Mario López

How I found a bug in the software NASA uses to talk to space

Thu, 17 Sep 2026 12:00:00 +0200

Writeup of an out-of-bounds read and unsigned integer underflow in NASA's ION-DTN CBOR decoder.

On AI on CTFs

Sun, 09 Aug 2026 12:00:00 +0200

Why I think CTF competitions should measure the competitor, not the model or workflow they bring into the event.

CRTP Review

Wed, 29 Jan 2025 16:41:43 +0100

Last week, I took the Certified Red Team Professional course. My goal was to build a strong foundation in Active Directory attack and defense, and honestly, I couldn’t have asked for a better course. From the materials to the lab experience, everything exceeded my expectations.

Course Experience

I started by watching the video tutorials, which explain core Active Directory concepts. These are a must-watch, as they cover everything essential. Taking good notes on these videos can save you a lot of research time later.

Internal Walkthrough

Mon, 18 Nov 2024 21:56:18 +0100

Initial Enumeration

So lets deploy the machine and start enumerating.

We can see ssh open on port 22 and a http web server on port 80. If we enter on 10.10.199.61 we see Apache2 Ubuntu Default Page.

After some directory enumeration, we find the following:

/blog
/phpmyadmin
/javascript
/wordpress/wp-login.php

It is necessary to add internal.thm to our /etc/hosts file to navigate through the website.

Since we know admin is a user because he has a post on the website, we can brute force the login page using wpscan and rockyou.txt for the password.

Wreath Walkthrough

Mon, 18 Nov 2024 21:56:18 +0100

Enumeration

Nmap scan for open ports

nmap -p-15000 -vv 10.200.81.200

Nmap scan for OS recognition through headers

nmap -vv 10.200.81.200 --script=http-headers

Exploitation

Once vulnerability is found, download script from github.

git clone https://github.com/MuirlandOracle/CVE-2019-15107

For python pip install:

sudo apt install python3-pip

If privileges are missing use:

chmod +x yourfile.py

Now we can open the reverse shell:

Set up netcat listener to catch reverse shell.

nc -lvnp 4444

Use rlwrap to stabilise the shell.

Now lets get ssh credentials since we won’t be able to crack password hash.

About

Sat, 16 Nov 2024 13:47:50 +0100

I’m a security researcher at Ikerlan, working on the security of AI and embedded systems. I’m looking for roles in application security and in the security of AI-based products, among others.

You can reach me at mariolfeijoo@gmail.com or on LinkedIn.

What I’m looking for

Application security: threat modeling, secure code review and testing of web applications and APIs
Security of AI-based products: red teaming LLM applications and agents, and designing them securely
Product security for embedded and connected devices
Red teaming and secure architecture design

Published work

How I found a bug in the software NASA uses to talk to space: a memory-safety bug in NASA’s ION-DTN, reported through the NASA Vulnerability Disclosure Program
Trusted services in Kubernetes using TEEs: paper presented at JNIC 2024

In my free time I build security tools, which you can find in Projects, and practice on Hack The Box and TryHackMe.

Trusted Services in Kubernetes using TEEs (JNIC 2024)

Mon, 27 May 2024 12:00:00 +0200

Paper presented at JNIC 2024: a confidential predictive-maintenance service built on Intel SGX and deployed with containers and Kubernetes.

eJPT Exam Prep

Sat, 10 Dec 2022 12:00:00 +0100

Metasploit

Basic Commands

search x
use x
info
show options, show advanced options
SET X (e.g. set RHOST 10.10.10.10, set payload x)

Meterpreter Commands

background
sessions -l
sessions -i 1
sysinfo, ifconfig, route, getuid
getsystem (privesc)
bypassuac
download x /root/
upload x C:\\Windows
shell
use post/windows/gather/hashdump

Networking Attacks

Brute Force with Hydra

hydra -L users.txt -P pass.txt -t 10 10.10.10.10 ssh -s 22
hydra -L users.txt -P pass.txt telnet://10.10.10.10

Windows Shares with null sessions

Projects

Mon, 01 Jan 0001 00:00:00 +0000

Tools I build and maintain. Source code on GitHub.

Crabby
Rust-written tool for Claude automation.
CVE Plugin
Obsidian plugin for CVE information.
CVE Notification Tool
MSc final project on CVE remediation times, plus a notification tool for tracking vulnerable software.
rustedr-light
Small Rust-written EDR for Linux, still in development.