🏴☠️ I can finally share a VMware 0day I discovered that led to CVE-2026-41702 (LPE as root). Funny enough, I found the bug in my hotel room after the second day of attending Csaba Fitzl (@theevilbit) & Gergely Kalman (@gergely_kalman) training at Zer0con.
https://t.co/mG55Ksc4gE
Funny tip, if you end up having a root access on a linux server with cortex installed, you can simply systemctl stop traps and disable it which will kill the agent for good. https://t.co/VVQf4bmakZ
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) https://t.co/7GQvKPszrl
Introducing a new tool for #PHP filters attacks, #wrapwrap: an algorithm to add an arbitrary prefix and suffix to a PHP resource, improving the exploitation of file read and #SSRF vulnerabilities.
https://t.co/iP3DpFBEmx
The @owncloud CRITICAL vulnerabilities I reported (CVE-2023-49103, CVE-2023-49105) are now patched. Patch your #owncloud. Details when possible. #pwncloud
@fastfire Hello, that is a PoC for CVE-2022-42475 (you can read so in the readme, also by reading the exploit that is targeting the Content-Length issue from the previous CVE).
This was a fun one! The vulnerability has been found and exploited during the timeframe of one of our Red Team engagements and allowed us to compromise our target entirely. Happy patch week! #xortigate
#Fortinet patched #CVE-2023-27997, a critical vulnerability affecting its VPN #Fortigate. Our latest blogpost describes the technical details about the bug, a pre-auth heap overflow, with a twist. #xortigate
https://t.co/LZ1ynVNY7w
#Fortinet patched #CVE-2023-27997, a critical vulnerability affecting its VPN #Fortigate. Our latest blogpost describes the technical details about the bug, a pre-auth heap overflow, with a twist. #xortigate
https://t.co/LZ1ynVNY7w
#Fortinet published a patch for CVE-2023-27997, the Remote Code Execution vulnerability @DDXhunter and I reported. This is reachable pre-authentication, on every SSL VPN appliance. Patch your #Fortigate. Details at a later time. #xortigate
Introducing sshimpanzee, a reverse shell made by @TitouanLazard based on openssh's sshd. It supports DNS, ICMP and HTTP encapsulation as well as SOCKS and HTTP Proxies :
https://t.co/PmEIHODLru
CVE-2022-47949 The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. Th... https://t.co/pUb2RpqmwV
Learn how we discovered 5 distinct vulnerabilities on @watchguard#Firebox/#XTM firewalls, and obtained a pre-auth Remote Code Execution as root #0day (CVE-2022-31789, CVE-2022-31790).
https://t.co/I2ixfZEAPK
💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE!
Read the research: https://t.co/PJZHLRM8xq