Privilege Escalation | writeups.xyz

Title	Vulnerabilities	Programs	Authors
How Abusing AWS CloudFormation Led to a Total Takeover of an AWS Environment	Cloud Information Disclosure Privilege Escalation Account Takeover	Undisclosed	Matthew Keeley (@Nightbanes)
ServiceNow Insecure Access Control To Full Admin Takeover	Broken Access Control Privilege Escalation Account Takeover	ServiceNow	Rezk0n (@Rezk0n)
Unleashing the Cloud: A Journey into Hacking College Servers and Uncovering Security Vulnerabilities	Authentication Bypass Account Takeover DoS Privilege Escalation	Undisclosed	Smukx (@Smukx07)
Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust	Azure AD Kerberos Privilege Escalation	Undisclosed	Dirk-Jan Mollema (@_Dirkjan)
Taking Over an Entire Organization - A Journey Through Multiple Bugs	Broken Access Control Privilege Escalation IDOR	Undisclosed	Hacktus (@H4cktus) DreyAnd (@Dreyand_)
Spotted: How we discovered Privilege Escalation, missing CloudTrail data and a race condition in AWS Directory Service	Cloud Privilege Escalation Race Condition	AWS	Ben Bridts (@Benbridts)
GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure	Cloud Privilege Escalation	Google (GCP)	Ofir Balassiano (@Ofir_balassiano) Ofir Shaty (@Nu11p01Nt)
Unintended Path to Exam Domination - AWS EC2 Meta-Data	Cloud Privilege Escalation	Undisclosed	Dr. Michael Gschwender (@Rootcathacking)
Tampering with Conditional Access Policies Using Azure AD Graph API	Cloud Privilege Escalation	Microsoft (Azure)	Secureworks Counter Threat Unit (@Secureworks)
CS:GO: From Zero to 0-day	Game Hacking RCE Memory Corruption Arbitrary File Download Arbitrary File Write DLL Hijacking Privilege Escalation	Valve (CS:GO)	Felipe Alain
From One Vulnerability to Another: Outlook Patch Analysis Reveals Important Flaw in Windows API	Privilege Escalation NTLM	Microsoft (Outlook)	Ben Barnea (@Nachoskrnl)
Hacking Chess.com: My Journey to Unlock Premium Bots on the Android App	Android Privilege Escalation	Chess.com	Fr4 (@_Icebre4ker_)
What is kong & why we’re relying on it	RCE Sandbox Escape Authentication Bypass Hardcoded Credentials Broken Access Control Privilege Escalation JWT	Konga	Laluka (@TheLaluka)
Privilege Escalations through Integrations	Privilege Escalation Amazon Cognito Misconfiguration JWT Account Takeover	Undisclosed	Colin McQueen
Securing Databricks cluster init scripts	Privilege Escalation Cloud	Databricks	Elia Florio Florian Roth (@Cyb3rops) Marius Bartholdy
AWS Identity Center (formerly known as AWS SSO): A Guide to Privilege Escalation and Identity and Access Management	Privilege Escalation Cloud	AWS	Jason Kao
Stealing GitHub staff's access token via GitHub Actions	CI/CD Token Leak Privilege Escalation Supply Chain Attack	GitHub	RyotaK (@Ryotkak)
#BrokenSesame: Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services	Cloud RCE Container Escape Kubernetes Privilege Escalation Lateral Movement Supply Chain Attack Cross-Tenant Vulnerability	Alibaba	Ronen Shustin (@Ronenshh) Shir Tamari (@Shirtamari)
Vulnerability Spotlight: CVE-2023-0264	OIDC OAuth Broken Authentication Privilege Escalation Security Code Review	Keycloak	Timo Müller (@Mtimo44)
User impersonation via stolen UUID code in KeyCloak (CVE-2023-0264)	OAuth OIDC Privilege Escalation Broken Authentication	Keycloak	Jordi Zayuelas I Muñoz
From listKeys to Glory: How We Achieved a Subscription Privilege Escalation and RCE by Abusing Azure Storage Account Keys	Cloud Privilege Escalation	Microsoft (Azure)	Roi Nisimi (@Roinisimi)
BingBang: The AAD misconfiguration that led to Bing.com results manipulation and account takeover explained	Account Takeover Azure AD Cloud XSS Privilege Escalation	Microsoft (Bing)	Hillai Ben-Sasson (@Hillai)
Hacking Admin Panel & Getting free subscription	Exposed Registration API Privilege Escalation Account Takeover	Undisclosed	Zeeshan Mustafa (@By6153)
High severity vulnerability fixed in WordPress Elementor Pro plugin.	Broken Access Control Privilege Escalation Security Code Review	Elementor	Jerome Bruandet
Escalating Privileges with Azure Function Apps	Privilege Escalation Cloud Container Escape RCE	Microsoft (Azure)	Karl Fosaaen (@Kfosaaen)

Page 3 of 9