Junior PG | Fuzz/DL Learner | Reverse Engineering
Beijing
Joined July 2019
- Tweets48
- Following373
- Followers102
- Likes331
3aturn retweeted
Theori's N-Day Full Chain Exploits Series: Part 2
How did we escape the chrome sandbox?
Want to dive deep into the first Windows kernel in-the-wild vulnerability(CVE-2023–21674) discovered in 2023?
Check it out now.
#Theori #티오리 #windows #sandbox
blog.theori.io/chaining-n-da…
·Severity: Important
·Bounty: None
Is this "mitigation" a new method to reduce vulnerabilities?
@msftsecresponse
3aturn retweeted
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. securelist.com/operation-tri…
3aturn retweeted
New blogpost by @FuzzySec and I! Patch Tuesday -> Exploit Wednesday: Pwning Windows afd.sys in 24 Hours. We reverse engineer a bug + write an exploit using a cool new primitive. We also find out that it's been exploited in the wild (previously unknown). securityintelligence.com/pos…
3aturn retweeted
To wrap up 2022, I'm releasing the final part of my 3-part browser exploitation series on Chrome!
In this post, we demonstrate the practical use of the concepts we've learned throughout the series by analyzing and exploiting CVE-2018-17463.
Enjoy!
jhalon.github.io/chrome-brow…
3aturn retweeted
Today I am releasing part 2 of my 3-part browser exploitation series on Chrome!
In part 2, we take a deep dive into the V8 compiler pipeline by understanding what happens under the hood in Ignition, Sparkplug, and TurboFan!
Enjoy!
jhalon.github.io/chrome-brow…
3aturn retweeted
Here is my new blog "Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 1: Root Cause Analysis", Part 2 will be released soon. Stay tuned!
The ThreatLabz research team has analyzed the Windows CLFS Zero-Day vulnerability: zscaler.com/blogs/security-r…
3aturn retweeted
Following up from last month, the Trend Micro Research Team returns with details about CVE-2022-30136 - another remote, unauthenticated RCE (at SYSTEM) in #NFS. They cover the root cause and offer detection guidance. Read all the details at zerodayinitiative.com/blog/2…
M
As promised, I wrote about my Windows 11 post exploitation technique to go from an arbitrary write/increment to a full read/write through I/O rings: windows-internals.com/one-i-…
3aturn retweeted
The latest blog from the Trend Micro Research Team looks at CVE-2022-26937: a Microsoft Windows NFS NLM Portmap stack buffer overflow that could lead to RCE. They provide root cause, source code walkthrough, and detection guidance. zerodayinitiative.com/blog/2…
3aturn retweeted
We do not always have success in everything we do. We even missed out some CVE while trying to figure out how to dig deeper. But it's part of our process & we hope that our documentation here will be useful You can read about @PTDuy 's blog post out here:
starlabs.sg/blog/2022/06/try…
3aturn retweeted
I had written these a while back, but I'm publishing them now as a four-part series. Here are the technical analysis details of the information disclosure #vulnerabilities I've found last fall while #fuzzing #Windows GDI+ with @ifsecure's #WinAFL. 🧵
3aturn retweeted
RCA for 1 of the 2 CLFS bugs patched in April 2022. While we can't determine the CVE, we did managed to exploit it ;) ... credit: @b1thvn_
pixiepointsecurity.com/blog/…
3aturn retweeted
Crypto3/Hydseven exploit chain: a Firefox RCE + sandbox escape. Links w/ the CVE-2019-11707 (RCE)+CVE-2019-11708 (sandbox escape) Firefox exploits were emailed at Coinbase in a phishing campaign targeting exclusively the FF browser on Win, Linux, Mac
github.com/forrest-orr/Explo…
3aturn retweeted
With #CVE-2022-29072 you can gain SYSTEM privilege in victim system when he has 7zip 😎🥳
github.com/kagancapar/CVE-20…
#Windows #PrivilegeEscalation
#RedTeam
M
I wrote a blogpost on turning a binary only target that takes file based inputs into a snapshot fuzzable harness that takes inputs from memory. This is a commonly asked question. It should be beginner friendly (i am one). h0mbre.github.io/Fuzzing-Lik…
3aturn retweeted
Exploiting a use-after-free in Windows Common Logging File System (CLFS): blog.exodusintel.com/2022/03…
3aturn retweeted
Happy Patch Tuesday!
Back in November 2021, I found and reported a local privilege escalation vulnerability in the Windows Print Spooler. The patch for the vulnerability (possibly CVE-2022–22718, CVSS 7.8) was released today. Read all about it here:
research.ifcr.dk/spoolfool-w…
