GULoader Campaigns: A Deep Dive Analysis of a highly evasive Shellcode based loader https://www.mcafee.com/blogs/other-blogs/mcafee-labs/guloader-campaigns-a-deep-dive-analysis-of-a-highly-evasive-shellcode-based-loader/
McAfee Blog
GULoader Campaigns: A Deep Dive Analysis of a highly evasive Shellcode based loader | McAfee Blog
Authored by: Anandeshwar Unnikrishnan Stage 1: GULoader Shellcode Deployment In recent GULoader campaigns, we are seeing a rise in NSIS-based installers
Fantastic Rootkits: And Where to Find Them (Part 1) https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1
Cyberark
Fantastic Rootkits: And Where to Find Them (Part 1)
Introduction In this blog series, we will cover the topic of rootkits — how they are built and the basics of kernel driver analysis — specifically on the Windows platform. In this first part, we...
👍2
Analysis of DHCP Service Remote Code Execution Vulnerability CVE-2023–28231https://medium.com/numen-cyber-labs/analysis-of-dhcp-service-remote-code-execution-vulnerability-cve-2023-28231-a4ce9f3a3fd
Medium
Analysis of DHCP Service Remote Code Execution Vulnerability CVE-2023–28231
CVE-2023–28231 Patch Analysis, with PoC
👍1
BOF in Stockfish: interesting discussion (without being solved) https://github.com/official-stockfish/Stockfish/pull/4558
GitHub
Increase MAX_MOVES to prevent buffer overflow and stack corruption by ZealanL · Pull Request #4558 · official-stockfish/Stockfish
SF's move buffer ExtMove moveList[MAX_MOVES] assumes a maximum move count of 256, but there are many "impossible" positions in which more than 256 moves are generated.
Whe...
Whe...
Escaping Parallels Desktop with Plist Injection https://pwn.win/2023/05/08/parallels-escape.html
pwn.win
Escaping Parallels Desktop with Plist Injection
This post details two bugs I found, a plist injection (CVE-2023-27328) and a race condition (CVE-2023-27327), which could be used to escape from a guest Parallels Desktop virtual machine. In this post I’ll break down the findings.
Detecting and Evading Sandboxing through Time based evasion https://shubakki.github.io/posts/2022/12/detecting-and-evading-sandboxing-through-time-based-evasion/
A list of resources related to warez https://community.thecreed.xyz/c/warez/
On Ashton Kutcher and Secure Multi-Party Computation https://blog.cryptographyengineering.com/2023/05/11/on-ashton-kutcher-and-secure-multi-party-computation/
A Few Thoughts on Cryptographic Engineering
On Ashton Kutcher and Secure Multi-Party Computation
Back in March I was fortunate to spend several days visiting Brussels, where I had a chance to attend a panel on “chat control”: the new content scanning regime being considered by the …
Pwn2Own Toronto 22: Exploit Netgear Nighthawk RAX30 Routers https://claroty.com/team82/research/chaining-five-vulnerabilities-to-exploit-netgear-nighthawk-rax30-routers-at-pwn2own-toronto-2022
Claroty
Pwn2Own Toronto 22: Exploit Netgear Nighthawk RAX30 Routers
Unveiling IoT Vulnerabilities: A Deep Dive into Netgear RAX30 Router Research from Pwn2Own Competition | Discover the insights gained from our investigation into the security weaknesses of IoT devices, as we analyze the Netgear RAX30 router in the renowned…
Experts Detail New Zero-Click Windows Vulnerability for NTLM Credential Theft https://thehackernews.com/2023/05/experts-detail-new-zero-click-windows.html
RET2ASLR - Leaking ASLR from return instructions https://github.com/google/security-research/tree/master/pocs/cpus/ret2aslr
GitHub
security-research/pocs/cpus/ret2aslr at master · google/security-research
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code. - google/security-research
SSHD Injection and Password Harvesting
https://jm33.me/sshd-injection-and-password-harvesting.html
https://jm33.me/sshd-injection-and-password-harvesting.html
jm33_ng
SSHD Injection and Password Harvesting
TL;DR The source code of this idea is available on GitHub And the weaponized version is available in emp3r0r Use echo 'print __libc_dlopen_mode("/path/to/library.so", 2)' | gdb -p <PID> for process injection Write a shared library to inject into sshd process…
The printer goes brrrrr, again! https://www.synacktiv.com/publications/the-printer-goes-brrrrr-again
Synacktiv
The printer goes brrrrr, again!
Prompt injection explained, with video, slides, and a transcript https://simonwillison.net/2023/May/2/prompt-injection-explained/
Simon Willison’s Weblog
Prompt injection explained, with video, slides, and a transcript
I participated in a webinar this morning about prompt injection, organized by LangChain and hosted by Harrison Chase, with Willem Pienaar, Kojin Oshiba (Robust Intelligence), and Jonathan Cohen and Christopher …
Linux ptrace introduction AKA injecting into sshd for fun https://blog.xpnsec.com/linux-process-injection-aka-injecting-into-sshd-for-fun/
XPN Infosec Blog
@_xpn_ - Linux ptrace introduction AKA injecting into sshd for fun
If there is one thing I've come to appreciate over this past few weeks, it's just how much support you are provided from the Win32 API. That being said, I wanted to tackle some Linux process injection, with the aim of loading a shared object into another…
Testing a new encrypted messaging app's extraordinary claims https://crnkovic.dev/testing-converso/
crnkovic.dev
Testing a new encrypted messaging app's extraordinary claims
How I breached a nonexistent database and found every private key in a 'state-of-the-art' encrypted messenger.
Fork off: Three ways to deal with forking processes https://www.skullsecurity.org/2023/fork-off-three-ways-to-deal-with-forking-processes
SkullSecurity Blog
Fork off: Three ways to deal with forking processes
Have you ever tested a Linux application that forks into multiple processes? Isn’t it a pain? Whether you’re debugging, trying to see a process crash, or trying to write an exploit, it can be super duper annoying! In a few days, I’m giving a talk at NorthSec…