stored in public AMIs. Digging through each AMI we managed to collect 500 GB of credentials, private repositories, access keys and more. The next article is the detailed analysis of how we did it and what the data represents.\u003c/p\u003e\n\u003cp\u003eFor this research we did a coordinated disclosure with AWSâs security team before publishing the article.\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/\"\u003ehttps://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/\u003c/a\u003e\u003c/p\u003e\n\u003ch3 id=\"heading-7-lesser-known-aws-ssm-document-techniques-for-code-execution-2023\"\u003e7 lesser-known AWS SSM Document techniques for code execution (2023)\u003c/h3\u003e\n\u003cp\u003eThis research is a deep dive into AWS SSM Run Command which shows that there are multiple documents attackers can use for executing code remotely on EC2 instances. In the next article I present 7 other documents that can be used when AWS-RunShellScript or AWS-RunPowerShellScript are not allowed.\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/\"\u003ehttps://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"heading-talks-and-presentations\"\u003eTalks and presentations\u003c/h2\u003e\n\u003cp\u003eIn 2022 I gave my first talk and since then I was motivated to speak and present at security conferences or focus meetings.\u003c/p\u003e\n\u003ch3 id=\"heading-elevating-access-a-methodical-approach-to-privilege-escalation-in-aws-2024\"\u003eElevating Access: A Methodical Approach to Privilege Escalation in AWS (2024)\u003c/h3\u003e\n\u003cp\u003eIn this talk I show my methodology, techniques and tips from over 2 years of cloud projects where I searched and accomplished multiple and all kinds of privilege escalation vectors.\u003c/p\u003e\n\u003cp\u003ePresented at:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDefCamp Cluj-Napoca edition (Romania): \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=XTKtjhn3Dwc\"\u003ehttps://www.youtube.com/watch?v=XTKtjhn3Dwc\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"heading-aws-cloudquarry-digging-for-secrets-in-public-amis-2024-1\"\u003eAWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\u003c/h3\u003e\n\u003cp\u003eIn this presentation I show the research done with Matei Josephs where we filtered and scanned over 3.1 public AMIs from all AWS regions. The talk shows how we managed to find a solution for mass scanning the AMIs along with the funny and not so funny results and conclusions we managed to gather.\u003c/p\u003e\n\u003cp\u003ePresented at:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eHacknet Barcelona edition (Spain): no recording available\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDEF CON 32: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=7k3zOylPKbM\"\u003ehttps://www.youtube.com/watch?v=7k3zOylPKbM\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eNo Hat 2024: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=QYTXMJScZZk\"\u003ehttps://www.youtube.com/watch?v=QYTXMJScZZk\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"heading-cloud-security-transitioning-from-reactivity-to-proactivity-2024\"\u003eCloud Security: Transitioning from Reactivity to Proactivity (2024)\u003c/h3\u003e\n\u003cp\u003eThis presentation was given for the Romanian chapter of Cloud Security Alliance. Here I talk about the importance of cloud security, how cloud can also mean Kubernetes and CI/CD, and showed some examples of misconfigurations inspired by engagements.\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=TVWCs401VIk\"\u003ehttps://www.youtube.com/watch?v=TVWCs401VIk\u003c/a\u003e\u003c/p\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://www.youtube.com/watch?v=TVWCs401VIk\"\u003ehttps://www.youtube.com/watch?v=TVWCs401VIk\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch3 id=\"heading-the-c2-tool-no-one-talks-about-aws-ssm-run-command-2023\"\u003eThe C2 tool no one talks about: AWS SSM - Run Command (2023)\u003c/h3\u003e\n\u003cp\u003eThis talk is about how the feature Run Command from the service Systems Manager (SSM) can be used as a perfect C2 tool, even if you don't have network connectivity to the instance or eve"])</script>
140<script>self.__next_f.push([1,"n if the instance is private altogether. The talk is a deep dive in how this feature can be used offensively, presenting 7 lesser-known documents for RCE along with a tool I developed called EC2StepShell.\u003c/p\u003e\n\u003cp\u003ePresented at:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSecurity Fest Sweden: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=cn7XLaGmmCg\"\u003ehttps://www.youtube.com/watch?v=cn7XLaGmmCg\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://www.youtube.com/watch?v=cn7XLaGmmCg\"\u003ehttps://www.youtube.com/watch?v=cn7XLaGmmCg\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eRSTCon #3 (in Romanian): \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=6Wymc9US4Ik\"\u003ehttps://www.youtube.com/watch?v=6Wymc9US4Ik\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDefCamp Romania: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=SKXzwDy4vkw\"\u003ehttps://www.youtube.com/watch?v=SKXzwDy4vkw\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"heading-cloud-configuration-review-the-new-internal-pentest-2022\"\u003eCloud Configuration Review â The new internal pentest (2022)\u003c/h3\u003e\n\u003cp\u003eThis talk is about how the mentality around cloud security is the same as the old mentality about internal penetration testing. Meaning that, if something is in my internal network that can't be accessed by anyone from the internet, then I don't need to worry about it. As we know now, you should worry about the systems in your internal network and this mentality should be applied to cloud environments as well.\u003c/p\u003e\n\u003cp\u003ePresented at DefCamp Romania:\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=eyIQ82vvGLk\"\u003ehttps://www.youtube.com/watch?v=eyIQ82vvGLk\u003c/a\u003e\u003c/p\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://www.youtube.com/watch?v=eyIQ82vvGLk\"\u003ehttps://www.youtube.com/watch?v=eyIQ82vvGLk\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch2 id=\"heading-cves-tools-and-other-articles\"\u003eCVEs, tools and other articles\u003c/h2\u003e\n\u003ch3 id=\"heading-cves\"\u003eCVEs\u003c/h3\u003e\n\u003cp\u003e\u003ca target=\"_blank\" href=\"https://github.com/advisories/GHSA-hv3m-r794-pg43\"\u003eCVE-2023-51946\u003c/a\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eMultiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003ca target=\"_blank\" href=\"https://github.com/advisories/GHSA-2cq5-qqj9-pr9m\"\u003eCVE-2023-51947\u003c/a\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eImproper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003ca target=\"_blank\" href=\"https://github.com/advisories/GHSA-99vg-whp9-cxq4\"\u003eCVE-2023-51948\u003c/a\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eA Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3 id=\"heading-tools\"\u003eTools\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eCloudShovel\u003c/strong\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eA tool for scanning public or private AMIs for sensitive files and secrets. The tool follows the research made on AWS CloudQuarry where we scanned 20k+ public AMIs.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://github.com/saw-your-packet/CloudShovel\"\u003ehttps://github.com/saw-your-packet/CloudShovel\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch4 id=\"heading-ec2stepshell\"\u003eEC2StepShell\u003c/h4\u003e\n\u003cblockquote\u003e\n\u003cp\u003eEC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://github.com/saw-your-packet/EC2StepShell\"\u003ehttps://github.com/saw-your-packet/EC2StepShell\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch4 id=\"heading-fun-with-ssm\"\u003efun-with-ssm\u003c/h4\u003e\n\u003cblockquote\u003e\n\u003cp\u003eA repository with resources for AW"])</script>
140<script>self.__next_f.push([1,"S post-exploitation scenarios where you have the permission ssm:SendCommand, but you can't use the AWS-RunPowerShellScript or AWS-RunShellScript documents.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://github.com/saw-your-packet/fun-with-ssm\"\u003ehttps://github.com/saw-your-packet/fun-with-ssm\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch3 id=\"heading-other-articles\"\u003eOther articles\u003c/h3\u003e\n\u003cp\u003eSince June 2024 this is my official blogging platform, but I wrote in the past on securitycafe.ro a series of articles:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/\"\u003eAWS CloudQuarry: Digging for Secrets in Public AMIs\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/07/27/iamactionhunter-in-action/\"\u003eIAMActionHunter in action\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/\"\u003e7 lesser-known AWS SSM Document techniques for code execution\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/03/08/ec2stepshell-reverse-shells-private-ec2-instances/\"\u003eEC2StepShell: A Tool for Getting Reverse Shells on Instances with Network Restrictions\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/01/17/aws-post-explitation-with-ssm-sendcommand/\"\u003eAWS ssm:SendCommand or network agnostic built-in RCE as root\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/\"\u003eAWS Enumeration â Part II (Practical enumeration)\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/11/01/aws-enumeration-part-1/\"\u003eAWS Enumeration â Part I (Where to start, Approaches and Tools)\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/07/01/web-cache-deception-attacks/\"\u003eWeb Cache Deception attacks\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/06/06/security-source-code-review-manual-approaches/\"\u003eSecurity Source Code Review â Manual Approaches\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"heading-get-in-touch\"\u003eGet in touch\u003c/h2\u003e\n\u003cp\u003eI'm open for collaborations, workshops on cloud security, mentoring and chatting. Feel free to reach me out on my social media accounts or via email ð¤\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://www.linkedin.com/in/eduard-k-agavriloae/\"\u003eLinkedIn\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://twitter.com/saw_your_packet\"\u003eTwitter/X\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks for being here,\u003c/p\u003e\n\u003cp\u003e\u003ca class=\"user-mention\" href=\"https://hashnode.com/@sawyourpacket\"\u003eEduard Agavriloae\u003c/a\u003e\u003c/p\u003e\n18:T223c,## Welcome!\n\nWelcome to HackToDef.com! Iâm Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\n\nThis is what `Hack to Def` is about. Showing relevant offensive techniques and how to defend against them.\n\n## Backgroun
140d\n\nI'm learning and practicing offensive cybersecurity since 2017 and I've never been bored ever since.\n\nI started in 2023 to do Cloud Security Research, I worked as a penetration tester for over 4 years, I have a Master's Degree in cybersecurity and I worked as a Web Developer for 3 years.\n\nI have extensive experience with Cloud Security (mostly AWS and focused on offensive), Web Application Security, Network Penetration Testing and Security Source Code Review. Along the way I got a few certifications such as OSCP, AWS Security Specialty, GIAC Cloud Penetration Tester and Certified Hybrid Multi-Cloud Red Team Specialist.\n\n## Research\n\n### AWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\n\nMoney, secrets and mass exploitation: This research done in collaboration with Matei Josephs unveils a quarry of sensitive data stored in public AMIs. Digging through each AMI we managed to collect 500 GB of credentials, private repositories, access keys and more. The next article is "])</script>
140<script>self.__next_f.push([1,"the detailed analysis of how we did it and what the data represents.\n\nFor this research we did a coordinated disclosure with AWSâs security team before publishing the article.\n\nLink: [https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/](https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/)\n\n### 7 lesser-known AWS SSM Document techniques for code execution (2023)\n\nThis research is a deep dive into AWS SSM Run Command which shows that there are multiple documents attackers can use for executing code remotely on EC2 instances. In the next article I present 7 other documents that can be used when AWS-RunShellScript or AWS-RunPowerShellScript are not allowed.\n\nLink: [https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/](https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/)\n\n## Talks and presentations\n\nIn 2022 I gave my first talk and since then I was motivated to speak and present at security conferences or focus meetings.\n\n### Elevating Access: A Methodical Approach to Privilege Escalation in AWS (2024)\n\nIn this talk I show my methodology, techniques and tips from over 2 years of cloud projects where I searched and accomplished multiple and all kinds of privilege escalation vectors.\n\nPresented at:\n\n* DefCamp Cluj-Napoca edition (Romania): [https://www.youtube.com/watch?v=XTKtjhn3Dwc](https://www.youtube.com/watch?v=XTKtjhn3Dwc)\n \n\n### AWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\n\nIn this presentation I show the research done with Matei Josephs where we filtered and scanned over 3.1 public AMIs from all AWS regions. The talk shows how we managed to find a solution for mass scanning the AMIs along with the funny and not so funny results and conclusions we managed to gather.\n\nPresented at:\n\n* Hacknet Barcelona edition (Spain): no recording available\n \n* DEF CON 32: [https://www.youtube.com/watch?v=7k3zOylPKbM](https://www.youtube.com/watch?v=7k3zOylPKbM)\n \n* No Hat 2024: [https://www.youtube.com/watch?v=QYTXMJScZZk](https://www.youtube.com/watch?v=QYTXMJScZZk)\n \n\n### Cloud Security: Transitioning from Reactivity to Proactivity (2024)\n\nThis presentation was given for the Romanian chapter of Cloud Security Alliance. Here I talk about the importance of cloud security, how cloud can also mean Kubernetes and CI/CD, and showed some examples of misconfigurations inspired by engagements.\n\nLink: [https://www.youtube.com/watch?v=TVWCs401VIk](https://www.youtube.com/watch?v=TVWCs401VIk)\n\n%[https://www.youtube.com/watch?v=TVWCs401VIk] \n\n### The C2 tool no one talks about: AWS SSM - Run Command (2023)\n\nThis talk is about how the feature Run Command from the service Systems Manager (SSM) can be used as a perfect C2 tool, even if you don't have network connectivity to the instance or even if the instance is private altogether. The talk is a deep dive in how this feature can be used offensively, presenting 7 lesser-known documents for RCE along with a tool I developed called EC2StepShell.\n\nPresented at:\n\n* Security Fest Sweden: [https://www.youtube.com/watch?v=cn7XLaGmmCg](https://www.youtube.com/watch?v=cn7XLaGmmCg)\n \n\n%[https://www.youtube.com/watch?v=cn7XLaGmmCg] \n\n* RSTCon #3 (in Romanian): [https://www.youtube.com/watch?v=6Wymc9US4Ik](https://www.youtube.com/watch?v=6Wymc9US4Ik)\n \n* DefCamp Romania: [https://www.youtube.com/watch?v=SKXzwDy4vkw](https://www.youtube.com/watch?v=SKXzwDy4vkw)\n \n\n### Cloud Configuration Review â The new internal pentest (2022)\n\nThis talk is about how the mentality around cloud security is the same as the old mentality about internal penetration testing. Meaning that, if something is in my internal network that can't be accessed by anyone from the internet, then I don't need to worry about it. As we know now, you should worry about the systems in your internal network and this mentality should be applied to cloud environments as well.\n\nPresented at DefCamp Romania:\n\nLink: [https://www.youtube.com/watch?v=eyIQ82vvGLk
140]"])</script>
140<script>self.__next_f.push([1,"(https://www.youtube.com/watch?v=eyIQ82vvGLk)\n\n%[https://www.youtube.com/watch?v=eyIQ82vvGLk] \n\n## CVEs, tools and other articles\n\n### CVEs\n\n[CVE-2023-51946](https://github.com/advisories/GHSA-hv3m-r794-pg43)\n\n\u003e Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.\n\n[CVE-2023-51947](https://github.com/advisories/GHSA-2cq5-qqj9-pr9m)\n\n\u003e Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.\n\n[CVE-2023-51948](https://github.com/advisories/GHSA-99vg-whp9-cxq4)\n\n\u003e A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.\n\n### Tools\n\n**CloudShovel**\n\n\u003e A tool for scanning public or private AMIs for sensitive files and secrets. The tool follows the research made on AWS CloudQuarry where we scanned 20k+ public AMIs.\n\n%[https://github.com/saw-your-packet/CloudShovel] \n\n#### EC2StepShell\n\n\u003e EC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.\n\n%[https://github.com/saw-your-packet/EC2StepShell] \n\n#### fun-with-ssm\n\n\u003e A repository with resources for AWS post-exploitation scenarios where you have the permission ssm:SendCommand, but you can't use the AWS-RunPowerShellScript or AWS-RunShellScript documents.\n\n%[https://github.com/saw-your-packet/fun-with-ssm] \n\n### Other articles\n\nSince June 2024 this is my official blogging platform, but I wrote in the past on securitycafe.ro a series of articles:\n\n* [AWS CloudQuarry: Digging for Secrets in Public AMIs](https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/)\n \n* [IAMActionHunter in action](https://securitycafe.ro/2023/07/27/iamactionhunter-in-action/)\n \n* [7 lesser-known AWS SSM Document techniques for code execution](https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/)\n \n* [EC2StepShell: A Tool for Getting Reverse Shells on Instances with Network Restrictions](https://securitycafe.ro/2023/03/08/ec2stepshell-reverse-shells-private-ec2-instances/)\n \n* [AWS ssm:SendCommand or network agnostic built-in RCE as root](https://securitycafe.ro/2023/01/17/aws-post-explitation-with-ssm-sendcommand/)\n \n* [AWS Enumeration â Part II (Practical enumeration)](https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/)\n \n* [AWS Enumeration â Part I (Where to start, Approaches and Tools)](https://securitycafe.ro/2022/11/01/aws-enumeration-part-1/)\n \n* [Web Cache Deception attacks](https://securitycafe.ro/2022/07/01/web-cache-deception-attacks/)\n \n* [Security Source Code Review â Manual Approaches](https://securitycafe.ro/2022/06/06/security-source-code-review-manual-approaches/)\n \n\n## Get in touch\n\nI'm open for collaborations, workshops on cloud security, mentoring and chatting. Feel free to reach me out on my social media accounts or via email ð¤\n\n* [LinkedIn](https://www.linkedin.com/in/eduard-k-agavriloae/)\n \n* [Twitter/X](https://twitter.com/saw_your_packet)\n \n\nThanks for being here,\n\n@[Eduard Agavriloae](@sawyourpacket)19:T1b2b,Welcome!\nWelcome to HackToDef.com! Iâm Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\nThis is what Hack to Def is about. Showing relevant offensive techniques and how to defend against them.\nBackground\nI'm learning and practicing offensive cybersecurity since 2017 and I've never been bored ever since.\nI started in 2023 to do Cloud Security Research, I worked as a penetration tester for over 4 years, I have a Master's Degree in cybersecurity and I worked as a Web Developer for 3 years.\nI have extensive experience with Cloud Security (mostly AWS and focused on offensive), Web Application Security, Network Penetration "])</script>
140<script>self.__next_f.push([1,"Testing and Security Source Code Review. Along the way I got a few certifications such as OSCP, AWS Security Specialty, GIAC Cloud Penetration Tester and Certified Hybrid Multi-Cloud Red Team Specialist.\nResearch\nAWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\nMoney, secrets and mass exploitation: This research done in collaboration with Matei Josephs unveils a quarry of sensitive data stored in public AMIs. Digging through each AMI we managed to collect 500 GB of credentials, private repositories, access keys and more. The next article is the detailed analysis of how we did it and what the data represents.\nFor this research we did a coordinated disclosure with AWSâs security team before publishing the article.\nLink: https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/\n7 lesser-known AWS SSM Document techniques for code execution (2023)\nThis research is a deep dive into AWS SSM Run Command which shows that there are multiple documents attackers can use for executing code remotely on EC2 instances. In the next article I present 7 other documents that can be used when AWS-RunShellScript or AWS-RunPowerShellScript are not allowed.\nLink: https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/\nTalks and presentations\nIn 2022 I gave my first talk and since then I was motivated to speak and present at security conferences or focus meetings.\nElevating Access: A Methodical Approach to Privilege Escalation in AWS (2024)\nIn this talk I show my methodology, techniques and tips from over 2 years of cloud projects where I searched and accomplished multiple and all kinds of privilege escalation vectors.\nPresented at:\n\nDefCamp Cluj-Napoca edition (Romania): https://www.youtube.com/watch?v=XTKtjhn3Dwc\n\nAWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\nIn this presentation I show the research done with Matei Josephs where we filtered and scanned over 3.1 public AMIs from all AWS regions. The talk shows how we managed to find a solution for mass scanning the AMIs along with the funny and not so funny results and conclusions we managed to gather.\nPresented at:\n\nHacknet Barcelona edition (Spain): no recording available\n\nDEF CON 32: https://www.youtube.com/watch?v=7k3zOylPKbM\n\nNo Hat 2024: https://www.youtube.com/watch?v=QYTXMJScZZk\n\n\nCloud Security: Transitioning from Reactivity to Proactivity (2024)\nThis presentation was given for the Romanian chapter of Cloud Security Alliance. Here I talk about the importance of cloud security, how cloud can also mean Kubernetes and CI/CD, and showed some examples of misconfigurations inspired by engagements.\nLink: https://www.youtube.com/watch?v=TVWCs401VIk\nhttps://www.youtube.com/watch?v=TVWCs401VIk\n \nThe C2 tool no one talks about: AWS SSM - Run Command (2023)\nThis talk is about how the feature Run Command from the service Systems Manager (SSM) can be used as a perfect C2 tool, even if you don't have network connectivity to the instance or even if the instance is private altogether. The talk is a deep dive in how this feature can be used offensively, presenting 7 lesser-known documents for RCE along with a tool I developed called EC2StepShell.\nPresented at:\n\nSecurity Fest Sweden: https://www.youtube.com/watch?v=cn7XLaGmmCg\n\nhttps://www.youtube.com/watch?v=cn7XLaGmmCg\n \n\nRSTCon #3 (in Romanian): https://www.youtube.com/watch?v=6Wymc9US4Ik\n\nDefCamp Romania: https://www.youtube.com/watch?v=SKXzwDy4vkw\n\n\nCloud Configuration Review â The new internal pentest (2022)\nThis talk is about how the mentality around cloud security is the same as the old mentality about internal penetration testing. Meaning that, if something is in my internal network that can't be accessed by anyone from the internet, then I don't need to worry about it. As we know now, you should worry about the systems in your internal network and this mentality should be applied to cloud environments as well.\nPresented at DefCamp Romania:\nLink: https://www.youtube.com/watch?v=eyIQ82vvGLk\nhttps://www.youtube.com/watch?v=eyIQ82vvGLk\n \nCVEs, tools an"])</script>
140<script>self.__next_f.push([1,"d other articles\nCVEs\nCVE-2023-51946\n\nMultiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.\n\nCVE-2023-51947\n\nImproper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.\n\nCVE-2023-51948\n\nA Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.\n\nTools\nCloudShovel\n\nA tool for scanning public or private AMIs for sensitive files and secrets. The tool follows the research made on AWS CloudQuarry where we scanned 20k+ public AMIs.\n\nhttps://github.com/saw-your-packet/CloudShovel\n \nEC2StepShell\n\nEC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.\n\nhttps://github.com/saw-your-packet/EC2StepShell\n \nfun-with-ssm\n\nA repository with resources for AWS post-exploitation scenarios where you have the permission ssm:SendCommand, but you can't use the AWS-RunPowerShellScript or AWS-RunShellScript documents.\n\nhttps://github.com/saw-your-packet/fun-with-ssm\n \nOther articles\nSince June 2024 this is my official blogging platform, but I wrote in the past on securitycafe.ro a series of articles:\n\nAWS CloudQuarry: Digging for Secrets in Public AMIs\n\nIAMActionHunter in action\n\n7 lesser-known AWS SSM Document techniques for code execution\n\nEC2StepShell: A Tool for Getting Reverse Shells on Instances with Network Restrictions\n\nAWS ssm:SendCommand or network agnostic built-in RCE as root\n\nAWS Enumeration â Part II (Practical enumeration)\n\nAWS Enumeration â Part I (Where to start, Approaches and Tools)\n\nWeb Cache Deception attacks\n\nSecurity Source Code Review â Manual Approaches\n\n\nGet in touch\nI'm open for collaborations, workshops on cloud security, mentoring and chatting. Feel free to reach me out on my social media accounts or via email ð¤\n\nLinkedIn\n\nTwitter/X\n\n\nThanks for being here,\nEduard Agavriloae\nb:[\"$\",\"main\",null,{\"className\":\"min-h-screen bg-transparent\",\"children\":[[\"$\",\"$L16\",null,{\"publication\":{\"__typename\":\"Publication\",\"id\":\"665727bdd988544d622ac402\",\"url\":\"https://hacktodef.com\",\"canonicalURL\":\"https://hacktodef.com\",\"urlPattern\":\"simple\",\"title\":\"Hack to Def | From Offense to Defense\",\"displayTitle\":\"Hack to Def | From Offense to Defense\",\"hasBadges\":true,\"descriptionSEO\":\"Security researcher on a mission to help defenders fortify their environment by revealing how hackers can breach it.\",\"seo\":{\"title\":null,\"description\":\"Security researcher on a mission to help defenders fortify their environment by revealing how hackers can breach it.\",\"__typename\":\"SEO\"},\"publicMembers\":{\"totalDocuments\":1,\"__typename\":\"PublicMembers\"},\"about\":{\"html\":\"\u003cp\u003eSecurity researcher helping defenders fortify their environment by revealing how hackers can breach it.\u003c/p\u003e\\n\",\"text\":\"Security researcher helping defenders fortify their environment by revealing how hackers can breach it.\\n\",\"__typename\":\"Content\"},\"features\":{\"proTeam\":{\"isEnabled\":false,\"__typename\":\"ProTeamFeature\"},\"newsletter\":{\"isEnabled\":true,\"__typename\":\"NewsletterFeature\"},\"viewCount\":{\"isEnabled\":true,\"__typename\":\"ViewCountFeature\"},\"readTime\":{\"isEnabled\":true,\"__typename\":\"ReadTimeFeature\"},\"textSelectionSharer\":{\"isEnabled\":true,\"__typename\":\"TextSelectionSharerFeature\"},\"gptBotCrawling\":{\"__typename\":\"GPTBotCrawlingFeature\",\"isEnabled\":false},\"headlessCMS\":{\"isEnabled\":false,\"__typename\":\"HeadlessCMSFeature\"},\"__typename\":\"PublicationFeatures\"},\"aeoSettings\":{\"isEnabled\":false,\"llmsTxtEnabled\":true,\"crawlers\":{\"gptBot\":false,\"claudeBot\":true,\"perplexityBot\":true,\"googleExtended\":true,\"ccBot\":true,\"__typename\":\"AeoCrawlerSettings\"},\"__typename\":\"PublicationAeoSettings\"},\"metaTags\":null,\"ogMetaData\":{\"image\":\"https://cdn.hashnode.com/res/hashnode/image/upload/v1732563090516/7285708a-af7c-49b0-bd47-81377431b02f.png\",\"__typename\":\"OpenGra
140phMetaData\"},\"author\":{\"_"])</script>
140<script>self.__next_f.push([1,"_typename\":\"User\",\"id\":\"665626215dbc89ee6ba91d9d\",\"name\":\"Eduard Agavriloae\",\"username\":\"sawyourpacket\",\"profilePicture\":\"https://cdn.hashnode.com/res/hashnode/image/upload/v1717187169032/MPGsCKbCD.jpg\"},\"preferences\":{\"__typename\":\"PublicationPreferences\",\"logo\":\"https://cdn.hashnode.com/res/hashnode/image/upload/v1732563575464/38253db2-ea15-4ab6-a59f-995aec73fe71.png\",\"darkMode\":{\"__typename\":\"DarkModePreferences\",\"logo\":\"https://cdn.hashnode.com/res/hashnode/image/upload/v1732563525621/a1797410-b74c-4760-8556-c9e0f775b2af.png\",\"enabled\":true},\"navbarItems\":[{\"__typename\":\"PublicationNavbarItem\",\"id\":\"665772a538cf0395dcfee406\",\"label\":\"/whoami\",\"url\":null,\"type\":\"page\",\"series\":null,\"page\":{\"__typename\":\"StaticPage\",\"id\":\"66576397d988544d622d1123\",\"slug\":\"about\"}}],\"enabledPages\":{\"__typename\":\"EnabledPages\",\"badges\":false,\"newsletter\":true,\"members\":true},\"layout\":\"magazine\",\"disableFooterBranding\":true,\"isSubscriptionModalDisabled\":false},\"favicon\":\"https://cdn.hashnode.com/res/hashnode/image/upload/v1732562850169/c6e20e96-2306-490d-bdc7-e16bbdde88c3.png\",\"headerColor\":\"#1e0a39\",\"integrations\":{\"fbPixelID\":null,\"fathomSiteID\":null,\"fathomCustomDomainEnabled\":false,\"fathomCustomDomain\":null,\"hotjarSiteID\":null,\"matomoSiteID\":null,\"matomoURL\":null,\"gaTrackingID\":null,\"gTagManagerID\":null,\"plausibleAnalyticsEnabled\":false,\"wmPaymentPointer\":null,\"koalaPublicKey\":null,\"msClarityID\":null,\"openPanelClientId\":null,\"consentManagement\":{\"enabled\":false,\"version\":1,\"privacyPolicyURL\":null,\"__typename\":\"ConsentManagement\"},\"__typename\":\"PublicationIntegrations\"},\"imprintV2\":null,\"postsCount\":{\"totalDocuments\":1,\"__typename\":\"PostConnection\"},\"isTeam\":true,\"links\":{\"twitter\":\"https://twitter.com/saw_your_packet\",\"instagram\":null,\"github\":\"https://github.com/saw-your-packet\",\"website\":null,\"hashnode\":\"https://hashnode.com/@sawyourpacket\",\"youtube\":null,\"dailydev\":null,\"linkedin\":\"https://www.linkedin.com/in/eduard-k-agavriloae/\",\"mastodon\":null,\"facebook\":null,\"bluesky\":null,\"__typename\":\"PublicationLinks\"},\"domainInfo\":{\"__typename\":\"DomainInfo\",\"hashnodeSubdomain\":\"sawyourpacket\",\"domain\":{\"__typename\":\"Domain\",\"host\":\"hacktodef.com\",\"ready\":true},\"wwwPrefixedDomain\":{\"__typename\":\"Domain\",\"host\":\"www.hacktodef.com\",\"ready\":true}},\"redirectionRules\":[],\"customRules\":[],\"totalRecommendedPublications\":0,\"allowContributorEdits\":true,\"staticPage\":{\"id\":\"66576397d988544d622d1123\",\"slug\":\"about\",\"title\":\"/whoami\",\"content\":{\"html\":\"$17\",\"markdown\":\"$18\",\"text\":\"$19\",\"__typename\":\"Content\"},\"hidden\":false,\"ogMetaData\":{\"image\":\"https://cdn.hashnode.com/res/hashnode/image/upload/v1717003033353/ROalVUiQ5.jpg\",\"__typename\":\"OpenGraphMetaData\"},\"seo\":{\"title\":\"/whoami\",\"description\":\"Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\",\"__typename\":\"SEO\"},\"__typename\":\"StaticPage\"}},\"posts\":[],\"host\":\"hacktodef.com\"}],\"$L1a\",\"$L1b\",\"$L1c\"]}]\n1d:T327d,\u003ch2 id=\"heading-welcome\"\u003eWelcome!\u003c/h2\u003e\n\u003cp\u003eWelcome to HackToDef.com! Iâm Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\u003c/p\u003e\n\u003cp\u003eThis is what \u003ccode\u003eHack to Def\u003c/code\u003e is about. Showing relevant offensive techniques and how to defend against them.\u003c/p\u003e\n\u003ch2 id=\"heading-background\"\u003eBackground\u003c/h2\u003e\n\u003cp\u003eI'm learning and practicing offensive cybersecurity since 2017 and I've never been bored ever since.\u003c/p\u003e\n\u003cp\u003eI started in 2023 to do Cloud Security Research, I worked as a penetration tester for over 4 years, I have a Master's Degree in cybersecurity and I worked as a Web Developer for 3 years.\u003c/p\u003e\n\u003cp\u003eI have extensive experience with Cloud Security (mostly AWS and focused on offensive), Web Application Security, Network Penetration Testing and Security Source Code Review. Along the way I got a few certifications such as OSCP, AWS Security Specialty, GIAC Cloud Penetration Tester and Certified Hybrid Multi-Cloud Red Team Specialist.\u003c/p\u003e\n\u003ch2 id=\"heading-research\"\u003eResearch"])</script>
140<script>self.__next_f.push([1,"\u003c/h2\u003e\n\u003ch3 id=\"heading-aws-cloudquarry-digging-for-secrets-in-public-amis-2024\"\u003eAWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\u003c/h3\u003e\n\u003cp\u003eMoney, secrets and mass exploitation: This research done in collaboration with Matei Josephs unveils a quarry of sensitive data stored in public AMIs. Digging through each AMI we managed to collect 500 GB of credentials, private repositories, access keys and more. The next article is the detailed analysis of how we did it and what the data represents.\u003c/p\u003e\n\u003cp\u003eFor this research we did a coordinated disclosure with AWSâs security team before publishing the article.\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/\" rel=\"noopener ugc\"\u003ehttps://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/\u003c/a\u003e\u003c/p\u003e\n\u003ch3 id=\"heading-7-lesser-known-aws-ssm-document-techniques-for-code-execution-2023\"\u003e7 lesser-known AWS SSM Document techniques for code execution (2023)\u003c/h3\u003e\n\u003cp\u003eThis research is a deep dive into AWS SSM Run Command which shows that there are multiple documents attackers can use for executing code remotely on EC2 instances. In the next article I present 7 other documents that can be used when AWS-RunShellScript or AWS-RunPowerShellScript are not allowed.\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/\" rel=\"noopener ugc\"\u003ehttps://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"heading-talks-and-presentations\"\u003eTalks and presentations\u003c/h2\u003e\n\u003cp\u003eIn 2022 I gave my first talk and since then I was motivated to speak and present at security conferences or focus meetings.\u003c/p\u003e\n\u003ch3 id=\"heading-elevating-access-a-methodical-approach-to-privilege-escalation-in-aws-2024\"\u003eElevating Access: A Methodical Approach to Privilege Escalation in AWS (2024)\u003c/h3\u003e\n\u003cp\u003eIn this talk I show my methodology, techniques and tips from over 2 years of cloud projects where I searched and accomplished multiple and all kinds of privilege escalation vectors.\u003c/p\u003e\n\u003cp\u003ePresented at:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDefCamp Cluj-Napoca edition (Romania): \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=XTKtjhn3Dwc\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=XTKtjhn3Dwc\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"heading-aws-cloudquarry-digging-for-secrets-in-public-amis-2024-1\"\u003eAWS CloudQuarry: Digging for Secrets in Public AMIs (2024)\u003c/h3\u003e\n\u003cp\u003eIn this presentation I show the research done with Matei Josephs where we filtered and scanned over 3.1 public AMIs from all AWS regions. The talk shows how we managed to find a solution for mass scanning the AMIs along with the funny and not so funny results and conclusions we managed to gather.\u003c/p\u003e\n\u003cp\u003ePresented at:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eHacknet Barcelona edition (Spain): no recording available\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDEF CON 32: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=7k3zOylPKbM\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=7k3zOylPKbM\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eNo Hat 2024: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=QYTXMJScZZk\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=QYTXMJScZZk\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"heading-cloud-security-transitioning-from-reactivity-to-proactivity-2024\"\u003eCloud Security: Transitioning from Reactivity to Proactivity (2024)\u003c/h3\u003e\n\u003cp\u003eThis presentation was given for the Romanian chapter of Cloud Security Alliance. Here I talk about the importance of cloud security, how cloud can also mean Kubernetes and CI/CD, and showed some examples of misconfigurations inspired by engagements.\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=TVWCs401VIk\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=TVWCs401VIk\u003c/a\u003e\u003c/p\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://www.youtube.com/watch?v=TVWCs401VIk\" target=\"_blank\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=TVWCs401VIk\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch"])</script>
140<script>self.__next_f.push([1,"3 id=\"heading-the-c2-tool-no-one-talks-about-aws-ssm-run-command-2023\"\u003eThe C2 tool no one talks about: AWS SSM - Run Command (2023)\u003c/h3\u003e\n\u003cp\u003eThis talk is about how the feature Run Command from the service Systems Manager (SSM) can be used as a perfect C2 tool, even if you don't have network connectivity to the instance or even if the instance is private altogether. The talk is a deep dive in how this feature can be used offensively, presenting 7 lesser-known documents for RCE along with a tool I developed called EC2StepShell.\u003c/p\u003e\n\u003cp\u003ePresented at:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSecurity Fest Sweden: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=cn7XLaGmmCg\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=cn7XLaGmmCg\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://www.youtube.com/watch?v=cn7XLaGmmCg\" target=\"_blank\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=cn7XLaGmmCg\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eRSTCon #3 (in Romanian): \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=6Wymc9US4Ik\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=6Wymc9US4Ik\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDefCamp Romania: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=SKXzwDy4vkw\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=SKXzwDy4vkw\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"heading-cloud-configuration-review-the-new-internal-pentest-2022\"\u003eCloud Configuration Review â The new internal pentest (2022)\u003c/h3\u003e\n\u003cp\u003eThis talk is about how the mentality around cloud security is the same as the old mentality about internal penetration testing. Meaning that, if something is in my internal network that can't be accessed by anyone from the internet, then I don't need to worry about it. As we know now, you should worry about the systems in your internal network and this mentality should be applied to cloud environments as well.\u003c/p\u003e\n\u003cp\u003ePresented at DefCamp Romania:\u003c/p\u003e\n\u003cp\u003eLink: \u003ca target=\"_blank\" href=\"https://www.youtube.com/watch?v=eyIQ82vvGLk\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=eyIQ82vvGLk\u003c/a\u003e\u003c/p\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://www.youtube.com/watch?v=eyIQ82vvGLk\" target=\"_blank\" rel=\"noopener ugc\"\u003ehttps://www.youtube.com/watch?v=eyIQ82vvGLk\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch2 id=\"heading-cves-tools-and-other-articles\"\u003eCVEs, tools and other articles\u003c/h2\u003e\n\u003ch3 id=\"heading-cves\"\u003eCVEs\u003c/h3\u003e\n\u003cp\u003e\u003ca target=\"_blank\" href=\"https://github.com/advisories/GHSA-hv3m-r794-pg43\" rel=\"noopener ugc\"\u003eCVE-2023-51946\u003c/a\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eMultiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003ca target=\"_blank\" href=\"https://github.com/advisories/GHSA-2cq5-qqj9-pr9m\" rel=\"noopener ugc\"\u003eCVE-2023-51947\u003c/a\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eImproper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003ca target=\"_blank\" href=\"https://github.com/advisories/GHSA-99vg-whp9-cxq4\" rel=\"noopener ugc\"\u003eCVE-2023-51948\u003c/a\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eA Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3 id=\"heading-tools\"\u003eTools\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eCloudShovel\u003c/strong\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eA tool for scanning public or private AMIs for sensitive files and secrets. The tool follows the research made on AWS CloudQuarry where we scanned 20k+ public AMIs.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://github.com/saw-your-packet/CloudShovel\" target=\"_blank\" rel=\"noopener ugc\"\u003ehttps://github.com/saw-your-packet/CloudShovel\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch4 i"])</script>
140<script>self.__next_f.push([1,"d=\"heading-ec2stepshell\"\u003eEC2StepShell\u003c/h4\u003e\n\u003cblockquote\u003e\n\u003cp\u003eEC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://github.com/saw-your-packet/EC2StepShell\" target=\"_blank\" rel=\"noopener ugc\"\u003ehttps://github.com/saw-your-packet/EC2StepShell\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch4 id=\"heading-fun-with-ssm\"\u003efun-with-ssm\u003c/h4\u003e\n\u003cblockquote\u003e\n\u003cp\u003eA repository with resources for AWS post-exploitation scenarios where you have the permission ssm:SendCommand, but you can't use the AWS-RunPowerShellScript or AWS-RunShellScript documents.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cdiv class=\"embed-wrapper\"\u003e\u003cdiv class=\"embed-loading\"\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003cdiv class=\"loadingRow\"\u003e\u003c/div\u003e\u003c/div\u003e\u003ca class=\"embed-card\" href=\"https://github.com/saw-your-packet/fun-with-ssm\" target=\"_blank\" rel=\"noopener ugc\"\u003ehttps://github.com/saw-your-packet/fun-with-ssm\u003c/a\u003e\u003c/div\u003e\n\u003cp\u003e \u003c/p\u003e\n\u003ch3 id=\"heading-other-articles\"\u003eOther articles\u003c/h3\u003e\n\u003cp\u003eSince June 2024 this is my official blogging platform, but I wrote in the past on securitycafe.ro a series of articles:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/\" rel=\"noopener ugc\"\u003eAWS CloudQuarry: Digging for Secrets in Public AMIs\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/07/27/iamactionhunter-in-action/\" rel=\"noopener ugc\"\u003eIAMActionHunter in action\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/04/19/7-lesser-known-aws-ssm-document-techniques-for-code-execution/\" rel=\"noopener ugc\"\u003e7 lesser-known AWS SSM Document techniques for code execution\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/03/08/ec2stepshell-reverse-shells-private-ec2-instances/\" rel=\"noopener ugc\"\u003eEC2StepShell: A Tool for Getting Reverse Shells on Instances with Network Restrictions\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2023/01/17/aws-post-explitation-with-ssm-sendcommand/\" rel=\"noopener ugc\"\u003eAWS ssm:SendCommand or network agnostic built-in RCE as root\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/\" rel=\"noopener ugc\"\u003eAWS Enumeration â Part II (Practical enumeration)\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/11/01/aws-enumeration-part-1/\" rel=\"noopener ugc\"\u003eAWS Enumeration â Part I (Where to start, Approaches and Tools)\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/07/01/web-cache-deception-attacks/\" rel=\"noopener ugc\"\u003eWeb Cache Deception attacks\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://securitycafe.ro/2022/06/06/security-source-code-review-manual-approaches/\" rel=\"noopener ugc\"\u003eSecurity Source Code Review â Manual Approaches\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"heading-get-in-touch\"\u003eGet in touch\u003c/h2\u003e\n\u003cp\u003eI'm open for collaborations, workshops on cloud security, mentoring and chatting. Feel free to reach me out on my s
140ocial media accounts or via email ð¤\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://www.linkedin.com/in/eduard-k-agavriloae/\" rel=\"noopener ugc\"\u003eLinkedIn\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" href=\"https://twitter.com/saw_your_packet\" rel=\"noopener ugc\"\u003eTwitter/X\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks for being here,\u003c/p\u003e\n\u003cp\u003e\u003ca class=\"user-mention\" href=\"https://hashnode.com/@sawyourpacket\" target=\"_blank\" rel=\"noopener ugc\"\u003eEduard Agavriloae\u003c/a\u003e\u003c/p\u003e\n1a:[\"$\",\"section\",null,{\"className\":\"pt-10 pb-16\",\"children\":[\"$\",\"div\",null,{\"className\":\"px-4 sm:px-8\",\"children\":[\"$\",\"div\",null,{\"className\":\"w-full xl:mx-auto xl:max-w-[80rem] 2xl:max-w-[90rem]\",\"children\":[\"$\",\"article\",null,{\"className\":\"w-full rounded-xl border bg-card text-card-foreground\",\"children\":[\"$\",\"div\",null,{\"className\":\"space-y-12 px-6 sm:px-10 pt-12 sm:pt-14 pb-10\",\"children\":[[\"$\",\"header\",null,{\"className\":\"space-y-"])</script>
140<script>self.__next_f.push([1,"4 text-center max-w-4xl mx-auto\",\"children\":[[\"$\",\"h1\",null,{\"className\":\"text-4xl md:text-5xl font-bold text-balance text-foreground transition-colors\",\"children\":\"/whoami\"}],\"$undefined\"]}],[\"$\",\"div\",null,{\"className\":\"prose dark:prose-invert prose-pre:bg-foreground prose-pre:text-background prose-pre:border prose-pre:border-border prose-pre:rounded prose-pre:px-5 prose-pre:py-4 dark:prose-pre:bg-muted dark:prose-pre:text-foreground dark:prose-pre:border-border max-w-3xl mx-auto text-base [\u0026\u003ediv\u003ep:first-child]:mt-0 [\u0026\u003ediv\u003ep:first-child]:pt-0 min-w-0\",\"children\":[\"$\",\"article\",null,{\"className\":\"space-y-6\",\"children\":[false,[\"$\",\"div\",null,{\"className\":\"prose prose-slate prose-pre:bg-foreground prose-pre:text-background prose-pre:border prose-pre:border-border prose-pre:rounded prose-pre:px-5 prose-pre:py-4 dark:prose-invert dark:prose-pre:bg-muted dark:prose-pre:text-foreground dark:prose-pre:border-border max-w-3xl mx-auto text-base lg:prose-lg [\u0026\u003ediv\u003ep:first-child]:mt-0 [\u0026\u003ediv\u003ep:first-child]:pt-0\",\"children\":[\"$\",\"div\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"$1d\"}}]}]]}]}]]}]}]}]}]}]\n1b:[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"WebPage\\\",\\\"name\\\":\\\"/whoami\\\",\\\"url\\\":\\\"https://hacktodef.com/page/about\\\",\\\"mainEntityOfPage\\\":{\\\"@type\\\":\\\"WebPage\\\",\\\"url\\\":\\\"https://hacktodef.com/page/about\\\"},\\\"publisher\\\":{\\\"@type\\\":\\\"Organization\\\",\\\"name\\\":\\\"Hack to Def | From Offense to Defense\\\",\\\"url\\\":\\\"https://hacktodef.com\\\",\\\"logo\\\":\\\"https://cdn.hashnode.com/res/hashnode/image/upload/v1732563575464/38253db2-ea15-4ab6-a59f-995aec73fe71.png\\\"},\\\"description\\\":\\\"Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\\\",\\\"image\\\":{\\\"@type\\\":\\\"ImageObject\\\",\\\"url\\\":\\\"https://cdn.hashnode.com/res/hashnode/image/upload/v1717003033353/ROalVUiQ5.jpg\\\"}}\"}}]\n1e:I[52619,[\"4554\",\"static/chunks/4554-984b480a9db5f3fe.js\",\"7563\",\"static/chunks/7563-4dfa0994a9b0e37c.js\",\"5001\",\"static/chunks/5001-fae0bebdd93f95e3.js\",\"2423\",\"static/chunks/2423-c8b1388240338d7d.js\",\"3091\",\"static/chunks/3091-bf1537ff6571a1bd.js\",\"652\",\"static/chunks/652-f40dcb480b4e356f.js\",\"6304\",\"static/chunks/app/page/%5Bslug%5D/page-8ebcb2eac05645c5.js\"],\"\"]\n1c:[\"$\",\"footer\",null,{\"className\":\"px-4 pt-8 pb-20 sm:px-8 text-muted-foreground\",\"aria-label\":\"Footer\",\"children\":[\"$\",\"div\",null,{\"className\":\"w-full max-w-4xl mx-auto\",\"children\":[\"$\",\"div\",null,{\"className\":\"flex flex-col items-center gap-4 text-center text-sm\",\"children\":[false,[\"$\",\"p\",null,{\"className\":\"font-medium\",\"children\":[[\"$\",\"time\",null,{\"dateTime\":\"2026\",\"children\":[[\"$\",\"span\",null,{\"className\":\"font-sans\",\"children\":\"©\"}],\" \",2026]}],\" \",\"Hack to Def | From Offense to Defense\"]}],[\"$\",\"nav\",null,{\"aria-label\":\"Footer navigation\",\"children\":[\"$\",\"ul\",null,{\"className\":\"flex flex-wrap justify-center gap-4 text-sm tracking-wide\",\"children\":[[\"$\",\"li\",\"/members\",{\"children\":[\"$\",\"$L1e\",null,{\"href\":\"/members\",\"className\":\"transition hover:text-foreground\",\"target\":\"$undefined\",\"rel\":\"$undefined\",\"children\":\"Members\"}]}],[\"$\",\"li\",\"/archive\",{\"children\":[\"$\",\"$L1e\",null,{\"href\":\"/archive\",\"className\":\"transition hover:text-foreground\",\"target\":\"$undefined\",\"rel\":\"$undefined\",\"children\":\"Archive\"}]}],[\"$\",\"li\",\"https://hashnode.com/privacy-policy\",{\"children\":[\"$\",\"$L1e\",null,{\"href\":\"https://hashnode.com/privacy-policy\",\"className\":\"transition hover:text-foreground\",\"target\":\"_blank\",\"rel\":\"noopener\",\"children\":\"Privacy\"}]}],[\"$\",\"li\",\"https://hashnode.com/terms\",{\"children\":[\"$\",\"$L1e\",null,{\"href\":\"https://hashnode.com/terms\",\"className\":\"transition hover:text-foreground\",\"target\":\"_blank\",\"rel\":\"noopener\",\"children\":\"Terms\"}]}]]}]}],[\"$\",\"div\",null,{\"className\":\"pt-8 flex justify-center gap-6\",\"children\":[[\"$\",\"$L1e\",null,{\"href\":\"/sitemap.xml\",\"target\":\"_blank\",\"rel\":\"noopener\",\"className\":\"flex items-center gap-2 text-sm transition hover:text-foreground\",\"title\":\"Sitemap\",\"ch"])</script>
140<script>self.__next_f.push([1,"ildren\":[[\"$\",\"i\",null,{\"className\":\"fa-regular fa-sitemap\"}],[\"$\",\"span\",null,{\"children\":\"Sitemap\"}]]}],[\"$\",\"$L1e\",null,{\"href\":\"/rss.xml\",\"target\":\"_blank\",\"rel\":\"noopener\",\"className\":\"flex items-center gap-2 text-sm transition hover:text-foreground\",\"title\":\"RSS Feed\",\"children\":[[\"$\",\"i\",null,{\"className\":\"fa-regular fa-rss\"}],[\"$\",\"span\",null,{\"children\":\"RSS\"}]]}]]}],false]}]}]}]\n"])</script>
140<script>self.__next_f.push([1,"1f:I[80622,[],\"IconMark\"]\n"])</script>
140<script>self.__next_f.push([1,"f:{\"metadata\":[[\"$\",\"title\",\"0\",{\"children\":\"/whoami\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\"}],[\"$\",\"link\",\"2\",{\"rel\":\"canonical\",\"href\":\"https://hacktodef.com/page/about\"}],[\"$\",\"meta\",\"3\",{\"property\":\"og:title\",\"content\":\"/whoami\"}],[\"$\",\"meta\",\"4\",{\"property\":\"og:description\",\"content\":\"Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\"}],[\"$\",\"meta\",\"5\",{\"property\":\"og:url\",\"content\":\"https://hacktodef.com/page/about\"}],[\"$\",\"meta\",\"6\",{\"property\":\"og:site_name\",\"content\":\"Hack to Def | From Offense to Defense\"}],[\"$\",\"meta\",\"7\",{\"property\":\"og:image\",\"content\":\"https://hacktodef.com/api/og/page?og=eyJhdXRob3IiOiJFZHVhcmQlMjBBZ2F2cmlsb2FlIiwiaXNEZWZhdWx0TW9kZURhcmsiOnRydWUsImRvbWFpbiI6ImhhY2t0b2RlZi5jb20iLCJ0aXRsZSI6IiUyRndob2FtaSIsInBob3RvIjoiaHR0cHM6Ly9jZG4uaGFzaG5vZGUuY29tL3Jlcy9oYXNobm9kZS9pbWFnZS91cGxvYWQvdjE3MTcxODcxNjkwMzIvTVBHc0NLYkNELmpwZyIsImxvZ28iOiJodHRwczovL2Nkbi5oYXNobm9kZS5jb20vcmVzL2hhc2hub2RlL2ltYWdlL3VwbG9hZC92MTczMjU2MzU3NTQ2NC8zODI1M2RiMi1lYTE1LTRhYjYtYTU5Zi05OTVhZWM3M2ZlNzEucG5nIiwiZmF2aWNvbiI6Imh0dHBzOi8vY2RuLmhhc2hub2RlLmNvbS9yZXMvaGFzaG5vZGUvaW1hZ2UvdXBsb2FkL3YxNzMyNTYyODUwMTY5L2M2ZTIwZTk2LTIzMDYtNDkwZC1iZGM3LWUxNmJiZGRlODhjMy5wbmcifQ==\"}],[\"$\",\"meta\",\"8\",{\"property\":\"og:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"9\",{\"property\":\"og:image:height\",\"content\":\"630\"}],[\"$\",\"meta\",\"10\",{\"property\":\"og:type\",\"content\":\"website\"}],[\"$\",\"meta\",\"11\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"12\",{\"name\":\"twitter:creator\",\"content\":\"https://twitter.com/saw_your_packet\"}],[\"$\",\"meta\",\"13\",{\"name\":\"twitter:title\",\"content\":\"/whoami\"}],[\"$\",\"meta\",\"14\",{\"name\":\"twitter:description\",\"content\":\"Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them.\"}],[\"$\",\"meta\",\"15\",{\"name\":\"twitter:image\",\"content\":\"https://hacktodef.com/api/og/page?og=eyJhdXRob3IiOiJFZHVhcmQlMjBBZ2F2cmlsb2FlIiwiaXNEZWZhdWx0TW9kZURhcmsiOnRydWUsImRvbWFpbiI6ImhhY2t0b2RlZi5jb20iLCJ0aXRsZSI6IiUyRndob2FtaSIsInBob3RvIjoiaHR0cHM6Ly9jZG4uaGFzaG5vZGUuY29tL3Jlcy9oYXNobm9kZS9pbWFnZS91cGxvYWQvdjE3MTcxODcxNjkwMzIvTVBHc0NLYkNELmpwZyIsImxvZ28iOiJodHRwczovL2Nkbi5oYXNobm9kZS5jb20vcmVzL2hhc2hub2RlL2ltYWdlL3VwbG9hZC92MTczMjU2MzU3NTQ2NC8zODI1M2RiMi1lYTE1LTRhYjYtYTU5Zi05OTVhZWM3M2ZlNzEucG5nIiwiZmF2aWNvbiI6Imh0dHBzOi8vY2RuLmhhc2hub2RlLmNvbS9yZXMvaGFzaG5vZGUvaW1hZ2UvdXBsb2FkL3YxNzMyNTYyODUwMTY5L2M2ZTIwZTk2LTIzMDYtNDkwZC1iZGM3LWUxNmJiZGRlODhjMy5wbmcifQ==\"}],[\"$\",\"link\",\"16\",{\"rel\":\"icon\",\"href\":\"https://cdn.hashnode.com/res/hashnode/image/upload/v1732562850169/c6e20e96-2306-490d-bdc7-e16bbdde88c3.png\"}],[\"$\",\"$L1f\",\"17\",{}]],\"error\":null,\"digest\":\"$undefined\"}\n14:\"$f:metadata\"\n"])</script>
140<title>/whoami</title><meta name="description" content="Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them."/><link rel="canonical" href="https://hacktodef.com/page/about"/><meta property="og:title" content="/whoami"/><meta property="og:description" content="Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them."/><meta property="og:url" content="https://hacktodef.com/page/about"/><meta property="og:site_name" content="Hack to Def | From Offense to Defense"/><meta property="og:image" content="https://hacktodef.com/api/og/page?og=eyJhdXRob3IiOiJFZHVhcmQlMjBBZ2F2cmlsb2FlIiwiaXNEZWZhdWx0TW9kZURhcmsiOnRydWUsImRvbWFpbiI6ImhhY2t0b2RlZi5jb20iLCJ0aXRsZSI6IiUyRndob2FtaSIsInBob3RvIjoiaHR0cHM6Ly9jZG4uaGFzaG5vZGUuY29tL3Jlcy9oYXNobm9kZS9pbWFnZS91cGxvYWQvdjE3MTcxODcxNjkwMzIvTVBHc0NLYkNELmpwZyIsImxvZ28iOiJodHRwczovL2Nkbi5oYXNobm9kZS5jb20vcmVzL2hhc2hub2RlL2ltYWdlL3VwbG9hZC92MTczMjU2MzU3NTQ2NC8zODI1M2RiMi1lYTE1LTRhYjYtYTU5Zi05OTVhZWM3M2ZlNzEucG5nIiwiZmF2aWNvbiI6Imh0dHBzOi8vY2RuLmhhc2hub2RlLmNvbS9yZXMvaGFzaG5vZGUvaW1hZ2UvdXBsb2FkL3YxNzMyNTYyODUwMTY5L2M2ZTIwZTk2LTIzMDYtNDkwZC1iZGM3LWUxNmJiZGRlODhjMy5wbmcifQ=="/><meta property="og:image:width" content="1200"/><meta property="og:image:height" content="630"/><meta property="og:type" content="website"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:creator" content="https://twitter.com/saw_your_packet"/><meta name="twitter:title" content="/whoami"/><meta name="twitter:description" content="Meet the author of HackToDef.com, Eduard Agavriloae, a dedicated security researcher on a mission to help defenders fortify their environments by revealing how hackers can breach them."/><meta name="twitter:image" content="https://hacktodef.com/api/og/page?og=eyJhdXRob3IiOiJFZHVhcmQlMjBBZ2F2cmlsb2FlIiwiaXNEZWZhdWx0TW9kZURhcmsiOnRydWUsImRvbWFpbiI6ImhhY2t0b2RlZi5jb20iLCJ0aXRsZSI6IiUyRndob2FtaSIsInBob3RvIjoiaHR0cHM6Ly9jZG4uaGFzaG5vZGUuY29tL3Jlcy9oYXNobm9kZS9pbWFnZS91cGxvYWQvdjE3MTcxODcxNjkwMzIvTVBHc0NLYkNELmpwZyIsImxvZ28iOiJodHRwczovL2Nkbi5oYXNobm9kZS5jb20vcmVzL2hhc2hub2RlL2ltYWdlL3VwbG9hZC92MTczMjU2MzU3NTQ2NC8zODI1M2RiMi1lYTE1LTRhYjYtYTU5Zi05OTVhZWM3M2ZlNzEucG5nIiwiZmF2aWNvbiI6Imh0dHBzOi8vY2RuLmhhc2hub2RlLmNvbS9yZXMvaGFzaG5vZGUvaW1hZ2UvdXBsb2FkL3YxNzMyNTYyODUwMTY5L2M2ZTIwZTk2LTIzMDYtNDkwZC1iZGM3LWUxNmJiZGRlODhjMy5wbmcifQ=="/><link rel="icon" href="https://cdn.hashnode.com/res/hashnode/image/upload/v1732562850169/c6e20e96-2306-490d-bdc7-e16bbdde88c3.png"/>
140<script>document.querySelectorAll('body link[rel="icon"], body link[rel="apple-touch-icon"]').forEach(el => document.head.appendChild(el))</script>
140<div hidden id="S:1"></div>
140<script>$RB=[];$RV=function(a){$RT=performance.now();for(var b=0;b<a.length;b+=2){var c=a[b],e=a[b+1];null!==e.parentNode&&e.parentNode.removeChild(e);var f=c.parentNode;if(f){var g=c.previousSibling,h=0;do{if(c&&8===c.nodeType){var d=c.data;if("/$"===d||"/&"===d)if(0===h)break;else h--;else"$"!==d&&"$?"!==d&&"$~"!==d&&"$!"!==d&&"&"!==d||h++}d=c.nextSibling;f.removeChild(c);c=d}while(c);for(;e.firstChild;)f.insertBefore(e.firstChild,c);g.data="$";g._reactRetry&&requestAnimationFrame(g._reactRetry)}}a.length=0}; 141$RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a,b),2===$RB.length&&("number"!==typeof $RT?requestAnimationFrame($RV.bind(null,$RB)):(a=performance.now(),setTimeout($RV.bind(null,$RB),2300>a&&2E3<a?2300-a:$RT+300-a)))):b.parentNode.removeChild(b)};$RC("B:1","S:1")</script>
141<div hidden id="S:0"></div>
141<script>$RC("B:0","S:0")</script>
141</body></html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.