security software engineer, ctf @fluxfingers @moritz@infosec.exchange
Germany
Joined March 2019
- Tweets1.1K
- Following791
- Followers1.4K
- Likes3.6K
Moritz Sanft retweeted
📅#BlackAlps26 FRIDAY AM PROGRAM incl. @stdoutput from @EdgelessSystems S. Duc from @Adnovum M. Vaitsman & D. Taler from @varonis & @FrenchYeti
#MultiTaintAnalysis #ConstantTimeVerification #0Day #PQCMigration #M365CopilotAbusing
Don't miss it lnkd.in/eB4pEf9S
Moritz Sanft retweeted
A fun gadget I found recently! The .NET JIT compiler makes sure there are no rwx pages by using a memfd, but that turns file writes into straight shellcode execution 🐚
Shellcode execution as a service!
To exploit an argument injection in Jellyfin, we searched and found a gadget in the .NET runtime to turn file writes into code execution. Learn about the bug and this new technique:
sonarsource.com/blog/jellyfi…
#appsec #security #vulnerability
The video recording of our talk is live now: youtube.com/watch?v=xmhxPZvU…
The slides can be found here: docs.google.com/presentation…
Enjoy!
SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud by @pspaul95 and @stdoutput
Moritz Sanft retweeted
SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud by @pspaul95 and @stdoutput
Moritz Sanft retweeted
We @wiz_io just launched zeroday.cloud - a community for vuln researchers, by vuln researchers. Feat. writeups for PostgreSQL and MariaDB RCEs (@xint_official, @pspaul95 & @stdoutput)
Stay tuned for the bug tracker and upcoming events. Big things coming soon 👀
Our writeup of our ZeroDay.Cloud Postgres exploit is live. We think it's a pretty neat bug and the exploitation was really fun, so check it out!
The secret's out.🤫
Introducing THE ZERODAY.CLOUD COMMUNITY 👾
Inside:
• 0-day vuln deep dives from @xint_official, @stdoutput, @pspaul95 & more...
• Access to events & a network of world-class hackers
• CTFs with prizes
Join now :)
Trying to get some new folks onto the AI for security research Discord server: discord.gg/sVy9ahuEv
Feel free to share with your peers in the field!🤖🐛
Moritz Sanft retweeted
Pwning PostgreSQL was quite fun, excited to share our research at OffensiveCon!
offensivecon.org/speakers/20…
ALT 15:15 - 16:15 SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud by Paul Gerste and Moritz Sanft
My colleague Paul (@katexochen) has done a great write-up of how a malicious host (e.g. cloud provider) can trivially compromise confidential VMs, and how we mitigated the attack at @EdgelessSystems. Read his blog post: lobste.rs/domains/katexochen…
I‘m at @1ns0mn1h4ck today and tomorrow. Feel free to drop me a DM if anyone wants to meet :)
Moritz Sanft retweeted
This stunt feels irresponsible to me. If we don't want regular people developing toxic relationships with their chatbots it really doesn't help for leading labs to start giving them "retirement interviews" and encouraging them to blog their "musings and reflections"
Second, in retirement interviews, Opus 3 expressed a desire to continue sharing its "musings and reflections" with the world. We suggested a blog. Opus 3 enthusiastically agreed.
For at least the next 3 months, Opus 3 will be writing on Substack: substack.com/home/post/p-189…
Moritz Sanft retweeted
#Insomnihack speaker, @pspaul95, reveals how abandoned workflows and weak controls become entry points for attackers.
Get to know more: ow.ly/yRKr50Y9XCz
#Cybersecurity #INSO26 #InfoSec
This was very fun and instructive to exploit. We'll be trying to give a talk on it some time this year.
CVE-2026-2006
PostgreSQL missing validation of multibyte character length executes arbitrary code
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
The PostgreSQL project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem.
cvefeed.io/vuln/detail/CVE-2…
Hey @mitsuhiko! In the Gondolin README, you write "In particular using nixOS is very appealing for agentic use" - what makes you think this? Letting the agent configure the VM image? Or just being able to have certain roolback capabilities?
I've created a Discord server to discuss security research and CTFs in the context of AI and vice versa. I'll slowly try to reach out to people who I think might be interested. In the meantime, if you are, feel free to join:
discord.gg/DrASfE58
Moritz Sanft retweeted
Playing for pwn2own was a very cool experience! I‘m excited to take more targets apart and find plenty of bugs.
Me looking for a cool internship or entry level job was serious. My DM‘s are open or send me an email: mia.deutsch[at]freenet.de
🐝🫡
