rioru (Dany Bach)

Penetration tester & security researcher

[Coiffeur @Coiffeur0x90]

🏴‍☠️ I can finally share a VMware 0day I discovered that led to CVE-2026-41702 (LPE as root). Funny enough, I found the bug in my hotel room after the second day of attending Csaba Fitzl (@theevilbit) & Gergely Kalman (@gergely_kalman) training at Zer0con.

https://t.co/mG55Ksc4gE

[Aurélien Chalot @Defte_]

Funny tip, if you end up having a root access on a linux server with cortex installed, you can simply systemctl stop traps and disable it which will kill the agent for good. https://t.co/VVQf4bmakZ

[NK @Nikaiw]

meet VMkatz, https://t.co/eza4AXRuFT

[rioru (Dany Bach) @DDXhunter]

@andremoulu @CellebriteLabs Intéressé. 😀

[Ambionics Security @ambionics]

Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) https://t.co/7GQvKPszrl

[Ambionics Security @ambionics]

Introducing a new tool for #PHP filters attacks, #wrapwrap: an algorithm to add an arbitrary prefix and suffix to a PHP resource, improving the exploitation of file read and #SSRF vulnerabilities.

https://t.co/iP3DpFBEmx

[Ambionics Security @ambionics]

We've updated our blogpost about @ownCloud with an #exploit for #CVE-2023-49105 and a video.

https://t.co/6fDfMLHYC9

[Charles Fol @cfreal_]

The @owncloud CRITICAL vulnerabilities I reported (CVE-2023-49103, CVE-2023-49105) are now patched. Patch your #owncloud. Details when possible. #pwncloud

[rioru (Dany Bach) @DDXhunter]

@andremoulu @hexacon_fr @Cellebrite Intéressé !

[rioru (Dany Bach) @DDXhunter]

@fastfire Hello, that is a PoC for CVE-2022-42475 (you can read so in the readme, also by reading the exploit that is targeting the Content-Length issue from the previous CVE).

[rioru (Dany Bach) @DDXhunter]

This was a fun one! The vulnerability has been found and exploited during the timeframe of one of our Red Team engagements and allowed us to compromise our target entirely. Happy patch week! #xortigate

[Lexfo @LexfoSecurite]

#Fortinet patched #CVE-2023-27997, a critical vulnerability affecting its VPN #Fortigate. Our latest blogpost describes the technical details about the bug, a pre-auth heap overflow, with a twist. #xortigate
https://t.co/LZ1ynVNY7w

[Lexfo @LexfoSecurite]

#Fortinet patched #CVE-2023-27997, a critical vulnerability affecting its VPN #Fortigate. Our latest blogpost describes the technical details about the bug, a pre-auth heap overflow, with a twist. #xortigate
https://t.co/LZ1ynVNY7w

[rioru (Dany Bach) @DDXhunter]

@abasmayorr @BleepinComputer @LawrenceAbrams Yes, it is a vulnerability in the SSL-VPN component of Fortigate, disabling it should prevent exploitation.

[Charles Fol @cfreal_]

The IR number is 23-097. Patch your Fortigate. https://t.co/FdzjrnUAGy

[Charles Fol @cfreal_]

#Fortinet published a patch for CVE-2023-27997, the Remote Code Execution vulnerability @DDXhunter and I reported. This is reachable pre-authentication, on every SSL VPN appliance. Patch your #Fortigate. Details at a later time. #xortigate

[Lexfo @LexfoSecurite]

Introducing sshimpanzee, a reverse shell made by @TitouanLazard based on openssh's sshd. It supports DNS, ICMP and HTTP encapsulation as well as SOCKS and HTTP Proxies :
https://t.co/PmEIHODLru

[rioru (Dany Bach) @DDXhunter]

@ChiseLouve Pareil

[CVE @CVEnew]

CVE-2022-47949 The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. Th... https://t.co/pUb2RpqmwV

[Lexfo @LexfoSecurite]

Learn how we discovered 5 distinct vulnerabilities on @watchguard #Firebox/#XTM firewalls, and obtained a pre-auth Remote Code Execution as root #0day (CVE-2022-31789, CVE-2022-31790).
https://t.co/I2ixfZEAPK

[PT SWARM @ptswarm]

💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE!

Read the research: https://t.co/PJZHLRM8xq