A guest in another process - a story of a remote thread crash https://m417z.com/A-guest-in-another-process-a-story-of-a-remote-thread-crash/
M417Z
A guest in another process - a story of a remote thread crash
In one of my previous blog posts, Implementing Global Injection and Hooking in Windows, I wrote about my journey in implementing global DLL injection for Windhawk, the customization marketplace for Windows programs. If you haven’t read it yet, I invite you…
All about LeakSanitizer https://maskray.me/blog/2023-02-12-all-about-leak-sanitizer
MaskRay
All about LeakSanitizer
Clang and GCC 4.9 implemented LeakSanitizer in 2013. LeakSanitizer (LSan) is a memory leak detector. It intercepts memory allocation functions and by default detects memory leaks at atexit time. The i
How I hacked into a Telecom Network — Part 1 (Getting the RCE) https://infosecwriteups.com/how-i-hacked-into-a-telecom-network-part-1-getting-the-rce-167c2bb320e6
Medium
How I hacked into a Telecom Network — Part 1 (Getting the RCE)
TLDR; Red Team Engagement for a telecom company. Got a foothold on the company’s Network Monitoring System (NMS). Sorted reverse shell…
CVE-2022-22655 - TCC - Location Services Bypass
https://theevilbit.github.io/posts/cve-2022-22655/
https://theevilbit.github.io/posts/cve-2022-22655/
theevilbit blog
CVE-2022-22655 - TCC - Location Services Bypass
This is a quick blogpost about a vulnerability I covered in our Black Hat Europe 2022 talk with Wojciech Regula.
In contrary to what people would expect, clients which can access location services are not maintained in one of the TCC databased, but in a separate…
In contrary to what people would expect, clients which can access location services are not maintained in one of the TCC databased, but in a separate…
Exploiting a remote heap overflow with a custom TCP stack https://www.synacktiv.com/publications/exploiting-a-remote-heap-overflow-with-a-custom-tcp-stack.html
Synacktiv
Exploiting a remote heap overflow with a custom TCP stack
XXE with Auto-Update in install4j https://frycos.github.io/vulns4free/2023/02/12/install4j-xxe.html
Frycos Security Diary
XXE with Auto-Update in install4j
Storyline
Understanding Stealerium Malware and Its Evasion Techniques https://www.uptycs.com/blog/understanding-stealerium-malware-and-its-evasion-techniques
Uptycs
Understanding Stealerium Malware and Its Evasion Techniques
We observed an increase in promotion of Stealerium on hacker forums. This malware is used by cybercriminals focused on stealing account credentials.
Where there is love, there is ...malware?
Analyzing an undetected persistent macOS updater https://objective-see.org/blog/blog_0x72.html
Analyzing an undetected persistent macOS updater https://objective-see.org/blog/blog_0x72.html
objective-see.org
Where there is love, there is ...malware?
Analyzing an undetected persistent macOS updater
LokiBot packer analysis https://uint8ptr.github.io/posts/lokibot-packer/
uint8ptr.github.io
LokiBot packer analysis
Summary File type: Win32 EXE Size: 276.992 bytes MD5: 17a062692257bfe27e95a64a9e4e6a65 SHA1: 6580ac9fb2f54376ba1bea40f6339662dd1c76ab SHA256: faa18e54f144e8377cc6492f1daabeed658d4c2fbfdbdaf3caec6f5188c95ac9 This sample is a packed version of LokiBot. This…
C99Shell-PHP7 - PHP 7 And Safe-Build Update Of The Popular C99 Variant Of PHP Shell https://www.kitploit.com/2023/02/c99shell-php7-php-7-and-safe-build.html
KitPloit - PenTest & Hacking Tools
C99Shell-PHP7 - PHP 7 And Safe-Build Update Of The Popular C99 Variant Of PHP Shell
cURL audit: How a joke led to significant findings https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/
The Trail of Bits Blog
cURL audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually…
Server-side prototype pollution: Black-box detection without the DoS https://portswigger.net/research/server-side-prototype-pollution
PortSwigger Research
Server-side prototype pollution: Black-box detection without the DoS
Server-side prototype pollution is hard to detect black-box without causing a DoS. In this post, we introduce a range of safe detection techniques, which we've also implemented in an open source Burp
New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign https://blog.talosintelligence.com/new-mortalkombat-ransomware-and-laplas-clipper-malware-threats/
Cisco Talos
New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign
Since December 2022, Cisco Talos has been observing an unidentified actor deploying two relatively new threats, the recently discovered MortalKombat ransomware and a GO variant of the Laplas Clipper malware, to steal cryptocurrency from victims.
Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-1/
TimDbg
Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process
I’ve left the Microsoft Debugger Platform team twice, and each time I’ve started writing my own debugger. I must really like debuggers or something. This time, I have two reasons for writing a new debugger. The first is because I want to learn Rust better…
🤪2
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955 https://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955/
Decoder's Blog
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955
Summary A standard domain user can exploit Arbitrary File Write/Overwrite with NT AUTHORITY\SYSTEM under certain circumstances if Group Policy “File Preference” is configured. I reported this findi…
Bypassing Okta MFA Credential Provider for Windows https://www.n00py.io/2023/02/bypassing-okta-mfa-credential-provider-for-windows/
www.n00py.io
Bypassing Okta MFA Credential Provider for Windows
I'll state this upfront, so as not to confuse: This is a POST exploitation technique. This is mostly for when you have already gained admin on the system via other means and want to be able to RDP without needing MFA. Okta MFA Credential Provider for Windows…
Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/
STAR Labs
Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability
Introduction
I recently discovered a very interesting kernel vulnerability that allows the reading of arbitrary kernel-mode address. Sadly, the vulnerability was patched in Windows 21H2 (OS Build 22000.675), and I am unsure of the CVE being assigned to it.…
I recently discovered a very interesting kernel vulnerability that allows the reading of arbitrary kernel-mode address. Sadly, the vulnerability was patched in Windows 21H2 (OS Build 22000.675), and I am unsure of the CVE being assigned to it.…