Posted by Tavis Ormandy, Project Zero Introduction This is an unusual blog post. I normally write posts to highlight some hidden attack surface or interest...

During the last two weeks of my summer (as of writing, summer 2021), I decided to try and take a crack at iOS 14 kernel exploitation with the IOMobileFramebuffer OOB pointer read (CVE-2021-30807). Unfortunately, a couple days after I moved back into school…

Emotet, the malware botnet, has resurfaced after almost 10 months. The operation was originally taken down by multiple international law enforcement agencies this past January. These agencies took control of the infrastructure and scheduled an un-installation…

Unpacking and decryption tools for the Emotet malware - deepinstinct/DeMotet

Over the years I’ve seen a lot of misconfigurations or a lack of configurations when it comes to protecting Windows credentials, hashes or Kerberos tickets. The main difficulty here comes fro…

CVE-2021-42008 is a Slab-Out-Of-Bounds Write vulnerability in the Linux 6pack driver caused by a missing size validation check in the decode_data function. A malicious input from a process with CAP_NET_ADMIN capability can lead to an overflow in the cooked_buf…

Bug Bounty Automation is the key to success for many expert bug bounty hunters including Hakluke. He walks through how he does it.

Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms-officecmd URI…

We have been tracking a campaign involving the SpyAgent malware that abuses well-known remote access tools (RATs) — namely TeamViewer — for some time now. While previous versions of the malware have been covered by other researchers, our blog entry focuses…

SentinelLabs has discovered a heap overflow vulnerability in the TIPC module of the Linux Kernel which can allow attackers to compromise an entire system.

Resources to help get started with IoT Pentesting - adi0x90/IoT-Pentesting-Methodology

We examine an emerging business model that involves access brokers selling direct access to organizations and stolen credentials to other malicious actors.

When in password hunting mode and having access to the filesystem of the target, most people would reach out to SAM and/or extracting cached credentials.
While this can usually be the way to go, it can pose a huge challenge, as the result can depend on the…