https://lulztigre.pw/ Stealth research blog exploring mechanistic interpretability, distributed consensus, and zero-knowledge cryptography. en-us Sun, 30 Aug 2026 19:30:45 GMT https://lulztigre.pw/posts/balbooa-forms-penny-rce-67363-67364.html https://lulztigre.pw/posts/balbooa-forms-penny-rce-67363-67364.html Sun, 30 Aug 2026 00:00:00 GMT While variant-hunting the pre-auth upload RCEs in Balbooa Forms, a line-by-line read of the shortcode engine and the payment tasks surfaced two separate flaws. The custom-PHP handler eval()s an unescaped query parameter behind a CSRF token that anyone can mint, and both payment endpoints charge the attacker-supplied total straight to Stripe and Authorize.net. This memo walks both code paths line by line, the MITM wire capture, and the disclosure to JSST. https://lulztigre.pw/posts/gravitino-test-connection-rce-41042.html https://lulztigre.pw/posts/gravitino-test-connection-rce-41042.html Mon, 17 Aug 2026 00:00:00 GMT While hunting an incomplete-fix pattern across Apache Gravitino's catalog REST surface, an unauthenticated testConnection endpoint surfaced that hands attacker-controlled jdbc-url strings to the connection factory with zero validation. This memo walks the patch diff, the variant sweep, and the first working PoC for CVE-2026-41042. https://lulztigre.pw/posts/dropoutjeep-the-phishing-simulator-that-refuses-to-drop-out.html https://lulztigre.pw/posts/dropoutjeep-the-phishing-simulator-that-refuses-to-drop-out.html Sat, 15 Aug 2026 00:00:00 GMT DropoutJeep is a phishing-simulation and red-team platform with 80-plus utility modules spanning OSINT, pretext generation, payload crafting, C2, exfiltration, evasion, persistence, and deliverability. This memo covers why it exists, why it keeps growing, and why its authors now read Gmail spam-filter documentation for fun. https://lulztigre.pw/posts/grandscream-phone-to-pbx-root.html https://lulztigre.pw/posts/grandscream-phone-to-pbx-root.html Sat, 15 Aug 2026 00:00:00 GMT One unauthenticated request against a Grandstream desk phone is enough to locate the PBX, fingerprint its firmware, and eventually own it, root shell included. This memo is the narrative of that chain: the leaks that pointed the way, the blind SQLi that gave up the password, and the credential reuse that collapsed three devices into one.