Security Review #246

In this post, we will see how attackers can manipulate LLM inputs, exploit logic flaws, or abuse AI features to gain unauthorized access, steal data, or compromise systems. We will focus on prompt injection, excessive agency, sensitive information disclosure and improper output handling vulnerabilities.

In this blog post, I demonstrate how every single security feature of PowerShell can be defeated using native code instead of the higher-level .NET framework. I provide examples showing the proof-of-concept on a machine running a top-tier EDR agent with no detection of the memory patching.

We discover 119 vulnerabilities in LTE/5G core infrastructure, each of which can result in persistent denial of cell service to an entire metropolitan area or city and some of which can be used to remotely compromise and access the cellular core. Our research covers seven LTE implementations (Open5GS, Magma, OpenAirInterface, Athonet, SD-Core, NextEPC, srsRAN) and three 5G implementations (Open5GS, Magma, OpenAirInterface)

This article explores how the Alt-Svc header can be abused to setup a man-in-the-middle, first step of a cross-protocol attack leveraging compression and certificate reuse between different protocols (HTTP and FTP) to eventually break TLS encryption.

In this article, we analyze the patch related to an USB Restricted Mode bypass in iOS (CVE-2025-24200) and identify the main attack vector.

In this article we will create a Ghidra processor module for the iRISC processors, these processors are embedded in the ConnectX series of NICs from NVIDIA/Mellanox.

In this article, we develop an exploit for an RCE vulnerability in XiongMai's uc-httpd, a lightweight web server used in countless IP cameras worldwide (CVE-2022-45460).

This blog post aims to showcase a couple of bugs affecting Valve's Steam Deck and generally various devices running on AMD. Some of the primitives induced by these bugs are very limited and offer a good playground to work on exploitation techniques.

This is a write-up of CVE-2024-12425 and CVE-2024-12426, two vulnerabilities in LibreOffice which respectively allow an attacker to write to a semi-arbitrary file in the filesystem, and remotely extract values from environment variables and from INI-like files in the filesystem.

In this piece of writing, we will explore various components of the DNS ecosystem, including the root zone, authoritative name servers, registrars, registries, EPP, and How Sacrificial Nameservers allowed possible DNS hijacking of 1.6+ million domains.

We detail a critical security vulnerability, tracked as CVE-2024-0132, in the widely used NVIDIA Container Toolkit. The vulnerability enables attackers who control a container image executed by the vulnerable toolkit to escape from the container's isolation and gain full access to the underlying host.

In this article, I'll explain how I managed, with a bit of creativity, to chain a few vulnerabilities and strange features together to achieve Remote Code Execution (RCE) on the SuiteCRM application (CVE-2024-36415).

This article will discuss baseline analysis, a crucial technique in memory forensics, enabling rapid identification of suspicious activity by filtering known good artifacts. We will also see how Memory Baseliner simplifies this process, providing efficient comparisons between suspect and clean memory images.

When it comes to forensic tools, MFTECmd.exe is one of my go-to choices. It's part of the KAPE suite and an incredibly efficient tool for parsing NTFS artifacts like $MFT, $J, $Boot, $SDS, and $I30. While I've always relied on it, many have requested a detailed guide, so here we are.

This article reviews the fundamentals of WMI Events Queries and Consumers. We will then discuss what are Evil WMI Consumers and how to find them.

In this post, I want to explore if there are any specifics in how Windows 11 records ShellBags for common user operations within Windows Explorer, with a specific focus on timestamps that indicate user interactions with directories, i.e. "FirstInteracted" and "LastInteracted" fields.

Malware persistence remains one of the most challenging aspects of cybersecurity. In this article, I explore how threat actors have leveraged a modified version of SharpHide to create hidden registry values which takes advantage of Windows registry redirection, complicating detection and deletion efforts.

Window functions are one of the powerful methods for data analysis. In this post, I will briefly explain two KQL (Kusto Query Language) window functions, prev() and next(), and how to use them for threat hunting.

This article details some creative and/or complex persistence mechanisms. We will explore the abuse of PAM modules and pam_exec, installer package manipulation via RPM and DPKG, and malicious Docker containers.

In this post, we explore the exploitation technique known as the Shadow Credentials attack. This attack leverages the mismanagement or exploitation of Active Directory Certificate Services (AD CS) to inject custom certificates into a user account, granting attackers persistent access.

We share a detailed root causes analysis for CVE-2024-8963 (likely covering CVE-2024-9381 as well), as a path traversal vulnerability in Ivanti CSA, enabling remote unauthenticated attacker to access restricted functionality.

We will delve into the world of tunneling techniques commonly used by adversaries to identify exactly how common some of the major tunneling providers are for various threat actors. We'll also explore another technology often used alongside tunnels: dynamic DNS hostnames.

In this article, we will cover the infection chain observed with SocGholish, also being tracked as FakeUpdates. Detection rules and indicators of compromise will be included at the end of the article.

I came across a technique that allows bypassing Windows Defender's detection mechanisms specifically designed to identify LSASS (Local Security Authority Subsystem Service) dumps. My investigation aims to shed light on its implications and understand why it has not been addressed in the current iteration of the operating system.

This blog will go through the methods to bypass AMSI, both theoretically in detailed and practically, with three simple yet effective PowerShell command lines. We'll also cover how to abuse .NET capabilities to run PowerShell commands without actually using PowerShell itself, as well as how to evade detection using tools like Invoke-Obfuscation.

This post details how I transformed an XSS into a 1-click account takeover despite a HttpOnly protected session cookie.

ChatGPT Operator is a research preview agent from OpenAI that lets ChatGPT use a web browser. This post explores how it can be hijacked through prompt injection exploits on web pages, leading to unauthorized data leakage of personal information.

I found a way to execute any code on the VirtualBox Windows 10 variant of the Microsoft Edge Developer VM, an image that Microsoft published to test out your website with different versions of Edge or Internet Explorer.

Arechclient2, also known as sectopRAT, is a Remote Access Trojan (RAT) written in .NET. This malware is highly obfuscated using the calli obfuscator, making its analysis challenging. Despite attempting deobfuscation using calliFixer, the code remained obfuscated but was still somewhat readable using dnSpy.

In this first part of the series, we will see how attackers manipulate their GitHub information to make their profile more attractive and will not raise any suspicions when posting a malicious code or asking to contribute to a popular open-source project.

In this article, I detail a remote code execution vulnerability that chains multiple problems in Chatwork, a popular communication tool in Japan. Specifically, I explain how I leveraged an obsolete feature of Electron to escalate to the preload context.

We discovered four critical vulnerabilities in Ivanti Endpoint Manager (EPM) allowing an unauthenticated attacker to coerce the Ivanti EPM machine account credential to be used in relay attacks, potentially allowing for server compromise.

We describe, in very general terms, how we were able to evade detection by taking advantage of statistical anomalies in the human interaction modules of several sandbox solutions. We provide an alternative algorithm for simulated mouse human interaction, including its specifications, parameters, source code, and several visual demonstrations.

NTDS.dit is the file housing the data for Windows Active Directory (AD). In this blog post, I'll be diving into how the file can be accessed nd how it is organized. I will also walk through DIT Explorer, an open-source tool used to search NTDS.dit and show how it makes sense of this database to present a view of the directory.

secretsdump.py allows retrieving specific secrets in the registry from a targeted computer, but it also allows performing DCSync operations when targeting a domain controller. This blogpost will focus only on the remote registry part, without using the vssadmin approach.

I am disclosing a 0-day vulnerability that bypasses the patch for CVE-2024-34331, a vulnerability abusing Parallels Desktop's trust in macOS installers, gaining local privilege escalation. I have identified two distinct methods to circumvent the fix.

This article introduces SACL_Scanner, a tool designed to aid in identifying the configured trip flares so we can avoid them. Currently, it will scan for SACLs on three local Windows securable objects and AD: registry keys, services, files/directories, and AD objects.

We identified a malicious PyPI package named pycord-self, which targets developers seeking Python wrappers for the Discord user API. This malicious package enables attackers to steal Discord authentication tokens and gain remote control over their systems through a backdoor persistence mechanism.

In this blog post, we will delve into the design and functionality of ARM Pointer Authentication, exploring how it mitigates a variety of attack vectors, such as buffer overflows and control flow hijacking. We will also discuss its practical applications and the unique advantages it offers in environments that demand a balance between performance, size, and robust protection.

This article details the steps that lead to the finding of a 7 years old use after free vulnerability in the core of the TCP subsystem of the Linux kernel.

CVE-2023-26083 is a kernel address disclosure bug affecting certain versions of the Mali GPU Kernel driver on ARM64 devices. The bug arises because the driver logs raw kernel pointers into a timeline stream ring buffer that is directly accessible to user space.

SeDebugPrivilege is a special privilege that when assigned gives a token high integrity. This privilege is often used in offensive tooling because it is known to pass over certain Windows access checks. Let's dive into this a bit more in-depth.

Detecting cloud account takeover (ATO) and adversary in the middle (AiTM) attacks can sometimes be difficult. In this blog, I'll explain how we can develop a generic detection that covers almost any, if not all, methods for Entra ID (Azure AD). The method can be applied to other identity providers, too.

This document provides an overview of the most common attack vectors on GitHub workflows and recommendations on how to secure them. In particular, it covers: running untrusted code in privileged workflows, code injections, vulnerable actions, malicious releases, tag-renaming attacks, imposter commits, and unsafe use of caches.

This blog post presents a development method that can be leveraged by malicious actors in order to create and execute payloads. We will analyse the COFF file and how a COFF loader works through an example of AMSI byte patching technique which implemented as a COFF object.

Malware can often be detected by scanning for a particular string or a sequence of bytes that identifies a family of malware. Yara is a tool that helps you do that. In this article, we will see how to generate Yara rules used to search for specific patterns in files that might indicate that the file is malicious.

This article will explain a remote code execution path leveraging the Spring Expression Language ( SpEL for short ) mechanism. It can expose the application to further attacks such as Cross-Site Scripting (XSS) or even Remote Code Execution (RCE).

This post describes a kernel mode payload for Windows NT called "SassyKitdi" (LSASS + Rootkit + TDI). This payload is of a nature that can be deployed via remote and local kernel exploits, and is universal from (at least) Windows 2000 to Windows 10, and without having to carry around weird DKOM offsets.