Worawit Wang retweeted
Good morning! Just published a deep dive into PatchGuard internals: how it works, key internal functions, context init, and possible bypasses. r0keb.github.io/posts/PatchG…
Worawit Wang retweeted
What if you skipped VirtualAlloc, skipped WriteProcessMemory and still got code execution?
We explored process injection using nothing but thread context.
Full write-up + PoCs:
blog.fndsec.net/2025/05/16/t…
Worawit Wang retweeted
The detailed version of our #WorstFit attack is available now! 🔥
Check it out! 👉 blog.orange.tw/posts/2025-01…
cc: @_splitline_
Our talk at #BHEU is done! Hope you all enjoyed it. 😉 A detailed blog is on the way, but in the meantime, check out the pre-alpha website worst.fit/ for early access and the slides!
Huge thanks to @BlackHatEvents and my awesome co-presenter @_splitline_! 🐈
Worawit Wang retweeted
The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. blog.qualys.com/vulnerabilit…
Worawit Wang retweeted
Exploiting CVE-2024-20656, a Local Privilege Escalation in the VSStandardCollectorService150 Service mdsec.co.uk/2024/01/cve-2024… - new research from @filip_dragovic
Worawit Wang retweeted
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. securelist.com/operation-tri…
Worawit Wang retweeted
The new Cookieless variant (CVE-2023-36560) has been added to soroush.me/blog/2023/08/cook…
@mwulftange 😇
Worawit Wang retweeted
New write-up on an Intel Ice Lake CPU vulnerability, we can effectively corrupt the RoB with redundant prefixes! 🔥 An updated microcode is available today for all affected products, cloud providers should patch ASAP.
lock.cmpxchg8b.com/reptar.ht…
Initial public #blutter tool for #reversing flutter app by compiling/using Dart runtime github.com/worawit/blutter
Now, support only Android target. It should still be useful even it is lack of analysis feature.
Worawit Wang retweeted
Dropping #Downfall, exploiting speculative forwarding of 'Gather' instruction to steal data from hardware registers. #MeltdownSequel
- Practical to exploit (POC/Demo)
- Defeat all isolation boundaries (OS, VM, SGX)
- Bypass all Meltdown/MDS mitigations.
downfall.page
Worawit Wang retweeted
#HITB2023HKT COMMSEC: B(l)utter – Reversing Flutter Applications by using Dart Runtime - Worawit Wangwarunyoo - conference.hitb.org/hitbsecc…
Worawit Wang retweeted
A new blog post on Intel VT-rp! Part 1 is about how HLAT prevents the remapping attack, taking Windows as an example platform.
tandasat.github.io/blog/2023…
Sample hypervisor code:
github.com/tandasat/Hello-VT…
Worawit Wang retweeted
First big result from our new CPU research project, a use-after-free in AMD Zen2 processors! 🔥 AMD have just released updated microcode for affected systems, please update! lock.cmpxchg8b.com/zenbleed.…
Worawit Wang retweeted
For anyone that has ran this PoC, consider your data stolen. This is what eventually runs on your host after a few stages. If you wanna analyse it, don't use a web browser or your IP will get blacklisted. #CVE_2023_35829 #backdoor
This quoted post is unavailable.
Worawit Wang retweeted
Introducing DavRelayUp - A port of #KrbRelayUp with modifications to allow for NTLM relay from WebDAV to LDAP and abuse #RBCD in order achieve #LPE in domain-joined windows workstations where LDAP signing is not enforced.
Demo in second tweet.
github.com/Dec0ne/DavRelayUp
My approach to call a kernel function and process creation callback against Windows HVCI datafarm-cybersecurity.mediu…. In short, I modified page table of SSDT. Then, change the jump target to another kernel function. For the callback, I used procmon driver functions and SEH.
The approach does not work when Intel VT-rp (HLAT) is used. The code is at github.com/worawit/malk
Worawit Wang retweeted
Today we're publishing new techniques for recovering NTLM hashes from encrypted credentials protected by Windows Defender Credential Guard.
These techniques also work on victims logged on before the server was compromised.
research.ifcr.dk/pass-the-ch…
Worawit Wang retweeted
The #Qualys Research Team has discovered an easily exploitable memory corruption vulnerability (#Pwnkit) in polkit a SUID-root program that allows any unprivileged local user to gain root privileges on all major linux systems in its default configuration: fal.cn/3lCr6
Worawit Wang retweeted
Hello world! Today, I am officially released, and you can use me to create and fuzz high-quality binary inputs at amazing speed - with optional coverage guidance, and without needing seed inputs. Read about me and download me at uds-se.github.io/FormatFuzze…
