Beyond the compiler: Making IBM i run modified native code - Program Validation Value Why this mattersIBM i does not treat an application program as a normal file that ha... 2026-11-10 08:0:0 | 阅读: 7 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu pvv savf repaired userb1 restored

QSYRUPWD, Part 2: Correcting the Rijndael Key Builder The Rijndael key builder in Part 1 worked for the first set of samples, but its split-... 2026-10-29 14:0:0 | 阅读: 21 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu receiver username populated des outer

512 bytes at a time: reconstructing IBM i save-file checksums IntroWhat exactly must be recalculated when bytes inside an IBM i save file are modi... 2026-10-12 13:45:0 | 阅读: 25 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu savf payload trailer edited testb

IBM Db2 Mirror for i: pre-auth RCE and the road to QSECOFR This is a write-up of a bug chain in the IBM Db2 Mirror for i web interface. The chain... 2026-9-14 12:25:0 | 阅读: 37 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu skipvald liberty db2mirror toolbox expanded

The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes IntroQSYRUPWD (Retrieve Encrypted User Password) is an IBM i API that returns passwo... 2026-7-28 15:0:0 | 阅读: 51 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu qsyrupwd gpr des memory 40404040

Unauthenticated RCE as QSECOFR via IBM i Management Central We discovered and developed an exploit for a pre-authentication remote code executio... 2026-6-5 08:15:0 | 阅读: 69 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu classid mgtc mcbuffer handshake qsecofr

IBM i LIBL Autopwn: Kill the Vulnerability Class 这篇文章讨论了IBM i系统中基于库列表（LIBL）的权限提升漏洞及其自动化检测与利用工具。作者强调了不安全程序放置和弱化的库列表管理带来的风险，并提供了防御建议以减少此类漏洞的影响。... 2025-10-22 07:50:0 | 阅读: 57 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu library libl pgm adoption adopted

Exploit development for IBM i 文章展示了如何利用IBM i系统的漏洞CVE-2023-30990通过DRDA协议实现远程命令执行，并绕过安全措施构建Java绑定壳以获得交互式控制。进一步研究发现通过SQL调用QCMDEXC函数可绕过部分安全过滤，强调及时修补漏洞的重要性。... 2025-9-4 11:20:0 | 阅读: 75 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu drda bindshell ebcdic remote

Rage Against the Authentication State Machine 文章描述了一个名为CVE-2024-28080的Gitblit SSH服务认证绕过漏洞。该漏洞允许攻击者在未持有私钥的情况下通过空密码绕过身份验证。问题源于Gitblit与MINA SSHD库的交互设计，在公钥验证失败后未正确重置状态，导致后续密码验证被绕过。此漏洞影响所有支持SSH公钥认证的旧版本，并于2025年6月通过版本1.10修复。... 2025-8-29 08:0:0 | 阅读: 116 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu ssh client gitblit mina

Vulnerability Archeology: Stealing Passwords with IBM i Access Client Solutions As part of our ongoing research of the IBM i platform we monitor news and updates rela... 2025-1-21 08:0:44 | 阅读: 51 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu windows acs network mpnotify security

Story of a Pentester Recruitment 2025 In 2015, we published a blog post about the recruitment challenges we devised for cand... 2025-1-14 14:0:0 | 阅读: 63 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu candidates mushroom candidate hired

Handling Arbitrarily Nested Structures with Burp Suite This is a blog post by Erik Szinai, who worked with us as an intern during the last co... 2024-12-6 16:0:0 | 阅读: 48 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu insertion burp encodings payload montoya

Engineering WCF Hacks There aren’t too many professions in IT that makes professionals learn so many differe... 2024-10-27 14:0:0 | 阅读: 41 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu nmf proxy nbfx wcf python

Technical Details of CVE-2023-30988 - IBM Facsimile Support Privilege Escalation Have you ever s... 2023-8-22 14:37:0 | 阅读: 45 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu qautprof qffstrfcpp facsimile qfax

Technical Details of CVE-2023-30990 - Unauthenticated RCE in IBM i DDM Service IBM published a security bulletin called IBM i is vulnerable to an attacker executin... 2023-7-3 14:37:0 | 阅读: 57 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu ddm client quser security

Booby Trapping IBM i Post-exploitation is a crucial element of any attack aiming for realistic objectives,... 2023-3-30 19:37:0 | 阅读: 42 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu ofile pgm usrprf qcmd database

Abusing Adopted Authority on IBM i In our first blog... 2023-1-20 21:0:0 | 阅读: 38 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu library pgm userb1 save1 usera1

Our new scanner for Text4Shell Some say, CVE-202... 2022-10-19 03:27:38 | 阅读: 43 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu log4shell github burp rapid7

Another Tale of IBM i (AS/400) Hacking Our next journey takes us into the infrastructure of a bank. One element of the infras... 2022-9-28 21:42:24 | 阅读: 36 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu pase 5250 security database attn

Simple IBM i (AS/400) hacking When you get the chance to take a look at the IT systems of financial institutions, te... 2022-9-5 19:36:23 | 阅读: 41 | 收藏 | Silent Signal Techblog - blog.silentsignal.eu security allobj tn5250 privileges ddm