Grav CMS 1.7.10 - Code Execution Vulnerabilities https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
Sonarsource
Grav CMS 1.7.10 - Code Execution Vulnerabilities
We responsibly disclosed two code execution vulnerabilities in Grav CMS, one of the most popular flat-file PHP CMS in the market. Let’s see what we can learn from them and discuss their patches!
Database of vulnerabilities showing also economic impacts and black market trading https://hardening-security.com/vulnerabilities
Nice explanation » Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474) https://testbnull.medium.com/ph%C3%A2n-t%C3%ADch-l%E1%BB%97-h%E1%BB%95ng-solarwinds-orion-deserialization-to-rce-cve-2021-31474-b31a5f168bf0
Medium
Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474)
Sau 2 tháng trời diff patch Exchange thì tới patch của tháng 5 này thì mình đã bị ngộ độc và quá chán nản,
Dynamic payload generation with mingw https://passthehashbrowns.github.io/dynamic-payload-generation-with-mingw
Public API to lookup hash values against known database of files (from CIRCL) https://hashlookup.circl.lu/
Great Windows Kernel exploitation tutorial. It starts here https://rootkits.xyz/blog/2017/06/kernel-setting-up/, follow the other links from the post
rootkit
Windows Kernel Exploitation Tutorial Part 1: Setting up the Environment - rootkit
Intro Recently, I had the pleasure to attend the training on Windows Kernel Exploitation at nullcon by the HackSysTeam. The training was well executed, and I got the intro into the world of kernel. But, as you know, nobody could teach you internals about…
Windows Kernel Debugging & Exploitation Part 2 - Stack Overflow https://hacklido.com/blog/147
Great post » The Much Misunderstood SeRelabelPrivilege https://www.tiraniddo.dev/2021/06/the-much-misunderstood.html
www.tiraniddo.dev
The Much Misunderstood SeRelabelPrivilege
Based on my previous blog post I recently had a conversation with a friend and well-known Windows security researcher about token privilege...
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS https://www.trendmicro.com/en_us/research/21/f/CVE-2021-30724_CVMServer_Vulnerability_in_macOS_and_iOS.html
Trend Micro
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS
We analyze the patched CVE-2021-30724 vulnerability, affecting macOS, iOS, and iPadOS. If exploited, this flaw can allow privilege escalation.
OSX/Hydromac: A new macOS malware leaked from a Flashcards app https://blog.confiant.com/osx-hydromac-a-new-macos-malware-leaked-from-a-flashcards-app-2af28f1caa9e
Medium
OSX/Hydromac: A new macOS malware leaked from a Flashcards app
At @ConfiantIntel we had some “luck” finding a new malware targeting the new Apple flagship M1 computers. I put “luck” between quotes, as…
Fuzzing the Office Ecosystem https://research.checkpoint.com/2021/fuzzing-the-office-ecosystem/
Check Point Research
Fuzzing the Office Ecosystem - Check Point Research
Research By: Netanel Ben-Simon and Sagi Tzadik Introduction Microsoft Office is a very commonly used software that can be found on almost any standard computer. It is also integrated inside many products of the Microsoft / Windows ecosystem such as Office…
PuzzleMaker attacks with Chrome zero-day exploit chain https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/
CVE-2021–22201: Arbitrary file read on Gitlab https://tradahacking.vn/cve-2021-22201-arbitrary-file-read-on-gitlab-d84d77cd83e3
Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html
iamelli0t’s blog
Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample
The general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called…
Taming Virtual Machine Based Code Protection – 1 https://malwareandstuff.com/taming-virtual-machine-based-code-protection-1/
Malware and Stuff
Taming Virtual Machine Based Code Protection – 1
Overcoming obfuscation in binaries has always been an interesting topic for me, especially in combination with malware. Over the last weeks I’ve been playing around with Virtualised Code Prot…
Jailbroken iOS can't run macOS apps. I spent a week to find out why https://worthdoingbadly.com/macappsios/
Worth Doing Badly
Jailbroken iOS can’t run macOS apps. I spent a week to find out why.
I ran command line macOS tools, such as Bash and Geekbench, on a jailbroken iPhone by replacing iOS’s dyld shared cache (all of iOS’s code) with macOS’s. However, graphical apps will never work: macOS’s WindowServer won’t start, since iOS’s drivers are too…
I Like to Move It: Windows Lateral Movement (WMI Event Subscription, DCOM, DLL Hijacking): https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/ https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-2-dcom/ https://www.mdsec.co.uk/2020/10/i-live-to-move-it-windows-lateral-movement-part-3-dll-hijacking/
MDSec
I Like to Move It: Windows Lateral Movement Part 1 - WMI Event Subscription - MDSec
Overview Performing lateral movement in an OpSec safe manner in mature Windows environments can often be a challenge as defenders hone their detections around the indicators generated by many of...
Dead Ends in Cryptanalysis #2: Timing Side-Channels https://soatok.blog/2021/06/07/dead-ends-in-cryptanalysis-2-timing-side-channels/
Dhole Moments
Dead Ends in Cryptanalysis #2: Timing Side-Channels - Dhole Moments
Previously on Dead Ends in Cryptanalysis, we talked about length-extension attacks and precisely why modern hash functions like SHA-3 and BLAKE2 aren’t susceptible. The art and science of sid…
Mistune: Remote code execution vulnerabilities that have been hiding for a decade https://blog.chichou.me/mistune/
Mistune Bug
Mistune is a remote exploit demostrated at TianfuCup 2020. It consists of two bugs that were introduced by iOS 3 and iOS 6 respectively