## https://sploitus.com/exploit?id=E10C9918-120D-5504-BD7A-2F3F135B14FD
# Publications
A home for publications, including slides/papers, proof-of-concepts, videos and tools.
For blog posts, see [the elttam blog](https://www.elttam.com/blog), and for our services, see [our website](https://www.elttam.com).
| Date | Type | Event | Title | Resources |
|------| ---- | ----- | ----- | --------- |
| 2024 | preso | BSides Canberra | Boot Security in the MCU | [repo](https://github.com/elttam/boot-security-in-the-mcu) |
| 2024 | preso | AISA CyberCon | The 7 Habits of Highly Mature Products | [pdf slides](./slides/Jamie%20-%20AISA%20Cybercon%202024%20-%20The%207%20Habits%20of%20Highly%20Mature%20Products.pdf) |
| 2024 | preso | Appsec and Devsecops Summit Melbourne | Adaptive Code Assisted Security Assessments | [pdf slides](./slides/Adaptive%20Code%20Assisted%20Security%20Assessments%20-%20Sep%202024.pdf) |
| 2024 | preso | Ruxmon Melbourne | Causing Funky Things in your NodeJS Servers | [pdf slides](./slides/Causing%20Funky%20Things%20in%20your%20NodeJS%20Web%20Servers.pdf) |
| 2024 | preso | CrikeyCon | Keeping up with the Pwnses: An overview of Talkback | [pdf slides](./slides/Keeping%20up%20with%20the%20Pwnses%20-%20CrikeyCon.pdf) |
| 2024 | adv | - | OTA Anti-Rollback Bypass via TOCTOU in ESP-IDF | [CVE-2024-28183.md](./writeups/CVE-2024-28183/CVE-2024-28183.md) [GHSA-22x6-3756-pfp8](https://github.com/espressif/esp-idf/security/advisories/GHSA-22x6-3756-pfp8) |
| 2023 | adv | - | Apache Guacamole: Integer overflow in handling of VNC image buffers | [CVE-2023-43826.md](./writeups/CVE-2023-43826.md) |
| 2023 | adv | - | STMicroelectronics STSAFE: I2C Receive buffer overflow | [CVE-2023-50096.md](./writeups/CVE-2023-50096.md) |
| 2023 | adv | - | Label Studio: Hardcoded Django SECRET_KEY that can be Abused to Forge Session Tokens | [CVE-2023-43791.md](./writeups/CVE-2023-43791.md) |
| 2023 | adv | - | Label Studio: Object Relational Mapper Leak Vulnerability in Filtering Task | [CVE-2023-47117.md](./writeups/CVE-2023-47117/CVE-2023-47117.md) |
| 2023 | adv | - | Drupal core: cache poisoning vulnerability | [CVE-2023-5256.md](./writeups/CVE-2023-5256.md) |
| 2023 | adv | - | Ruby on Rails: Possible XSS via User Supplied Values to redirect_to | [CVE-2023-28362](https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132) |
| 2023 | writeup | - | [RCE and other issues](https://www.elttam.com/blog/pwnassistant/) in Home Asisstant | [home-assistant](./writeups/home-assistant/) |
| 2023 | preso | Ruxmon Melbourne | Cracking the odd case of randomness in Java | [pdf slides](./slides/joseph-ruxmon-02_2023-cracking-the-odd-case-of-randomness-in-java.pdf) |
| 2022 | adv | - | Memory corruption in libksba | [CVE-2022-47629.md](./writeups/CVE-2022-47629.md) |
| 2022 | preso | Budapest Infosec Meetup | Airplane Hacking | [airplane-hacking.pdf](./slides/airplane-hacking.pdf) |
| 2022 | writeup | - | LFI in inkscape via SVG injection | [inkscape-xml.md](./writeups/inkscape-xml.md)
| 2021 | preso | Yascon | Canotary: How to find and bypass Canarytokens | [github.com](https://github.com/loltan/Canotary), [youtube.com](https://www.youtube.com/watch?v=hkuiuppJQDs&t=3002s) |
| 2021 | preso | ISACA Melbourne | IoT Security Assessment Insights | [pptx slides](./slides/Matt%20-%20ISACA%20Melb%202021%20-%20IoT%20Security%20Assessment%20Insights.pptx) |
| 2020 | adv | - | FreeBSD kernel fs info leaks | [cve-2020-25578.txt](./writeups/CVE-2020-25578.txt), [cve-2020-25579.txt](./writeups/CVE-2020-25579.txt) |
| 2020 | poc | - | Tuya IoT EZ Mode (Tuya Link) WiFi Credential Sniffer | [tuya-live-extract.py](./writeups/tuya-live-extract.py) |
| 2020 | preso | Airgap | haha v8 engine go brrrrr | [youtube.com](https://www.youtube.com/watch?v=i9O_vYQbZEo) |
| 2019 | preso | BSides Perth | Understanding the Chromium Sandbox on Windows | [pptx slides](./slides/Matt%20-%20Bsides%20Per%202019%20-%20Chromium%20Sandbox%20-%20General.pptx) |
| 2019 | preso | OWASP Australia | Secure SDLC Speedrun | [youtube.com](https://www.youtube.com/watch?v=85GFFTagSf8) |
| 2019 | preso | OWASP Australia | Session IPA: Sessions' Interesting Protection Anomalies | [youtube.com](https://www.youtube.com/watch?v=NMwng5L6kOw), [pdf slides](./slides/Luke%20(and%20Louis)%20-%20OWASP%202019%20-%20Session%20IPA.pdf) |
| 2019 | preso | Ruxmon Melbourne | Little Black Book of Libc: Exploring the security properties of multiple libc implementation | [github.com](https://github.com/danielhodson/littleblackbook-libc) |
| 2019 | preso | Bsides Canberra | Kubernetes Security | [youtube.com](https://www.youtube.com/watch?v=82STUedYuj8), [pdf slides](./slides/BSides%20Canberra%202019%20-%20Kubernetes%20Security.pdf) |
| 2018 | preso | BSides Perth | OpenSSH security | [pdf slides](./slides/Matt%20-%20Bsides%20Perth%202018%20-%20OpenSSH.pdf) |
| 2018 | poc | - | Fuze Card Paired Data Retrieval PoC | [CVE-2018-9119.py](./writeups/CVE-2018-9119.py) |
| 2018 | preso | SDR Melbourne | Reversing BLE to Steal Your Wallet (CVE-2018-9119) | [blog post](https://www.elttam.com/blog/fuzereview/) |
| 2017 | poc | - | GoAhead httpd/2.5 to 3.6.5 LD_PRELOAD remote code execution exploit | [CVE-2017-17562/](./writeups/CVE-2017-17562/) |
| 2017 | preso | Ruxmon Melbourne | BitcoinCTF III | [pdf slides](https://github.com/lukejahnke/talks/blob/master/BitcoinCTF%20III.pdf) |
| 2017 | poc | - | Firejail TOCTOU privilege escalation | [firejail-toctou.md](./writeups/firejail-toctou.md)
| 2016 | adv | - | Advisory for multiple vulnerabilities in Retroshare | [retroshare-advisory.pdf](./writeups/retroshare-advisory.pdf) |
| 2016 | preso | BSides Canberra | EFF Secure IM Scorecard Review | [blog post](https://www.elttam.com/blog/a-review-of-the-eff-secure-messaging-scorecard-pt1/) |