🚨 CVE-2022-34502
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.
🎖@cveNotify
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.
🎖@cveNotify
GitHub
heap-buffer-overflow in WASM name handling after 5.7.0 release · Issue #20336 · radareorg/radare2
Environment Mon Jun 20 03:01:00 PM CST 2022 radare2 5.7.0 28296 @ linux-x86-64 git.5.7.0 commit: 09569c1d5c324df7f23bdc9ad864ac1c25925745 build: 2022-06-20__11:48:07 Linux x86_64 Description After ...
IDA Pro 8.0 released!
ℹ️ Golang 1.18
ℹ️ iOS 16 dyld shared cache support
ℹ️ ARC decompiler
ℹ️ Better firmware analysis
ℹ️ FLAIR pattern generator (makepat)
https://hex-rays.com/products/ida/news/8_0/
🎖@cveNotify
ℹ️ Golang 1.18
ℹ️ iOS 16 dyld shared cache support
ℹ️ ARC decompiler
ℹ️ Better firmware analysis
ℹ️ FLAIR pattern generator (makepat)
https://hex-rays.com/products/ida/news/8_0/
🎖@cveNotify
Hex-Rays
IDA 8.0 | Hex-Rays Docs
🤮4😁3
How does AV know when a process is malicious if it doesnt have a known hash?
🗣Diesl
All AVs have a database of known malicious code and extensions. If the hash is unrecognized it may get quarantined.
👤latnGemin616
🎖@malwr
🗣Diesl
All AVs have a database of known malicious code and extensions. If the hash is unrecognized it may get quarantined.
👤latnGemin616
🎖@malwr
Culbert Report
How AV Hooks NTDLL
How Does AV Know? Have you ever wondered how AV knows what that the application you’re trying to run is malicious when it doesn’t have a known signature? NTDLL is the answer.
👍1
Image displays its own MD5 hash
🗣ASIC_SP
Absolute noob question incoming... What are some practical uses for this?
👤WhatArghThose
There's a mathematical function (maybe in parametric form) whose graph is the "picture of the algebraic equation" of the function itself. I can't find it right now. [not exactly correct, see below\]
EDIT:
Tupper's self-referential formula:
https://en.wikipedia.org/wiki/Tupper%27s_self-referential_formula
👤Acrobatic-Cause-4925
See also: This PDF is an NES ROM that prints its own MD5 hash!
👤cbarrick
🎖@malwr
🗣ASIC_SP
Absolute noob question incoming... What are some practical uses for this?
👤WhatArghThose
There's a mathematical function (maybe in parametric form) whose graph is the "picture of the algebraic equation" of the function itself. I can't find it right now. [not exactly correct, see below\]
EDIT:
Tupper's self-referential formula:
https://en.wikipedia.org/wiki/Tupper%27s_self-referential_formula
👤Acrobatic-Cause-4925
See also: This PDF is an NES ROM that prints its own MD5 hash!
👤cbarrick
🎖@malwr
👍1
Downrange: A Survey of China’s Cyber Ranges - Center for Security and Emerging Technology
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Center for Security and Emerging Technology
Downrange: A Survey of China’s Cyber Ranges | Center for Security and Emerging Technology
China is rapidly building cyber ranges that allow cybersecurity teams to test new tools, practice attack and defense, and evaluate the cybersecurity of a particular product or service. The presence of these facilities suggests a concerted effort on the part…
git-vuln-finder v1.3 released - a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
Release git-vuln-finder v1.3 released - bug fixes release · cve-search/git-vuln-finder
git-vuln-finder v1.3 released - bug fixes released.
git-vuln-finder is a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associ...
git-vuln-finder is a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associ...
Cronos: PoC for a new sleep obfuscation technique leveraging waitable timers to evade memory scanners - leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - Idov31/Cronos: PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.
PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners. - Idov31/Cronos
👍1
List of Free Cybersecurity Services and Tools curated by CISA
https://www.cisa.gov/free-cybersecurity-services-and-tools
🗣apes_2gether_strong
🎖@malwr
https://www.cisa.gov/free-cybersecurity-services-and-tools
🗣apes_2gether_strong
🎖@malwr
Cybersecurity and Infrastructure Security Agency CISA
No-Cost Cybersecurity Services & Tools | CISA
BumbleBee: Round Two - In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector to deploy Cobalt Strike and Meterpreter.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
The DFIR Report
BumbleBee: Round Two
In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee has been identified as an initial access vector utilized by several ransomware affiliates. …
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV [PDF+EXPLOIT](https://github.com/Wh04m1001/ZoneAlarmEoP)
🗣soupcreamychicken
🎖@malwr
🗣soupcreamychicken
🎖@malwr
GitHub
GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV - GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV
Microsoft Shift F10 bypass + Autopilot privilege escalation
🗣k4m1ll0
Am i missing something, or could you just as easily pop out the harddisk and put it in another machine to remove the DisableCMDRequest.TAG file/do whatever you want?
👤Bl00dsoul
There are ways to disable it: https://call4cloud.nl/2022/01/the-oobe-massacre-the-beginning-of-shift-f10/
Another attack vector would be audit mode at beginning of setup. After creating admin accounts or whatever sysprep back to OOBE to continue with autopilot
👤HankMardukasNY
This vuln is fairly well-known in the Intune community, but mostly theoretical - great to see a writeup and full attack chain. Do you have any recommendations for mitigating it? I've focused on using preprovisioning to lock down the system and defaultuser0, but being able to alt-tab and modify system state at all seems like a huge attack surface
👤Pl4nty
🎖@malwr
🗣k4m1ll0
Am i missing something, or could you just as easily pop out the harddisk and put it in another machine to remove the DisableCMDRequest.TAG file/do whatever you want?
👤Bl00dsoul
There are ways to disable it: https://call4cloud.nl/2022/01/the-oobe-massacre-the-beginning-of-shift-f10/
Another attack vector would be audit mode at beginning of setup. After creating admin accounts or whatever sysprep back to OOBE to continue with autopilot
👤HankMardukasNY
This vuln is fairly well-known in the Intune community, but mostly theoretical - great to see a writeup and full attack chain. Do you have any recommendations for mitigating it? I've focused on using preprovisioning to lock down the system and defaultuser0, but being able to alt-tab and modify system state at all seems like a huge attack surface
👤Pl4nty
🎖@malwr
K4M1Ll0
Shift F10 bypass and Autopilot privilege escalation - Microsoft
Shift + F10 bypass and privilege escalation
👍1