The Rijndael key builder in Part 1 worked for the first set of samples, but its split-buffer model was wrong. QSYS/QZLSRTPW builds one 32-byte value, 00×5 ‖ des_plaintext_16 ‖ format_byte ‖ username_cp037_10, and insertion-sorts all 32 bytes in ascending order. I tested the corrected decoder against almost 900 QSYRUPWD API...
2026-10-29 — 14 minute readIntro What exactly must be recalculated when bytes inside an IBM i save file are modified? IBM i save files, usually called SAVFs, use two container-consistency checksum mechanisms. Every 512-byte payload has a 16-byte trailer, and the logical stream also carries a 16-byte global checksum in its final payload. I...
2026-10-12 — 35 minute readThis is a write-up of a bug chain in the IBM Db2 Mirror for i web interface. The chain starts without authentication, reaches arbitrary Java/JSP execution in the Liberty application server, and can then cross into QSECOFR on the local IBM i system. I am not publishing the JSP payload...
2026-09-14 — 24 minute readIntro QSYRUPWD (Retrieve Encrypted User Password) is an IBM i API that returns password-related data for a specified user profile in encrypted form to authorized callers. IBM i is IBM’s integrated enterprise platform, originating from the AS/400 line, and is still widely used for business-critical workloads such as ERP, finance,...
2026-07-28 — 41 minute readIntro We discovered and developed an exploit for a pre-authentication remote code execution vulnerability in IBM i Management Central (MGTC). The vulnerability allows an unauthenticated attacker to execute arbitrary CL commands as QSECOFR – the root-equivalent profile on IBM i – by abusing the MGTC packet protocol on port 5555....
2026-06-05 — 13 minute readIntro At the end of last year and the beginning of this one, I focused on IBM i library list (LIBL) based privilege escalation vulnerabilities — a subtle but critical class of issues that can quietly undermine the security of both the core operating system and 3rd party applications. While...
2025-10-22 — 5 minute readIntro At TROOPERS24, we demonstrated how IBM i systems – still widely used in enterprise environments – can be compromised in both authenticated and unauthenticated scenarios, using only built-in services and a basic understanding of the underlying mechanisms. Despite being labeled “legacy,” these systems remain active in finance, logistics, and...
2025-09-04 — 8 minute readThis blogpost describes our journey through discovering CVE-2024-28080, an authentication bypass vulnerability in Gitblit, “an open-source, pure Java stack for managing, viewing, and serving Git repositories”. The vulnerability affects the SSH service and can only be exploited for users that have at least one public key assigned to their account....
2025-08-29 — 13 minute read