Technical Analysis of Access Token Theft and Manipulation (by @McAfee_Labs) https://www.mcafee.com/enterprise/en-us/assets/reports/rp-access-token-theft-manipulation-attacks.pdf
Trellix
Trellix | Revolutionary Threat Detection and Response
Enhance your cybersecurity resilience with XDR. Detect and respond to threats quickly, modernize SecOps, and defend against ransomware.
A series of posts about QEMU internals » https://airbus-seclab.github.io/qemu_blog/
QEMU internals
Introduction
A series of posts about QEMU internals:
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop/
SentinelOne
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol - SentinelLabs
A newly-discovered NTLM relay attack makes every Windows system vulnerable to an escalation of privileges attack, and there's no patch in sight.
Nice description (likely you will need Google Translate :)) » https://testbnull.medium.com/microsoft-exchange-from-deserialization-to-post-auth-rce-cve-2021-28482-e713001d915f
Medium
Microsoft Exchange From Deserialization to Post-Auth RCE (CVE-2021–28482)
Sau sự kiện proxylogon xảy ra vào tháng 3 vừa rồi, có vẻ như đã tiếp một nguồn cảm hứng mới cho các Researcher đã/đang làm về Exchange.
Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel https://blog.talosintelligence.com/2021/04/vuln-spotlight-linux-kernel.html
Cisco Talos Blog
Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel
Lilith >_> and Claudio Bozzato of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel.
The Linux Kernel is the free and open-source core of Unix-like…
Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel.
The Linux Kernel is the free and open-source core of Unix-like…
Dynamic Symbolic Links https://scorpiosoftware.net/2021/04/30/dynamic-symbolic-links/
Pavel Yosifovich
Dynamic Symbolic Links
While teaching a Windows Internals class recently, I came across a situation which looked like a bug to me, but turned out to be something I didn’t know about – dynamic symbolic links. …
Exploit Development: Browser Exploitation on Windows - Understanding Use-After-Free Vulnerabilities https://connormcgarr.github.io/browser1/
Connor McGarr’s Blog
Exploit Development: Browser Exploitation on Windows - Understanding Use-After-Free Vulnerabilities
Documenting my journey from ground 0 to (hopefully) more modern browser exploitation.
Malware Analysis: Ragnarok Ransomware https://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware/
A journey into IonMonkey: root-causing CVE-2019-9810 https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/
doar-e.github.io
A journey into IonMonkey: root-causing CVE-2019-9810.
CVE-2021-29921 – python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities https://sick.codes/sick-2021-014/
Sick.Codes
CVE-2021-29921 – python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in…
Title python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities. — “ipaddress leading zeros in IPv4 address” CVE ID CVE-2021-29921 CVSS Score 9.8 CVSS:3.1/AV:N/A…
Offensive Security Guide to SSH Tunnels and Proxies https://posts.specterops.io/offensive-security-guide-to-ssh-tunnels-and-proxies-b525cbd4d4c6
SpecterOps
Blog - SpecterOps
Your new best friend: Introducing BloodHound Community Edition!
UUIDs are Popular, but Bad for Performance — Let’s Discuss https://www.percona.com/blog/2019/11/22/uuids-are-popular-but-bad-for-performance-lets-discuss/
Percona Database Performance Blog
MySQL UUIDs - Bad For Performance
MySQL UUIDs are still very popular despite a majority of posts warning against their usage. Learn what UUIDs are and why they are very bad for MySQL performance.
Exploiting and detecting CVE-2021-25735: Kubernetes validating admission webhook bypass https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/
Fuzzing exotic arch with AFL using ghidra emulator https://airbus-cyber-security.com/fuzzing-exotic-arch-with-afl-using-ghidra-emulator/ (src: https://github.com/airbus-cyber/afl_ghidra_emu)
Abusing Replication: Stealing AD FS Secrets Over the Network https://www.fireeye.com/blog/threat-research/2021/04/abusing-replication-stealing-adfs-secrets-over-the-network.html
Google Cloud Blog
Abusing AD FS Replication | Stealing Secrets Over the Network | Google Cloud Blog
Abusing AD FS Replication. We demonstrate how a threat actor can extract the encrypted Token Signing Certificate from anywhere on an internal network.
SSD Advisory – NETGEAR Nighthawk R7000 httpd PreAuth RCE https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/
SSD Secure Disclosure
SSD Advisory – NETGEAR Nighthawk R7000 httpd PreAuth RCE - SSD Secure Disclosure
TL;DR Find out how a vulnerability in NETGEAR R7000 allows an attacker to run arbitrary code without requiring authentication with the device. Vulnerability Summary A vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations…
Google Promised Its Contact Tracing App Was Completely Private—But It Wasn’t https://themarkup.org/privacy/2021/04/27/google-promised-its-contact-tracing-app-was-completely-private-but-it-wasnt
The Markup
Google Promised Its Contact Tracing App Was Completely Private—But It Wasn’t
Researchers say hundreds of preinstalled apps can access a log found on Android devices where sensitive contact tracing information is stored
Bypassing EDR real-time injection detection logic https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection