Hacking Rootkit Development 16 - Bypass 3.15 Linux Kernel x86 CR4 & CR0 pinning protections
🗣SourcecodeDeleted
🎖@malwr
🗣SourcecodeDeleted
🎖@malwr
YouTube
Hacking Rootkit Development 16 - Bypass Linux Kernel 3.15 x86 CR4 & CR0 pinning protections
Linux Kernel 5.3 solves the CR0 write exploit by making that register read only. Today let's discuss how we can write to the SyscallTable directly and not rely on the CR0 write exploit that we have been using. I heard about this method some time ago and I…
Bypassing CSP & Iframe Sandbox in Android Webview
Just published a blog post around why sensitive pages should not be loaded inside a webview - nuckingfoob on android webviews
Have tried to discuss how CSP & iframe sandbox, in a webview, can be bypassed by the underlying app. Critics welcome, feedback appreciated, expert advice would have me humbled.
🗣qre0ct
🎖@malwr
Just published a blog post around why sensitive pages should not be loaded inside a webview - nuckingfoob on android webviews
Have tried to discuss how CSP & iframe sandbox, in a webview, can be bypassed by the underlying app. Critics welcome, feedback appreciated, expert advice would have me humbled.
🗣qre0ct
🎖@malwr
CVE-2020-3947: A UAF in VMware Workstation that could be used for guest-to-host code execution
🗣RedmondSecGnome
🎖@malwr
🗣RedmondSecGnome
🎖@malwr
Zero Day Initiative
Zero Day Initiative — CVE-2020-3947: Use-After-Free Vulnerability in the VMware Workstation DHCP Component
Ever since introducing the virtualization category at Pwn2Own in 2016, guest-to-host escapes have been a highlight of the contest. This year’s event was no exception. Other guest-to-host escapes have also come through the ZDI program throughout the year.…
Amid Pandemic, Microsoft Alerts Dozens of Hospitals Vulnerable to Ransomware Threat
🗣secureyourdata
🎖@malwr
🗣secureyourdata
🎖@malwr
PCMAG
Amid Pandemic, Microsoft Alerts Dozens of Hospitals Vulnerable to Ransomware Threat
Microsoft said it warned 'several dozens of hospitals' about vulnerabilities in their networks that could be used to deliver ransomware to their IT systems.
safe-mail: A Docker service used by analysts to extract and inspect suspicious .MSG, .EML, and documents
Everyone, I would like to introduce a new utility for Security Analysts that I built called safe-mail. You can find the repository here: https://github.com/swimlane/safe-mail
safe-mail is a Docker service used by analysts to upload, extract, and inspect suspicious .MSG, .EML, and documents.
safe-mail has an API and a (limited) UI which allows a user to upload and retrieve artifacts generated by safe-mail.
safe-mail has the following features and functionality:
Message Features
• Upload EML and MSG mail messages as well as Microsoft Office documents themselves
• .MSG mail messages are Microsoft binary email format messages - typically from Microsoft Outlook clients
• Generates a PNG of the message itself named {filename}.png
• Extracts all embedded & attached images/attachments within the email message
• Provides a OCR text file of the generated mail message
• Generates a JSON file representing the mail message headers
Attachment/Document Features
• Extracts attachments of mail messages
• Generates an image & PDF of each attachment
• Attempts to extract any identified Macros within attachments and creates a JSON file representing the Macro code base
• PDF Documents will generate output from pdfid & pdfparser tools
• ZIP attachments will extract the zip and return any files within the zip
Enjoy! I hope this helps you all on a daily basis!
🗣[Unas](https://www.reddit.com/r/blueteamsec/comments/ftynlo/safemailadockerserviceusedbyanalyststo/)
🎖@malwr
Everyone, I would like to introduce a new utility for Security Analysts that I built called safe-mail. You can find the repository here: https://github.com/swimlane/safe-mail
safe-mail is a Docker service used by analysts to upload, extract, and inspect suspicious .MSG, .EML, and documents.
safe-mail can be used locally on your workstation or can be deployed for shared (or dedicated) use.safe-mail has an API and a (limited) UI which allows a user to upload and retrieve artifacts generated by safe-mail.
safe-mail has the following features and functionality:
Message Features
• Upload EML and MSG mail messages as well as Microsoft Office documents themselves
• .MSG mail messages are Microsoft binary email format messages - typically from Microsoft Outlook clients
• Generates a PNG of the message itself named {filename}.png
• Extracts all embedded & attached images/attachments within the email message
• Provides a OCR text file of the generated mail message
• Generates a JSON file representing the mail message headers
Attachment/Document Features
• Extracts attachments of mail messages
• Generates an image & PDF of each attachment
• Attempts to extract any identified Macros within attachments and creates a JSON file representing the Macro code base
• PDF Documents will generate output from pdfid & pdfparser tools
• ZIP attachments will extract the zip and return any files within the zip
Enjoy! I hope this helps you all on a daily basis!
🗣[Unas](https://www.reddit.com/r/blueteamsec/comments/ftynlo/safemailadockerserviceusedbyanalyststo/)
🎖@malwr
I discovered a vulnerability in Safari that allowed unauthorized websites to access your camera on iOS and macOS
🗣ga-vu
Nice write up and it's cool to see the Apple program finally paying out bounties to non-blessed researchers!
👤SirensToGo
Nice
👤morrislesterszyslak
And this is why I use an adblocker. Though recently, I have stepped up my game with a PiHole as well.
👤thatvhstapeguy
🎖@malwr
🗣ga-vu
Nice write up and it's cool to see the Apple program finally paying out bounties to non-blessed researchers!
👤SirensToGo
Nice
👤morrislesterszyslak
And this is why I use an adblocker. Though recently, I have stepped up my game with a PiHole as well.
👤thatvhstapeguy
🎖@malwr
Ryan Pickren
Webcam Hacking | Ryan Pickren
A vulnerability in Safari allowed hackers to access the iPhone and Macbook cameras. (CVE-2020-3852, CVE-2020-3864, CVE-2020-3865, CVE-2020-3885, CVE-2020-3887 & CVE-2020-9784)
A windows machine that has Cisco passwords hashes that we crack, spray on an smb share to validate user/pass combos and get user access . We then dump data from a running process and get root. It’s a fun machine
🗣lmakonem
🎖@malwr
🗣lmakonem
🎖@malwr
YouTube
HackTheBox - Heist | Noob To OSCP Episode #26
We will complete Heist, a Windows ctf machine from hackthebox for learning offensive cyber security skills. You will learn: 1) Enumerating windows 3) How to ...
TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln
🗣cyberg0100
🎖@malwr
🗣cyberg0100
🎖@malwr
projectzero.google
TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln
Posted by Maddie Stone, Project ZeroINTRODUCTIONI’m really interested in 0-days exploited i...
Research: Vulnerability analysis using the security news graph. Alternate way to score severity.
🗣isox_xx
Sounds similar to the VPR scoring method used by Tenable (Nessus).
👤Tryptic0nUK
🎖@malwr
🗣isox_xx
Sounds similar to the VPR scoring method used by Tenable (Nessus).
👤Tryptic0nUK
🎖@malwr
Vulners Blog
Hidden Threat – Vulnerability Analysis using the news graph
When you face to face a new vulnerability, what is the thought that comes first? Of course, respond as quickly as possible. However, speed is just one of the conditions for an effective fight again…
Common Ports to Remember (credits: packetlife.net)
🗣ATTACKERSA
This very same printout follows me from desk-to-desk. Very good reference point to the not-so-easy-to-remember ports.
👤native_rooted
All u need to know is 20,22,21,25,389,3389,80,53
👤Calvimn
What about WhatsApp?
👤wthinastix
🎖@malwr
🗣ATTACKERSA
This very same printout follows me from desk-to-desk. Very good reference point to the not-so-easy-to-remember ports.
👤native_rooted
All u need to know is 20,22,21,25,389,3389,80,53
👤Calvimn
What about WhatsApp?
👤wthinastix
🎖@malwr
