Công Thành Nguyễn

Pwner, gacha player and meme maker.

[Công Thành Nguyễn @ExLuck99]

@bl4sty @orange_8361 The logic bug chain for browser rce is really insane.

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Công Thành Nguyễn @ExLuck99]

@yunsu_dev I once got my bug patched before the contest due to someone report it to the vendor and even once got duplicated because some team write down every bug they found even the one that not used or they not exploited it yet 😂 that's the game and you all have to face it.

[Công Thành Nguyễn @ExLuck99]

@yunsu_dev There is nothing wrong with report your bug to the vendor or any bug bounty program so you can at least get some reward for your finding. I don't know why people keep saying that "revenge" report like it a bad behaviour.

[Công Thành Nguyễn @ExLuck99]

@terrynini38514 @__suto @thezdi We submit 9 entries, yesterday they said they're reviewing and this morning they reply with out of entry slot 😂

[Công Thành Nguyễn @ExLuck99]

@__suto @terrynini38514 @thezdi :c at least you got accepted while we got none. They said out of slot lol

[Công Thành Nguyễn @ExLuck99]

@SinSinology Did you get any reply from the zdi?

[TrendAI Zero Day Initiative @thezdi]

Confirmed! @ExLuck99 and @gr4ss341 of ANHTUD chained two vulnerabilities (CWE‑125 and CWE‑122) to achieve code execution on the Sony XAV‑9500ES, earning $10,000 USD and 2 Master of Pwn points in Round 3. #Pwn2Own #P2OAuto

[Công Thành Nguyễn @ExLuck99]

@bl4sty Just whitepaper stuff. They want more details about the bug.

[Công Thành Nguyễn @ExLuck99]

😂 rip 10k. More careful next time.

[TrendAI Zero Day Initiative @thezdi]

Verified! Nao and @ExLuck99 from ANHTUD used a heap-based buffer overflow to exploit the Lexmark CX532adwe, but we penalized for a rules violation. The still earn $10,000 and 2 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Confirmed! ChatGPT helped Team ANHTUD as they used 3 bugs - 1 collision, 1 unique SSRF and 1 cleartext storage of sensitive information - to exploit Home Automation Green. They finished with just 45 seconds remaining. Their work earns them $16,750 and 3.75 Master of Pwn points. #Pwn2Own

[Khoa Dinh @_l0gg]

Blog for ToolShell
Disclaimer: The content of this blog is provided for educational and informational purposes only.
https://t.co/gT0aoKXkig
#SharePoint #ToolShell

[Công Thành Nguyễn @ExLuck99]

Sadly, I can't get to Berlin in time for P2O. So, just stay at home with an <(´= ⩊ =`)> elf in my Triton console. Good luck to all contestants out there.

[Mehdi @MehdiHacks]

🧵
Mega thread on RF, SDR, ham radio, and signal hacking:
I've been writing educational posts and threads on these topics.
To help finding them easier, I will put all the links here.
And I will link the new threads to the bottom of this meta thread every time I write one.

0/n

[TrendAI Zero Day Initiative @thezdi]

Confirmed! We were definitely thrilled to see @ExLuck99 and @greengrass19000 of ANHTUD use a command injection bug to exploit the Alpine IVI and leave us a special message. Their round 2 win earns them $10,000 and 2 Master of Pwn points. #P2OAuto

[Công Thành Nguyễn @ExLuck99]

Thanks you and good luck.

[Compass Security @compasssecurity]

The #Pwn2Own schedule is out. Compass folks will show off their exploit Thursday, January 23th, 10:00 Swiss time (CET). Also wishing @_moradek_, @moe_hw, @konatabrk, @vcslab, @EQSTLab, @kiddo_pwn, @ExLuck99, @nyanctl, @SinSinology, @SummoningTeam success in pwning the Alpine IVI.

[Công Thành Nguyễn @ExLuck99]

First time onsite with a funny bug. what a memorable day in Ireland.
#P2OIreland

[Công Thành Nguyễn @ExLuck99]

@thezdi @pivik_ :( @pivik_ is my colleague in the Qnap bug not my twitter handle.

[Kevin2600 @Kevin2600]

One of the must-attend talks this year is from @Yogehi. They will be sharing how @Xiaomi became the most secure mobile phone company on the planet. 🤩