ddaa

I'm ddaa, aka 0xddaa.
Researcher @TrapaSecurity

[NiNi @terrynini38514]

Another year of DEF CON CTF.

We don’t say we are a team with all Taiwanese,
we say we are a team with all Orange fans.

[Orange Tsai 🍊 @orange_8361]

And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work

— excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦

[ddaa @0xddaa]

human hacker never die 🙏

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[TrendAI Zero Day Initiative @thezdi]

Amaze! Amaze! Amaze! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) was able to exploit Edge with a sandbox escape! If confirmed, we wins $175K. He's off to the disclosure room to explain how he did it. #Pwn2Own #P2OBerlin

[Calif @calif_io]

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

https://t.co/Cv8M69i1Mk

[binaryboy @b1n4r1b01]

Brief info and POC for this week's Apple 0click iOS 18.6.1 RCE bug CVE-2025-43300 https://t.co/EL3qg56N8X

[Orange Tsai 🍊 @orange_8361]

Turns out my #PHRACK article is live! 🔥

> The Art of PHP — My CTF Journey and Untold Stories!

Kinda a love letter to those CTF players & PHP nerds! Hope all the credit goes to the right ppl. Also huge thanks to @0xdea for not forgetting me, @guitmz for the edits, and the @Phrack crew for keeping it real! 🎉

https://t.co/BMCLlHti7q

[HITCON @HacksInTaiwan]

HITCON 2025 - Kernel 不死！Windows 與 Linux 核心漏洞的進擊💥

從 Windows 的 Kernel Streaming 到 Linux 的 net/sched 模組，現代作業系統儘管層層防護、緩解機制日新月異，但這些防線背後依然潛藏著漏洞溫床。在本次議程雙響炮中，我們將帶你直擊兩場由頂尖研究者針對核心漏洞的探索旅程——踏上學習進階漏洞利用與繞過緩解措施的技巧，全面揭示 OS 核心防線下仍持續滲漏的真實現況。

🎥 Frame by Frame, Kernel Streaming Keeps Giving Vulnerabilities - angelboy
Kernel Streaming 去年成為 Windows 核心中備受關注的攻擊面，講者將揭露超過 10 個「由網路攝影機影像輸入觸發」的全新漏洞類型，精心構造的 frame 可觸發任意實體記憶體寫入，有效繞過現代核心防禦機制。本議程不只拆解設計缺陷，也示範如何從看似無法利用的 bug 建立穩定提權 exploit，教你辨識更多本地提權機會並強化防禦思維。想知道影像如何攻破核心？這場絕對不容錯過！

🐧 正確入侵 Linux 的方式：Zero Day、嶄新技巧與失敗的教訓 - Pumpkin
Linux kernel 漏洞利用難度向來高，但這位講者在 kernelCTF 的實戰環境中，針對 net/sched 子系統漏洞運用兩項新穎技巧，成功在最新 LTS 版本實現提權至 root：
🔹 劫持次級物件，簡化 Use-After-Free (UAF) 漏洞利用
🔹 控制 kernel 變數，即使僅有 kernel base 洩漏，也能構造偽造物件或 ROP 鏈
除了技術細節，講者也會分享研究歷程與心得，談談 Linux kernel 研究心態、漏洞開發方法，以及從中衍生的嶄新技巧。

不論你是 Windows、Linux 陣營，這兩場演講都將帶你見識核心漏洞研究的尖端進展，學習如何發掘潛藏在現代作業系統中的設計破口，並掌握突破緩解機制的進階思維。

🔗購票連結：https://t.co/ShKVA1Sjnq
🎙️完整議程表：https://t.co/GyxPc2JL3e

#HITCON #HITCON2025 #漏洞研究 #提權攻擊 #資安議程

[HITCON @HacksInTaiwan]

🎉 感謝所有隊伍參與 HITCON Cyber Range 2025 資格賽！

各位資安好手辛苦了！感謝大家熱情參與 HITCON Cyber Range 2025 資格賽，本次競賽由 HITCON 與 TRAPA Security 共同舉辦！吸引來自全球各地的隊伍參戰，共計 43 支企業藍隊參與角逐，其中 37 支來自台灣，6 支為國際隊伍，分別來自馬來西亞、日本與蒙古。歷經 14 小時不間斷的實戰挑戰，每一隊都展現出超強應變力與堅強團隊合作精神，讓整場比賽精彩萬分、高潮迭起！
我們目前正積極彙整比賽數據與審核結果，並將於近期內正式公告晉級隊伍名單，請持續鎖定我們的官方社群與網站，以掌握第一手消息！📢
資格賽雖已落幕，但精彩才正要開始——誰能挺進 10 月總決賽舞台，爭奪最強藍隊榮耀？讓我們繼續見證這場資安盛事的每一個高光時刻！🔥

📍敬請持續關注 HITCON Cyber Range 2025，更多精彩即將揭曉！
📅決賽： 2025 年 10 月 17 日 (五)
🕙 10:00 至 16:00（共 6 小時, UTC+8） 現場決戰！
📩 聯絡信箱：[email protected]

🚀 Thank You for Joining the HITCON Cyber Range 2025 Qualifiers!
Dear cybersecurity experts, thank you for your hard work! We sincerely appreciate everyone’s enthusiastic participation in the HITCON Cyber Range 2025 Qualifiers. The event was jointly organized by HITCON and TRAPA Security and attracted teams from around the world, who faced an intense 14-hour nonstop practical challenge. A total of 43 teams participated, including 37 from Taiwan and 6 international teams representing Malaysia, Japan, and Mongolia.
Each team demonstrated exceptional adaptability and strong teamwork, making the competition thrilling and full of highlights!

We are currently consolidating the competition data and reviewing the results. The list of teams advancing to the next stage will be officially announced soon. Please stay tuned to our official social channels and website to get the latest updates! 📢

Although the qualifiers have concluded, the excitement is just beginning—who will make it to the grand finals in October to compete for the ultimate Blue Team glory? Let’s continue to witness every shining moment of this cybersecurity spectacle! 🔥

📍Keep following HITCON Cyber Range 2025—more highlights and surprises are on the way!
📅 Final : Friday, Oct. 17, 2025
🕙 10:00 – 16:00 (6 hours, UTC+8), Onsite.
📩 Contact Email: [email protected]

#HITCON #CyberRange #HITCONCyberRange2025 #資安競賽 #藍隊 #CyberSecurityCompetition #BlueTeam #IncidentResponse

[NiNi @terrynini38514]

"For anyone who dares to call themselves a researcher, this exam should be easy enough to make you laugh."
https://t.co/J9zjOr6CbJ

My new blog post shares my thoughts on OSEE.
Where is the learning path?
Where is the value of the course?
Is the course still relevant today?
Will it help you get a job?

[offensivecon @offensive_con]

#OffensiveCon25 videos are now up!

https://t.co/aRzmXS7iPA

[ddaa @0xddaa]

@freetsubasa 口以帶我到鑽石ㄇ

[ddaa @0xddaa]

@freetsubasa 瘦趴

[0xor0ne @0xor0ne]

Exploiting CVE-2024-26581: use-after-free in Linux kernel nftables subsystem

https://t.co/YX0UdVreSu

#Linux #cybersecurity

[ddaa @0xddaa]

@freetsubasa 我有獵人執照悠遊卡

[Seth Jenkins @__sethJenkins]

Unfixed issue derestricted! Another UAF in adsprpc :(
https://t.co/HC3aiWnKps

[NiNi @terrynini38514]

Tips for Pwn2Own player: pick a target that no one care, then you got no collision.

Shout out to my colleague: @h3xr4bb1t
We manage to bypass all the hardware protection together 🎉

[Dor @Dor00tkit]

I implemented a PoC for CVE-2024-30090, which @scwuaptx discovered. The PoC uses an arbitrary increment primitive on nt!SeDebugPrivilege to escalate privileges to SYSTEM.
https://t.co/Is4oKsShDF
#CVE-2024-30090 #PoC #LPE

[ddaa @0xddaa]

比起程式 bug，網路 bug 真的更 g8 難搞，程式的 bug 程式碼都攤在眼前，看不出來是自己悟性不夠，網路都靠通靈才有辦法猜出問題 ==