@RandoriAttack

Trusted Adversary @RandoriSecurity | Exploit Development | Offensive Operations | #InfoSec tweets only | Managed by @syndrowm @pwnpnw @aaronportnoy

randori.com/category/ttps/
Joined May 2019
  • Tweets96
  • Following60
  • Followers2.8K
9Media
We've been able to trigger CVE-2023-21554 AKA #QueueJumper, a recently patched RCE in Microsoft’s Message Queueing Service reported by @_CPResearch_. We can confirm it appears exploitable. IOCs and more: randori.com/blog/vulnerabili…
2
60
6
116
57,083
Randori Attack Team retweeted
chompie
@chompie13372 Aug 2023
In collaboration with @FabiusArtrel and @aaronportnoy we conducted a post mortem of the QueueJumper MSMQ RCE patch. We do an in depth RCA, identify variants, create exploit primitives, evaluate exploitability, and make some interesting new discoveries! securityintelligence.com/pos…

Security | IBM

Leverage educational content like blogs, articles, videos, courses, reports and more, crafted by IBM experts, on emerging security and identity technologies.

ibm.com
4
87
4
250
53,980
OpenSSL released details for CVE-2022-3602 & CVE-2022-3786. Due to the mitigating factors outlined in our post we do not believe these will be exploited for remote code execution in real-world scenarios: randori.com/blog/openssl-vul…
8
13
We have validated Rapid7’s analysis on CVE-2022-26134, an RCE in Atlassian Confluence. Randori recommends assuming compromise and investigating accordingly. Vendor guidance is available here: confluence.atlassian.com/doc…
Jacob Baines@Junior_Baines3 Jun 2022
Our technical analysis and curl based PoC for Confluence CVE-2022-26134 can be found here: rapid7.com/blog/post/2022/06…

Active Exploitation of Confluence CVE-2022-26134 | Rapid7 Blog

On June 2, 2022, Atlassian published an advisory for CVE-2022-26134, a critical unauthenticated RCE vulnerability in Confluence Serve and Data Center.

rapid7.com
11
1
14
The Randori Attack Team developed a working exploit for #f5 BIG-IP CVE-2022-1388. To help the #infosec community assess their risk, we published our technical analysis and a bash one-liner that organizations can run to test exploitability. Details here: randori.com/blog/vulnerabili…
31
6
52
CVE-2022-22965 has been assigned to the #SpringShell vulnerability. Spring framework 5.3.18 and 5.2.20 have been released to address the issue: spring.io/blog/2022/03/31/sp…
1
4
The following non-malicious request can be used to test susceptibility to the @springframework 0day RCE. An HTTP 400 return code indicates vulnerability. $ curl host:port/path?class.module.classLoader.URLs%5B0%5D=0 #SpringShell #Spring4Shell #infosec
10
192
7
531
Clarification on the above: a 400 code is not the *only* positive indicator of susceptibility--just a definitive one.
1
1
8
New high severity DoS in OpenSSL just released: openssl.org/news/secadv/2022… CVE-2022-0778 was reported by @taviso and appears to affect systems that parse user-supplied certificates.
1
34
4
52
Not able to attend our webinar on #Log4j with @GreyNoiseIO? Click to watch the recording and get expert insights into researching and remediating Log4Shell, with @HexadeciMoose @aaronportnoy @Andrew___Morris, and Remi. vital.wistia.com/medias/qo6v…
1
1
1
6
Thanks to @mubix doing great work dispelling myths and misinformation around #log4j xitter.cf/mubix/status/147074720…
Rob Fuller@mubix14 Dec 2021
10 #Log4Shell Facts vs Fiction: a 🧵 1. 1.x is NOT vuln to this RCE. While it doesn't have another RCE, it requires access to send serialized data to a listener ON the log server. This is much MUCH harder to exploit and kind of rare for a Log4j server to be running.
1
3
Heads up, expect to see a growing diversity of payloads as this evolves. Patching & Default-Deny still your best strategies.
Greg Linares (Laughing Mantis)
@Laughing_Mantis14 Dec 2021
Replying to @Laughing_Mantis
#log4J info stealing method: Just saw an info stealer payload that uses System.getenv(); to grab ALL variables and then send them back to the attacker. That's all it does. This means attackers do not have to know what env variables to guess in order to steal them.
10
FYI: Join @Andrew___Morris @aaronportnoy @HexadeciMoose and @_mattata at 3pm EST for a live #log4j discussion hosted by @RandoriSecurity and @GreynoiseIO info.randori.com/log4j-log4s…
1
5
10
The Randori Attack Team can confirm the exploitability of unpatched Jamf Pro on-prem via "Log4Shell". Due to the severity of impact, we recommend organizations patch immediately. See: randori.com/blog/jamf-pro-lo…
1
10
2
17
The Randori Attack Team can confirm exploitability of VMWare products in live environments (VMSA-2021-0028) via Log4j (CVE-2021-44228) aka "Log4Shell". This is a critical vulnerability. Follow @RandoriAttack for updates: randori.com/blog/cve-2021-44… 1/3
2
70
5
133
We have validated exploitability with a working exploit, and anticipate widespread exploitation by threat actors imminently. Randori has been in contact with the VMWare team to assist their development of mitigations. 2/3
1
1
1
If impacted: 1. assume compromise and review logs for signs of malicious activity. 2. Configure firewalls to prevent outbound connections. 3. Look for updates from VMware on release of patches. 4. Read updated Log4Shell blog and follow @RandoriAttack for updates. 3/3
2
We have been collaborating with Palo Alto on CVE-2021-3064 and have jointly decided to delay release of technical details as many customers have yet to apply protections due to the COVID-19 pandemic.
1
8
6
28
We have been monitoring activity and neither Palo Alto Networks nor Randori’s threat intelligence sources have identified attempted exploitation. We hope to give defenders extra time through the end of the year to apply mitigations.
1
1
7
The Randori Attack Team has developed a working exploit and has been able to successfully leverage this vulnerability. Check out our analysis here: randori.com/blog/cve-2021-44…
1
33
6
67
Load more