Pinned Tweet
After a few months of tracking, here is my analysis of the late 2021 #Aggah / #GorgonGroup campaign.
Part 1 related to the infection chain and the campaign overview: guillaumeorlando.github.io/G…
Part 2 focusing the #AgentTesla v3 technical malware analysis: guillaumeorlando.github.io/A…
GuillaumeOrlando retweeted
Our OffensiveCon talk on stateful baseband emulation (and how improper string handling led to baseband RCE) is available on YouTube: youtu.be/zoAITq7jUM8. It has been a pleasure; awesome conference, brilliant people. Slides and paper: danielklischies.net/research…
GuillaumeOrlando retweeted
This is a good resource on how to use github.com/0vercl0k/wtf to find bugs in Microsoft's Defender Malware Protection Engine 🔥:
labs.infoguard.ch/posts/atta… by Manuel Feifel
GuillaumeOrlando retweeted
New blogpost! Want to see how we exploited @Synology network-attached-storage devices at Pwn2Own Ireland?
RCE to root via out-of-bounds NULL-byte writes, click the embed for a fun little writeup of CVE-2024-10442 🔎🎉
blog.ret2.io/2025/04/23/pwn2…
GuillaumeOrlando retweeted
In case you weren't at #nohat2024 but still wanna nerd over RPC, authentication and what's in between, we summarized everything to a blogpost as well. Slides and PoC are on our Github as well.
akamai.com/blog/security-res…
GuillaumeOrlando retweeted
We've updated our blog on abusing file deletes to escalate privileges. We've also released PoC to demonstrate this. The exploit offers a high degree of reliability and eliminates all race conditions. It has been tested on the latest Windows 11 Enterprise. zerodayinitiative.com/blog/2…
GuillaumeOrlando retweeted
Got my first CVE (CVE-2024-41908) during my Master's project on fuzzing. The affected product, Siemens NX, has an out-of-bounds read vulnerability (CVSS 7.8).
Given the complexity and the size of the app, it was my biggest challenge so far.
Details here : cert-portal.siemens.com/prod…
GuillaumeOrlando retweeted
A few months back we submitted two exploit chains to the first ever Pwn2Own Automotive competition.
We just released a blogpost (part 1 of 2) detailing the bugs we abused to remotely exploit the Phoenix CHARX industrial EV charger and win $60,000 🔥🔥
blog.ret2.io/2024/07/17/pwn2…
GuillaumeOrlando retweeted
Wrote a blogpost summarizing all of the features we've added to Lucid in the last few months: Snapshots, Code Coverage Feedback, and more. In the blogpost we actually get all the way to fuzzing a Linux kernel syscall which includes a setup description. h0mbre.github.io/Lucid_Snaps…
GuillaumeOrlando retweeted
Do you know what that means?
You can now play with all 3 IDA GPTs without being a paid customer:
- chatgpt.com/g/g-QohtN580d-id…
- chatgpt.com/g/g-eKf2Iz4XO-id…
- chatgpt.com/g/g-VgbIr9TQQ-id…
GuillaumeOrlando retweeted
Link to the paper for those interested: srg.doc.ic.ac.uk/files/paper…
GuillaumeOrlando retweeted
Take the time to read our new #PluginFocus article. In this blog post, Arnaud Gatignol (@_anyfun) and Julien Staszewski (@_0perator) from the @thalium_team introduce ida kmdf, a tool that helps with your KMDF driver analysis. Read more 🌐 hex-rays.com/blog/plugin-foc…
#idapro
ALT Plugin Focus – ida kmdf
GuillaumeOrlando retweeted
There is now a programmatic way for you to record slices of execution with TTD in your own application 🔥
Check out the LiveRecorderApiSample that demonstrates how to use the API:
github.com/microsoft/WinDbg-…
Do you wish Time Travel Debugging was faster and more lightweight? Our latest version lets you decide exactly what you want recorded! Select modules to record or use the API for full control. Get your recording just the way you like it. Crusts optional. aka.ms/ttd
GuillaumeOrlando retweeted
Is remote code execution in UEFI firmware possible?
Yes it is.
Meet #PixieFAIL: 9 vulnerabilities in the IPv6 stack of EDK II, the open source UEFI implementation used by billions of computers.
Full details by @fdfalcon and @4Dgifts in our new blog post:
blog.quarkslab.com/pixiefail…
ALT Pixies are said to reward consideration and punish neglect of server maintenance on the part of larger humans, they bring blessings to those who are fond of timely patching.
GuillaumeOrlando retweeted
Great series of blog posts by @justuspolzin that makes Mixed Boolean-Arithmetic obfuscation very accessible: plzin.github.io/posts/mba. There is even a web interface available to play with! plzin.github.io/mba-wasm/
GuillaumeOrlando retweeted
A very digestible presentation about fuzzing with LibAFL and QEMU.
Slides:
fahrplan.events.ccc.de/congr…
Code:
github.com/AFLplusplus/LibAF…
#37c3
GuillaumeOrlando retweeted
I turned a workshop on fuzzing with LibAFL into a blog post for you all, check it out:
atredis.com/blog/2023/12/4/a…
GuillaumeOrlando retweeted
Following up on his #SSTIC talk earlier in June, Valentino found a critical RCE affecting the Steam client. Read more about the internals of the Remote Play protocol 📷 and several vulnerabilities in our latest blog post!
blog.thalium.re/posts/achiev…
GuillaumeOrlando retweeted
We’ve got some cool stuff today! A #PluginFocus article by Baptiste Verstraeten from the @thalium_team. He introduces #Symless - a nifty tool aiming to simplify the process of retrieving & defining structures, classes, and virtual tables 🌐 hex-rays.com/blog/plugin-foc…
#IDAPython
ALT Plugin Focus - Symless
GuillaumeOrlando retweeted
Check it out, it's tmp.0ut Volume 3!
tmpout.sh/3/
ALT screenshot of the tmp.0ut Vol 3 table of contents