frack113 retweeted
ATT&CK v20 is here! This release brings more coverage of attacks on critical infrastructure, with new Campaigns for the 2026 attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure that spanned IT and OT. medium.com/mitre-attack/atta…
frack113 retweeted
🚨❤️🔥💀 13 NEW remote RCEs on pfSense CE 2.9.0 💀❤️🔥🚨
These are BRAND NEW and not from Tuesday's earlier drop!
🔥 1. Wireless clone ifconfig
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root ifconfig command from a stored wireless clone interface
• 🔗 github.com/abraxas/pfsense-w…
🔥 2. Assign Interfaces Add
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root command from Assign Interfaces Add
• 🔗 github.com/abraxas/pfsense-a…
🔥 3. IPv6 gateway %zone
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root dpinger command from an IPv6 gateway zone
• 🔗 github.com/abraxas/pfsense-g…
🔥 4. Timezone php.ini prepend
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run root PHP on the next FPM request via php.ini auto_prepend_file
• 🔗 github.com/abraxas/pfsense-t…
🔥 5. sshguard THRESHOLD CRLF
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root sshguard command via THRESHOLD CRLF
• 🔗 github.com/abraxas/pfsense-s…
🔥 6. L2TP RADIUS mpd.conf
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root mpd helper from L2TP RADIUS
• 🔗 github.com/abraxas/pfsense-l…
🔥 7. PPPoE ptpid crontab
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root cron job from PPPoE ptpid
• 🔗 github.com/abraxas/pfsense-p…
🔥 8. PPPoE mpd.secret bang helper
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run a root bang-helper from PPPoE mpd.secret
• 🔗 github.com/abraxas/pfsense-p…
🔥 9. Captive Portal HA pfctl
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run root pfctl from Captive Portal HA host
• 🔗 github.com/abraxas/pfsense-c…
🔥 10. Unbound sock-queue-timeout
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: inject an Unbound include and run unbound-control as root
• 🔗 github.com/abraxas/pfsense-u…
🔥 11. Unbound ACL CRLF
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: inject an Unbound include through ACL CRLF
• 🔗 github.com/abraxas/pfsense-u…
🔥 12. OpenVPN connect_async eval
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: eval a RADIUS username as root in OpenVPN connect_async
• 🔗 github.com/abraxas/pfsense-o…
🔥 13. OpenVPN learn-address CN
• 🎯 Class: RCE
• 🌐 Remote
• 💀 What an attacker can do: run su -c as root from an OpenVPN learn-address CN
• 🔗 github.com/abraxas/pfsense-o…
🧨 First drop (Tuesday) - 5 RCE's - pfSense:
• 🔗 xitter.cf/abraxas_null/status/21…
🧨 Second drop (Wednesday) - pfSense API:
• 🔗 xitter.cf/abraxas_null/status/21…
📖 Full series:
• 🔗 abraxaslabs.tech/research/pf…
🤖 Made with AI
🚨 🧯 Even MORE pfSense 0day? How??? 🧯 🚨
🧨 🚒 Exclusively pfSense API Exploits 🚒 🧨
Nine leftovers in Netgate’s pfSense Plus MIM API toolkit (public OpenAPI + official samples). Loopback labs. Full write-up at the end.
🔥 1 • Privilege leftover • Remote • Shape controller JSON so enrollment SSH runs as admin on every listed firewall • github.com/abraxas/pfsense-a…
🔥 2 • Privilege leftover • Remote • SSH MITM of first-contact enroll steals the SSH user and plants a hostile controller • github.com/abraxas/pfsense-a…
🔥 3 • Privilege leftover • Local • Any local uid that can open the device unix socket enrolls a hostile controller and dumps identity • github.com/abraxas/pfsense-a…
🔑 4 • Privilege leftover • Remote • With a read-shaped MIM JWT, download CA and leaf private keys and PKCS12 with no password • github.com/abraxas/pfsense-a…
🔑 5 • Privilege leftover • Remote • GET /services/acme returns the Let’s Encrypt account key and issued private keys • github.com/abraxas/pfsense-a…
🪪 6 • IDOR • Remote • One controller JWT lists every device and, if the role includes console, php/shell any enrolled box • github.com/abraxas/pfsense-a…
🪪 7 • IDOR • Remote • A stolen or derived ACB userkey fetches full Auto Config Backup blobs • github.com/abraxas/pfsense-a…
📂 8 • File read • Remote • GET Snort rules {file} may join outside the ruleset after %2F decode • github.com/abraxas/pfsense-a…
🔓 9 • Privilege leftover • Remote • Official samples disable TLS verify, so MITM of :8443 steals the JWT and replays 4–6 / php/shell • github.com/abraxas/pfsense-a…
abraxaslabs.tech/research/pf…
frack113 retweeted
🔥🚒 pfSense Firewall 0day - 5 RCEs! 🚒 🔥
Exploits
- github.com/abraxas/pfsense-q…
- github.com/abraxas/pfsense-o…
- github.com/abraxas/pfsense-c…
- github.com/abraxas/pfsense-l…
- github.com/abraxas/pfsense-i…
Writeups
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
🤖 Made with AI
frack113 retweeted
I’m not a fan of AI-generated images, but this one deserves to be in Charlie Hebdo.
frack113 retweeted
🏦 又发现一个能替代 Datadog 和 Splunk 的开源神器 OpenObserve，日志、指标、链路追踪一套全包，自己部署就不用再交那笔账单了。
GitHub 上 2.2 万 star，官方说跟 Elasticsearch 比，光存储成本最多就能降 140 倍。
可观测性这事最劝退的地方从来不是难用，是贵。日志量一上来账单能翻着倍涨，很多小团队最后的选择是「少存点、只留报错的」，然后线上真出事的时候，发现关键那段日志被自己砍掉了。
OpenObserve 用 Rust 写，底下是 Parquet 列式存储直接打到 S3，所以它敢让你把日志都留着。查的时候不用学新语言，日志和链路直接 SQL，指标 SQL 或者 PromQL 都行，整套按 OpenTelemetry 标准来，现有的采集端基本不用改。内置的助手还能帮你把想查的东西翻译成查询语句。
部署是单个二进制文件，官方说两分钟能起来；它自己最大的那个用户每天往里灌超过 2PB。开源版走 AGPL-3.0，另有企业版和每天 50GB 的免费额度。
存不存得起日志，不该由账单来决定。
GitHub：github.com/openobserve/openo…
frack113 retweeted
📢 #Fleurdelix OS picked #ONLYOFFICE Desktop Editors as its default office suite 🖥️
Preinstalled, no setup needed. Full DOCX, XLSX & PPTX support with great MS Office compatibility. Built for #digitalsovereignty and data control.
🔗 onlyo.co/3SZlVfv
frack113 retweeted
🛠️ Tool Tuesday: PsExec
Sysinternals' remote-execution classic, and the ransomware operator's deployment tool of choice. In our cases, actors use PsExec to push the locker to dozens of hosts in seconds.
🔎 Hunt tip: watch for PSEXESVC service creation and remote service starts fanning out from a single host.
See it across real intrusions 👉 buff.ly/8k7Bink
I heard “We chose Elastic as our SIEM because it’s free and it handles all formats with integrators.” I think this narrow-minded view is harmful because it doesn’t take into account how I manage my rules, my alerts, or the languages (Elastic now has three). it's Friday🤗
frack113 retweeted
Ollama
Shodan indexes over 47.000 exposed Ollama instances, including many running on expensive cloud GPUs.
The API has no authentication, which means hackers can run prompts, steal models and exploit vulnerable versions.
To spread awareness we made an article showing you what can be done. Make sure you're safe
hackers-arise.com/hacking-ar…
frack113 retweeted
Microsoft reúne una excelente serie sobre #ActiveDirectory Hardening, con temas fundamentales para reducir la superficie de ataque:
✅ Deshabilitar NTLMv1
✅ Eliminar SMBv1
✅ Forzar LDAP Signing
✅ Implementar AES para Kerberos
✅ Configurar LDAP Channel Binding
✅ Forzar SMB Signing
✅ Aplicar Least Privilege
✅ Reducir y eliminar el uso de NTLM
⚠️ Hardening no significa aplicar una GPO y esperar lo mejor. Requiere inventario, auditoría, pruebas y validación de dependencias.
Una lectura imprescindible para cualquier administrador de Active Directory. 👇
techcommunity.microsoft.com/…
frack113 retweeted
This is not “just” an attack on a local substation. High-voltage transmission infrastructure is part of the backbone of the interconnected German and European power grid.
Under the wrong conditions, disruptions at this level can cascade far beyond the immediate area and potentially contribute to large-scale blackouts across Germany or even Continental Europe.
The fact that this incident was contained and power was restored quickly should not make the target - or the potential consequences - seem any less serious.
BREAKING:
Unknown attackers targeted a high-voltage substation near the Jänschwalde power plant in Brandenburg, Germany, firing homemade explosive rockets at the facility.
Additional devices were found and defused. Several transmission lines were briefly interrupted but have been restored.
Police in Potsdam and the Brandenburg State Criminal Police Office are investigating. No suspects or motive have been identified.
Initial reports suggest the aim was a large-scale blackout around the plant.
frack113 retweeted
🛠️ Tool Tuesday: Rclone
A legitimate tool for backing up and syncing data to the cloud, which is exactly why threat actors reach for it to steal yours. In our investigations, actors drop Rclone (often renamed) to exfiltrate gigabytes to MEGA, SFTP, or FTP just before ransomware.
🔎 Hunt tip: flag rclone command lines (copy, --multi-thread-streams, mega:) and large outbound transfers from file servers.
See it across real intrusions 👉 buff.ly/BYwJTz9
frack113 retweeted
🔥 Tencent released an 8.5GB model that can VISUALLY 👀 search your private PDFs, charts, tables, and scanned documents, all done completely locally.
EVIE-Preview-4.5B is not a chatbot model.
🎯 It's a visual document retrieval model built on Qwen3.5-4B that searches the actual page, including layout, charts, tables, images, and text, instead of flattening everything into text chunks first.
And this tiny 4.5B model is taking on much larger models. 👀
🏆 #1 on ViDoRe V3
🏆 #1 on ViDoRe V1+V2
ViDoRe V3:
🥇 EVIE 4.5B → 65.36
✧ webAI ColVec 8.4B → 65.32
✧ NVIDIA Nemotron 8B → 63.54
✧ Jina Embeddings v4 → 57.54
Stats ...
🧠 4.54B parameters
📦 ~8.5GB BF16
🔎 128-dimensional visual token embeddings
🌍 Multilingual
📜 Apache 2.0
💻 Runs locally
You can give your local AI thousands of these ...
📑 PDFs
📊 Charts
🧾 Scanned forms
📚 Research papers
📈 Financial reports
🛠️ Technical manuals
…and it can retrieve the actual pages visually, not just OCR text. 🎯
This feels like an important next step for private Local RAG.
⚠️ No llama.cpp / Ollama / LM Studio support yet. The current path is PyTorch + ColPali.
🔗 HF /tencent/EVIE-Preview-4.5B
