CVE-2020-9900 & CVE-2021-1786 - Abusing macOS Crash Reporter https://theevilbit.github.io/posts/macos_crashreporter/
theevilbit blog
CVE-2020-9900 & CVE-2021-1786 - Abusing macOS Crash Reporter
I plan to discuss two symlink attacks in this blog post. The first, more severe one, CVE-2020-9900 was reported by Zhongcheng Li (CK01) of Zero-dayits Team of Legendsec at Qi’anxin Group, and fixed in Catalina 10.15.6. Apple’s advisory said that with a symlink…
Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
Google Cloud Blog
Authentication Bypass Techniques and Pulse Secure Zero-Day | Google Cloud Blog
We examine multiple techniques for bypassing single & multifactor authentication on Pulse Secure VPN devices and maintaining access through webshells.
CVE-2021-30481: Source engine remote code execution via game invites https://secret.club/2021/04/20/source-engine-rce-invite.html
secret club
CVE-2021-30481: Source engine remote code execution via game invites
Steam is the most popular PC game launcher in the world. It gives millions of people the chance to play their favorite video games with their friends using the built in friend and party system, so it’s safe to assume most users have accepted an invite at…
Adversary Dossier: Ryuk Ransomware Anatomy of an Attack in 2021 https://www.advanced-intel.com/post/adversary-dossier-ryuk-ransomware-anatomy-of-an-attack-in-2021
How to analyze mobile malware: a Cabassous/FluBot Case study https://blog.nviso.eu/2021/04/19/how-to-analyze-mobile-malware-a-cabassous-flubot-case-study/
NVISO Labs
How to analyze mobile malware: a Cabassous/FluBot Case study
This blogpost explains all the steps I took while analyzing the Cabassous/FluBot malware. I wrote this while analyzing the sample and I’ve written down both successful and failed attempts at …
Lazarus APT conceals malicious code within BMP image to drop its RAT https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/
All Your Macs Are Belong To Us: bypassing macOS's file quarantine, gatekeeper, and notarization requirements https://objective-see.com/blog/blog_0x64.html
Objective-See
All Your Macs Are Belong To Us
bypassing macOS's file quarantine, gatekeeper, and notarization requirements
Nice write-up about a XSS challenge » Easter XSS by @terjanq https://easterxss.terjanq.me/writeup.html
easterxss.terjanq.me
Easter XSS challenge by terjanq
Writeup to the Intigriti's 0421 XSS challenge
Volatile Memory Analysis With Volatility : Coreflood Trojan part 2 https://digitalitskills.com/volatile-memory-analysis-with-volatility-coreflood-trojan-part-2/
Volatility | Memory Forensics | Malware| DIGITAL IT SKILLS - Skills that matter
Volatile Memory Analysis With Volatility : Coreflood Trojan part 2 - Volatility | Memory Forensics | Malware| DIGITAL IT SKILLS
In this post we will analyze CoreFlood malware using more advanced concepts of volatile Memory analysis with Volatility Framework.
Discovering Null Byte Injection Vulnerability in GoAhead https://luker983.github.io/blog/2021-04-26-Embedded-Webserver-Null-Byte-Injection/
Luke Rindels
Discovering Null Byte Injection Vulnerability in GoAhead
How I found a zero-day in an embedded web server while testing problems for PlaidCTF 2021.
Nice blog series on reversing mobile apps » https://medium.com/@xplodwild/turning-the-frustration-of-a-mobile-game-into-a-reverse-engineering-training-a9887043efdf https://blog.usejournal.com/reverse-engineering-of-a-mobile-game-part-2-they-updated-we-dumped-memory-27046efdfb85 https://medium.com/@xplodwild/reverse-engineering-of-a-mobile-game-part-3-now-its-obfuscated-9c31e29c386b
Medium
Turning the frustration of a mobile game into a reverse engineering training
Games can be as fun as frustrating, when bugs ruin the fun for half of the player base, and the dev doesn’t care. So, I fixed it myself.
Technical Analysis of Access Token Theft and Manipulation (by @McAfee_Labs) https://www.mcafee.com/enterprise/en-us/assets/reports/rp-access-token-theft-manipulation-attacks.pdf
Trellix
Trellix | Revolutionary Threat Detection and Response
Enhance your cybersecurity resilience with XDR. Detect and respond to threats quickly, modernize SecOps, and defend against ransomware.
A series of posts about QEMU internals » https://airbus-seclab.github.io/qemu_blog/
QEMU internals
Introduction
A series of posts about QEMU internals:
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop/
SentinelOne
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol - SentinelLabs
A newly-discovered NTLM relay attack makes every Windows system vulnerable to an escalation of privileges attack, and there's no patch in sight.
Nice description (likely you will need Google Translate :)) » https://testbnull.medium.com/microsoft-exchange-from-deserialization-to-post-auth-rce-cve-2021-28482-e713001d915f
Medium
Microsoft Exchange From Deserialization to Post-Auth RCE (CVE-2021–28482)
Sau sự kiện proxylogon xảy ra vào tháng 3 vừa rồi, có vẻ như đã tiếp một nguồn cảm hứng mới cho các Researcher đã/đang làm về Exchange.
Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel https://blog.talosintelligence.com/2021/04/vuln-spotlight-linux-kernel.html
Cisco Talos Blog
Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel
Lilith >_> and Claudio Bozzato of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel.
The Linux Kernel is the free and open-source core of Unix-like…
Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel.
The Linux Kernel is the free and open-source core of Unix-like…
Dynamic Symbolic Links https://scorpiosoftware.net/2021/04/30/dynamic-symbolic-links/
Pavel Yosifovich
Dynamic Symbolic Links
While teaching a Windows Internals class recently, I came across a situation which looked like a bug to me, but turned out to be something I didn’t know about – dynamic symbolic links. …
Exploit Development: Browser Exploitation on Windows - Understanding Use-After-Free Vulnerabilities https://connormcgarr.github.io/browser1/
Connor McGarr’s Blog
Exploit Development: Browser Exploitation on Windows - Understanding Use-After-Free Vulnerabilities
Documenting my journey from ground 0 to (hopefully) more modern browser exploitation.
Malware Analysis: Ragnarok Ransomware https://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware/
A journey into IonMonkey: root-causing CVE-2019-9810 https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/
doar-e.github.io
A journey into IonMonkey: root-causing CVE-2019-9810.
CVE-2021-29921 – python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities https://sick.codes/sick-2021-014/
Sick.Codes
CVE-2021-29921 – python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in…
Title python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities. — “ipaddress leading zeros in IPv4 address” CVE ID CVE-2021-29921 CVSS Score 9.8 CVSS:3.1/AV:N/A…