Coder, hacker, infosec researcher, adrenaline junkie. Once hiked Ben Nevis, Scafell Pike, and Snowdon in 22h 48m. Not a snake oil peddler.
Manchester, UK
Joined September 2009
- Tweets5K
- Following671
- Followers2K
- Likes2.7K
Are there any funky .NET exploitation techniques that might lead to a crash in clr!PrecodeFixupThunk?
Deserialization, reflection, and memory-resident shellcode execution come to mind with PrecodeFixupThunk being the first step of the JIT mechanism (hat-tip to @_xpn_ for weird ways to run unmanaged code in .NET!).
Anyone observed this, or have any more specific suggestions?
In other news - my @Steel_Con talk has been accepted! Looking forward to it. Catch you there if you're going!
That's another one ticked! Did not go as well as I'd have liked but it was a brutal one today. The heat took a lot of people out. Hope everyone's ok and congrats to the 92k or so marathoners today whether at London or Manchester! #ManchesterMarathon
Apache security team have reviewed and revised this one! CVE-2025-24859 in Apache Roller has been downgraded to CVSS 2.1, panic over ;)
CVE database is becoming a joke TBH, when things like CVE-2025-24859 are published with a CVSS score of 10.0 - To exploit this vulnerability you first need to obtain a valid session token, then you only maintain access to the corresponding user account... cve.org/CVERecord?id=CVE-202…
Nicky Bloor retweeted
Intercepting HTTPS Communication in Flutter : Going Full Hardcore Mode with Frida : sensepost.com/blog/2025/inte…
CVE database is becoming a joke TBH, when things like CVE-2025-24859 are published with a CVSS score of 10.0 - To exploit this vulnerability you first need to obtain a valid session token, then you only maintain access to the corresponding user account... cve.org/CVERecord?id=CVE-202…
It's time! Picked this one up about 9 years ago, not long after I had my first Smog Rocket @BeavertownBeer !
Nicky Bloor retweeted
A colleague pointed me today to an insane exploit primitive if you control a PHP include() with a fixed .php extension and no upload:
leavesongs.com/PENETRATION/d…
#lazyweb Anyone know how I can run Android Auto in a VM, with a view to later running it on a Raspberry Pi or similar? Also looking to modify it so open source preferably. Currently building a VM to look at OpenAuto but any pointers would be brill!
Man this was a banging hack. Miss getting properly stuck into stuff for mad r00t like that!
@TenableSecurity Nessus still says no known exploit for these vulns despite me publishing it and notifying them three years ago 🤣 Wonder how many times this has been reported and wontfixed because "no exploit"! Stable, unauthenticated, no interaction RCE in default config.
Too hot for this. Why no sprinklers or jelly babies this year @Great_Run ?! I reckon I would have run at least 2 minutes faster with those 🤣
