QT: heap overflow in TIFF processing https://bugs.chromium.org/p/project-zero/issues/detail?id=2165
The Nansh0u Campaign – Hackers Arsenal Grows Stronger https://www.guardicore.com/labs/the-nansh0u-campaign-hackers-arsenal-grows-stronger/
Guardicore
The Nansh0u Campaign – Hackers Arsenal Grows Stronger - Guardicore
During the past two months, the Guardicore Labs team has been closely following a China-based campaign which aimed to infect Windows MS-SQL and phpMyAdmin servers worldwide. We have taken a deep look into the inner workings of the campaign – the tools in…
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/
Check Point Research
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor - Check Point Research
Introduction Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in…
CVE-2021-30660 - XNU Kernel Memory Disclosure https://alexplaskett.github.io/CVE-2021-30660/
Amit Merchant - Software Engineer
CVE-2021-30660 - XNU Kernel Memory Disclosure
The msgrcv_nocancel syscall could disclose uninitialized memory from kernel space into userspace. This is due to an incorrect calculation being performed when copying the memory.
Analysis report of the Facefish rootkit https://blog.netlab.360.com/ssh_stealer_facefish_en/
360 Netlab Blog - Network Security Research Lab at 360
Analysis report of the Facefish rootkit
Background
In Feb 2021, we came across an ELF sample using some CWP’s Ndays exploits, we did some analysis, but after checking with a partner who has some nice visibility in network traffic in some China areas, we discovered there is literarily 0 hit for…
In Feb 2021, we came across an ELF sample using some CWP’s Ndays exploits, we did some analysis, but after checking with a partner who has some nice visibility in network traffic in some China areas, we discovered there is literarily 0 hit for…
Abusing LNK "Features" for Initial Access and Persistence https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
v3ded.github.io
Abusing LNK "Features" for Initial Access and Persistence
Preface Today we’ll talk about the misuse of .LNK trigger keys as a means of achieving initial access and persistence. I first heard about this topic myself ...
The Race to Native Code Execution in PLCs https://www.claroty.com/2021/05/28/blog-research-race-to-native-code-execution-in-plcs/
Claroty
Siemens PLC Software Vulnerabilities Uncovered | Team82
Claroty has found a severe memory protection bypass vulnerability (CVE-2020-15782) in Siemens PLC Software, the SIMATIC S7-1200 and S7-1500. Learn more.
Memory Analysis For Beginners With Volatility — Coreflood Trojan: Part 2 https://infosecwriteups.com/memory-analysis-for-beginners-with-volatility-coreflood-trojan-part-2-42bdb46683f2
Medium
Memory Analysis For Beginners With Volatility
Hello everyone, welcome back to my memory analysis series. If you didn’t read the first part of the series — go back and read it here:
Overwolf 1-Click Remote Code Execution - CVE-2021-33501 https://swordbytes.com/blog/security-advisory-overwolf-1-click-remote-code-execution-cve-2021-33501/
Overwolf 1-Click Remote Code Execution - CVE-2021-33501 | SwordBytes Security
SwordBytes researchers have identified an Unauthenticated Remote Code Execution (RCE) vulnerability in Overwolf’s Client Application by abusing a Reflected Cross-Site Scripting (XSS) issue present in the “overwolfstore://” URL handler. This vulnerability…
CVE-2021-22204 - Recreating a critical bug in ExifTool, no Perl smarts required https://blog.bricked.tech/posts/exiftool/
blog.bricked.tech
CVE-2021-22204 - Recreating a critical bug in ExifTool, no Perl smarts required.
This writeup explains how to reverse engineer the security patch and craft an exploit for CVE-2021-22204, without any real Perl knowledge.
Grav CMS 1.7.10 - Code Execution Vulnerabilities https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
Sonarsource
Grav CMS 1.7.10 - Code Execution Vulnerabilities
We responsibly disclosed two code execution vulnerabilities in Grav CMS, one of the most popular flat-file PHP CMS in the market. Let’s see what we can learn from them and discuss their patches!
Database of vulnerabilities showing also economic impacts and black market trading https://hardening-security.com/vulnerabilities
Nice explanation » Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474) https://testbnull.medium.com/ph%C3%A2n-t%C3%ADch-l%E1%BB%97-h%E1%BB%95ng-solarwinds-orion-deserialization-to-rce-cve-2021-31474-b31a5f168bf0
Medium
Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474)
Sau 2 tháng trời diff patch Exchange thì tới patch của tháng 5 này thì mình đã bị ngộ độc và quá chán nản,
Dynamic payload generation with mingw https://passthehashbrowns.github.io/dynamic-payload-generation-with-mingw
Public API to lookup hash values against known database of files (from CIRCL) https://hashlookup.circl.lu/
Great Windows Kernel exploitation tutorial. It starts here https://rootkits.xyz/blog/2017/06/kernel-setting-up/, follow the other links from the post
rootkit
Windows Kernel Exploitation Tutorial Part 1: Setting up the Environment - rootkit
Intro Recently, I had the pleasure to attend the training on Windows Kernel Exploitation at nullcon by the HackSysTeam. The training was well executed, and I got the intro into the world of kernel. But, as you know, nobody could teach you internals about…
Windows Kernel Debugging & Exploitation Part 2 - Stack Overflow https://hacklido.com/blog/147
Great post » The Much Misunderstood SeRelabelPrivilege https://www.tiraniddo.dev/2021/06/the-much-misunderstood.html
www.tiraniddo.dev
The Much Misunderstood SeRelabelPrivilege
Based on my previous blog post I recently had a conversation with a friend and well-known Windows security researcher about token privilege...