Lazarus APT conceals malicious code within BMP image to drop its RAT https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/
All Your Macs Are Belong To Us: bypassing macOS's file quarantine, gatekeeper, and notarization requirements https://objective-see.com/blog/blog_0x64.html
Objective-See
All Your Macs Are Belong To Us
bypassing macOS's file quarantine, gatekeeper, and notarization requirements
Nice write-up about a XSS challenge » Easter XSS by @terjanq https://easterxss.terjanq.me/writeup.html
easterxss.terjanq.me
Easter XSS challenge by terjanq
Writeup to the Intigriti's 0421 XSS challenge
Volatile Memory Analysis With Volatility : Coreflood Trojan part 2 https://digitalitskills.com/volatile-memory-analysis-with-volatility-coreflood-trojan-part-2/
Volatility | Memory Forensics | Malware| DIGITAL IT SKILLS - Skills that matter
Volatile Memory Analysis With Volatility : Coreflood Trojan part 2 - Volatility | Memory Forensics | Malware| DIGITAL IT SKILLS
In this post we will analyze CoreFlood malware using more advanced concepts of volatile Memory analysis with Volatility Framework.
Discovering Null Byte Injection Vulnerability in GoAhead https://luker983.github.io/blog/2021-04-26-Embedded-Webserver-Null-Byte-Injection/
Luke Rindels
Discovering Null Byte Injection Vulnerability in GoAhead
How I found a zero-day in an embedded web server while testing problems for PlaidCTF 2021.
Nice blog series on reversing mobile apps » https://medium.com/@xplodwild/turning-the-frustration-of-a-mobile-game-into-a-reverse-engineering-training-a9887043efdf https://blog.usejournal.com/reverse-engineering-of-a-mobile-game-part-2-they-updated-we-dumped-memory-27046efdfb85 https://medium.com/@xplodwild/reverse-engineering-of-a-mobile-game-part-3-now-its-obfuscated-9c31e29c386b
Medium
Turning the frustration of a mobile game into a reverse engineering training
Games can be as fun as frustrating, when bugs ruin the fun for half of the player base, and the dev doesn’t care. So, I fixed it myself.
Technical Analysis of Access Token Theft and Manipulation (by @McAfee_Labs) https://www.mcafee.com/enterprise/en-us/assets/reports/rp-access-token-theft-manipulation-attacks.pdf
Trellix
Trellix | Revolutionary Threat Detection and Response
Enhance your cybersecurity resilience with XDR. Detect and respond to threats quickly, modernize SecOps, and defend against ransomware.
A series of posts about QEMU internals » https://airbus-seclab.github.io/qemu_blog/
QEMU internals
Introduction
A series of posts about QEMU internals:
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop/
SentinelOne
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol - SentinelLabs
A newly-discovered NTLM relay attack makes every Windows system vulnerable to an escalation of privileges attack, and there's no patch in sight.
Nice description (likely you will need Google Translate :)) » https://testbnull.medium.com/microsoft-exchange-from-deserialization-to-post-auth-rce-cve-2021-28482-e713001d915f
Medium
Microsoft Exchange From Deserialization to Post-Auth RCE (CVE-2021–28482)
Sau sự kiện proxylogon xảy ra vào tháng 3 vừa rồi, có vẻ như đã tiếp một nguồn cảm hứng mới cho các Researcher đã/đang làm về Exchange.
Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel https://blog.talosintelligence.com/2021/04/vuln-spotlight-linux-kernel.html
Cisco Talos Blog
Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel
Lilith >_> and Claudio Bozzato of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel.
The Linux Kernel is the free and open-source core of Unix-like…
Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel.
The Linux Kernel is the free and open-source core of Unix-like…
Dynamic Symbolic Links https://scorpiosoftware.net/2021/04/30/dynamic-symbolic-links/
Pavel Yosifovich
Dynamic Symbolic Links
While teaching a Windows Internals class recently, I came across a situation which looked like a bug to me, but turned out to be something I didn’t know about – dynamic symbolic links. …
Exploit Development: Browser Exploitation on Windows - Understanding Use-After-Free Vulnerabilities https://connormcgarr.github.io/browser1/
Connor McGarr’s Blog
Exploit Development: Browser Exploitation on Windows - Understanding Use-After-Free Vulnerabilities
Documenting my journey from ground 0 to (hopefully) more modern browser exploitation.
Malware Analysis: Ragnarok Ransomware https://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware/
A journey into IonMonkey: root-causing CVE-2019-9810 https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/
doar-e.github.io
A journey into IonMonkey: root-causing CVE-2019-9810.
CVE-2021-29921 – python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities https://sick.codes/sick-2021-014/
Sick.Codes
CVE-2021-29921 – python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in…
Title python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities. — “ipaddress leading zeros in IPv4 address” CVE ID CVE-2021-29921 CVSS Score 9.8 CVSS:3.1/AV:N/A…
Offensive Security Guide to SSH Tunnels and Proxies https://posts.specterops.io/offensive-security-guide-to-ssh-tunnels-and-proxies-b525cbd4d4c6
SpecterOps
Blog - SpecterOps
Your new best friend: Introducing BloodHound Community Edition!
UUIDs are Popular, but Bad for Performance — Let’s Discuss https://www.percona.com/blog/2019/11/22/uuids-are-popular-but-bad-for-performance-lets-discuss/
Percona Database Performance Blog
MySQL UUIDs - Bad For Performance
MySQL UUIDs are still very popular despite a majority of posts warning against their usage. Learn what UUIDs are and why they are very bad for MySQL performance.
Exploiting and detecting CVE-2021-25735: Kubernetes validating admission webhook bypass https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/
Fuzzing exotic arch with AFL using ghidra emulator https://airbus-cyber-security.com/fuzzing-exotic-arch-with-afl-using-ghidra-emulator/ (src: https://github.com/airbus-cyber/afl_ghidra_emu)