MeshyJSON: A TP-Link tdpServer JSON Stack Overflow https://research.nccgroup.com/2022/12/19/meshyjson-a-tp-link-tdpserver-json-stack-overflow/
Nccgroup
Cyber Security Research
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
Better Make Sure Your Password Manager Is Secure
Or Someone Else Will https://www.modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html
Or Someone Else Will https://www.modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html
Modzero
Better Make Sure Your Password Manager Is Secure | mod%log
We examined the password management solution Passwordstate of Click Studios and identified multiple high severity vulnerabilities (CVE-2022-3875, CVE-2022-3876, CVE-2022-3877).
What I Learned from Analyzing a Caching Vulnerability in Istio https://www.cyberark.com/resources/threat-research-blog/what-i-learned-from-analyzing-a-caching-vulnerability-in-istio
Cyberark
What I Learned from Analyzing a Caching Vulnerability in Istio
TL;DR Istio is an open-source service mash that can layer over applications. Studying CVE-2021-34824 in Istio will allow us to dive into some concepts of Istio and service meshes in general. We...
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange https://securelist.com/cve-2022-41040-and-cve-2022-41082-zero-days-in-ms-exchange/108364/
Securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
At the end of September, GTSC reported the finding of two 0-day vulnerabilities in Microsoft Exchange Server, CVE-2022-41040 and CVE-2022-41082. The cybersecurity community dubbed the pair of vulnerabilities ProxyNotShell.
Attacking Titan M with Only One Byte https://blog.quarkslab.com/attacking-titan-m-with-only-one-byte.html
Quarkslab
Attacking Titan M with Only One Byte - Quarkslab's blog
Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.
Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg https://blog.exodusintel.com/2022/12/19/linux-kernel-exploiting-a-netfilter-use-after-free-in-kmalloc-cg/
Exodus Intelligence
Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg - Exodus Intelligence
By Sergi Martinez Overview It’s been a while since our last technical blogpost, so here’s one right on time for the Christmas holidays. We describe a method to exploit a use-after-free in the Linux kernel when objects are allocated in a specific slab cache…
DirtyCred Remastered: how to turn an UAF into Privilege Escalation https://exploiter.dev/blog/2022/CVE-2022-2602.html
LukeGix
DirtyCred Remastered
DirtyCred Remastered: how to turn an UAF into Privilege Escalation
What child is this? https://blog.trailofbits.com/2022/12/20/process-reparenting-microsoft-windows/
The Trail of Bits Blog
What child is this?
A Primer on Process Reparenting in Windows. Process reparenting is a technique used in Microsoft Windows to create a child process under a different parent process than the one making the call to CreateProcess. Malicious actors can use this technique to evade…
👍1
Introduction to the Windows Filtering Platform https://scorpiosoftware.net/2022/12/25/introduction-to-the-windows-filtering-platform/
Pavel Yosifovich
Introduction to the Windows Filtering Platform
As part of the second edition of Windows Kernel Programming, I’m working on chapter 13 to describe the basics of the Windows Filtering Platform (WFP). The chapter will focus mostly on kernel-…
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy https://blog.cluster25.duskrise.com/2022/12/22/an-infostealer-comes-to-town
Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities https://www.trendmicro.com/en_us/research/22/l/diving-into-an-old-exploit-chain-and-discovering-3-new-sip-bypas.html
Trend Micro
Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities
More than two years ago, a researcher, A2nkF demonstrated the exploit chain from root privilege escalation to SIP-Bypass up to arbitrary kernel extension loading. In this blog entry, we will discuss how we discovered 3 more vulnerabilities from the old exploit…
Dissecting FortiGate Images for fun and non-profit https://www.divd.nl/2022/12/26/dissecting-fortigate-images-for-fun-and-no-profit/
Pass-the-Challenge: Defeating Windows Defender Credential Guard https://research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22
Medium
Pass-the-Challenge: Defeating Windows Defender Credential Guard
In this blog post, we present new techniques for recovering the NTLM hash from an encrypted credential protected by Windows Defender…
🔥1
A tale of a simple Apple kernel bug https://pwning.systems/posts/easy-apple-kernel-bug/
pwning.systems
A tale of a simple Apple kernel bug
Earlier this year, I discovered a flaw in XNU, which is the kernel that Apple uses on both macOS and iOS. While it's not a particularly complicated flaw, I wanted to explain how I discovered it and how it works, both so that I can motivate others and so that…
CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM https://github.com/kkent030315/CVE-2022-42046
GitHub
GitHub - kkent030315/CVE-2022-42046: CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM
CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM - kkent030315/CVE-2022-42046
A brief analysis of Hornet Ransomware https://rixed-labs.medium.com/a-brief-analysis-of-hornet-ransomware-ec958e9cf310
Medium
A brief analysis of Hornet Ransomware
Hey readers, hope everyone is having a good time. Once again I decided to write blogs for the community on topics I stumble upon. I hope…