CVE-2021-30660 - XNU Kernel Memory Disclosure https://alexplaskett.github.io/CVE-2021-30660/
Amit Merchant - Software Engineer
CVE-2021-30660 - XNU Kernel Memory Disclosure
The msgrcv_nocancel syscall could disclose uninitialized memory from kernel space into userspace. This is due to an incorrect calculation being performed when copying the memory.
Analysis report of the Facefish rootkit https://blog.netlab.360.com/ssh_stealer_facefish_en/
360 Netlab Blog - Network Security Research Lab at 360
Analysis report of the Facefish rootkit
Background
In Feb 2021, we came across an ELF sample using some CWP’s Ndays exploits, we did some analysis, but after checking with a partner who has some nice visibility in network traffic in some China areas, we discovered there is literarily 0 hit for…
In Feb 2021, we came across an ELF sample using some CWP’s Ndays exploits, we did some analysis, but after checking with a partner who has some nice visibility in network traffic in some China areas, we discovered there is literarily 0 hit for…
Abusing LNK "Features" for Initial Access and Persistence https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
v3ded.github.io
Abusing LNK "Features" for Initial Access and Persistence
Preface Today we’ll talk about the misuse of .LNK trigger keys as a means of achieving initial access and persistence. I first heard about this topic myself ...
The Race to Native Code Execution in PLCs https://www.claroty.com/2021/05/28/blog-research-race-to-native-code-execution-in-plcs/
Claroty
Siemens PLC Software Vulnerabilities Uncovered | Team82
Claroty has found a severe memory protection bypass vulnerability (CVE-2020-15782) in Siemens PLC Software, the SIMATIC S7-1200 and S7-1500. Learn more.
Memory Analysis For Beginners With Volatility — Coreflood Trojan: Part 2 https://infosecwriteups.com/memory-analysis-for-beginners-with-volatility-coreflood-trojan-part-2-42bdb46683f2
Medium
Memory Analysis For Beginners With Volatility
Hello everyone, welcome back to my memory analysis series. If you didn’t read the first part of the series — go back and read it here:
Overwolf 1-Click Remote Code Execution - CVE-2021-33501 https://swordbytes.com/blog/security-advisory-overwolf-1-click-remote-code-execution-cve-2021-33501/
Overwolf 1-Click Remote Code Execution - CVE-2021-33501 | SwordBytes Security
SwordBytes researchers have identified an Unauthenticated Remote Code Execution (RCE) vulnerability in Overwolf’s Client Application by abusing a Reflected Cross-Site Scripting (XSS) issue present in the “overwolfstore://” URL handler. This vulnerability…
CVE-2021-22204 - Recreating a critical bug in ExifTool, no Perl smarts required https://blog.bricked.tech/posts/exiftool/
blog.bricked.tech
CVE-2021-22204 - Recreating a critical bug in ExifTool, no Perl smarts required.
This writeup explains how to reverse engineer the security patch and craft an exploit for CVE-2021-22204, without any real Perl knowledge.
Grav CMS 1.7.10 - Code Execution Vulnerabilities https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
Sonarsource
Grav CMS 1.7.10 - Code Execution Vulnerabilities
We responsibly disclosed two code execution vulnerabilities in Grav CMS, one of the most popular flat-file PHP CMS in the market. Let’s see what we can learn from them and discuss their patches!
Database of vulnerabilities showing also economic impacts and black market trading https://hardening-security.com/vulnerabilities
Nice explanation » Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474) https://testbnull.medium.com/ph%C3%A2n-t%C3%ADch-l%E1%BB%97-h%E1%BB%95ng-solarwinds-orion-deserialization-to-rce-cve-2021-31474-b31a5f168bf0
Medium
Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474)
Sau 2 tháng trời diff patch Exchange thì tới patch của tháng 5 này thì mình đã bị ngộ độc và quá chán nản,
Dynamic payload generation with mingw https://passthehashbrowns.github.io/dynamic-payload-generation-with-mingw
Public API to lookup hash values against known database of files (from CIRCL) https://hashlookup.circl.lu/
Great Windows Kernel exploitation tutorial. It starts here https://rootkits.xyz/blog/2017/06/kernel-setting-up/, follow the other links from the post
rootkit
Windows Kernel Exploitation Tutorial Part 1: Setting up the Environment - rootkit
Intro Recently, I had the pleasure to attend the training on Windows Kernel Exploitation at nullcon by the HackSysTeam. The training was well executed, and I got the intro into the world of kernel. But, as you know, nobody could teach you internals about…
Windows Kernel Debugging & Exploitation Part 2 - Stack Overflow https://hacklido.com/blog/147
Great post » The Much Misunderstood SeRelabelPrivilege https://www.tiraniddo.dev/2021/06/the-much-misunderstood.html
www.tiraniddo.dev
The Much Misunderstood SeRelabelPrivilege
Based on my previous blog post I recently had a conversation with a friend and well-known Windows security researcher about token privilege...
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS https://www.trendmicro.com/en_us/research/21/f/CVE-2021-30724_CVMServer_Vulnerability_in_macOS_and_iOS.html
Trend Micro
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS
We analyze the patched CVE-2021-30724 vulnerability, affecting macOS, iOS, and iPadOS. If exploited, this flaw can allow privilege escalation.
OSX/Hydromac: A new macOS malware leaked from a Flashcards app https://blog.confiant.com/osx-hydromac-a-new-macos-malware-leaked-from-a-flashcards-app-2af28f1caa9e
Medium
OSX/Hydromac: A new macOS malware leaked from a Flashcards app
At @ConfiantIntel we had some “luck” finding a new malware targeting the new Apple flagship M1 computers. I put “luck” between quotes, as…
Fuzzing the Office Ecosystem https://research.checkpoint.com/2021/fuzzing-the-office-ecosystem/
Check Point Research
Fuzzing the Office Ecosystem - Check Point Research
Research By: Netanel Ben-Simon and Sagi Tzadik Introduction Microsoft Office is a very commonly used software that can be found on almost any standard computer. It is also integrated inside many products of the Microsoft / Windows ecosystem such as Office…