Công Thành Nguyễn

Pwner, gacha player and meme maker.

[Công Thành Nguyễn @ExLuck99]

@greengrass19000 Ngon luôn :)))

[TrendAI Zero Day Initiative @thezdi]

2 unique bugs and down went the Lexmark CX532adwe as Cong Thanh (@ExLuck99), Duc Hieu (@gr4ss341) and Nam Dung (@greengrass19000) earned $5,000 and 2 Master of Pwn points in their successful exploit attempt #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Confirmed! In the penultimate exploit of Day 1, Cong Thanh (@ExLuck99), Duc Hieu (@gr4ss341) and Nam Dung (@greengrass19000) used an OOB Write to exploit Canon imageFORCE 1643F. They win $10,000 and 2 Master of Pwn points. #Pwn2Own

[Nicolas Krassas @Dinosn]

From AI Agents to RCE - Building a Vulnerability Research Workflow https://t.co/P5Waw4AMG5

[Công Thành Nguyễn @ExLuck99]

Found two arbitrary installation chains on Samsung Galaxy.
> Vendor said both are duplicate and they already prepared a patch for it.
> New version arrive, only the USB chain got fixed while the remote still remain untouch.
> Hot patch before p2o is coming but I can't prove it.

[Toan Pham @__suto]

22 Windows LPE reported by one of my colleagues at @Seasecresponse .
This data should not be in any public dataset so if you plan to do any fine-tuning it would be helpful we hope.
All credit goes to him.
https://t.co/FnkQe5jWd4

[Công Thành Nguyễn @ExLuck99]

@bl4sty @orange_8361 The logic bug chain for browser rce is really insane.

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Công Thành Nguyễn @ExLuck99]

@yunsu_dev I once got my bug patched before the contest due to someone report it to the vendor and even once got duplicated because some team write down every bug they found even the one that not used or they not exploited it yet 😂 that's the game and you all have to face it.

[Công Thành Nguyễn @ExLuck99]

@yunsu_dev There is nothing wrong with report your bug to the vendor or any bug bounty program so you can at least get some reward for your finding. I don't know why people keep saying that "revenge" report like it a bad behaviour.

[Công Thành Nguyễn @ExLuck99]

@terrynini38514 @__suto @thezdi We submit 9 entries, yesterday they said they're reviewing and this morning they reply with out of entry slot 😂

[Công Thành Nguyễn @ExLuck99]

@__suto @terrynini38514 @thezdi :c at least you got accepted while we got none. They said out of slot lol

[Công Thành Nguyễn @ExLuck99]

@SinSinology Did you get any reply from the zdi?

[TrendAI Zero Day Initiative @thezdi]

Confirmed! @ExLuck99 and @gr4ss341 of ANHTUD chained two vulnerabilities (CWE‑125 and CWE‑122) to achieve code execution on the Sony XAV‑9500ES, earning $10,000 USD and 2 Master of Pwn points in Round 3. #Pwn2Own #P2OAuto

[Công Thành Nguyễn @ExLuck99]

@bl4sty Just whitepaper stuff. They want more details about the bug.

[Công Thành Nguyễn @ExLuck99]

😂 rip 10k. More careful next time.

[TrendAI Zero Day Initiative @thezdi]

Verified! Nao and @ExLuck99 from ANHTUD used a heap-based buffer overflow to exploit the Lexmark CX532adwe, but we penalized for a rules violation. The still earn $10,000 and 2 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Confirmed! ChatGPT helped Team ANHTUD as they used 3 bugs - 1 collision, 1 unique SSRF and 1 cleartext storage of sensitive information - to exploit Home Automation Green. They finished with just 45 seconds remaining. Their work earns them $16,750 and 3.75 Master of Pwn points. #Pwn2Own

[Khoa Dinh @_l0gg]

Blog for ToolShell
Disclaimer: The content of this blog is provided for educational and informational purposes only.
https://t.co/gT0aoKXkig
#SharePoint #ToolShell

[Công Thành Nguyễn @ExLuck99]

Sadly, I can't get to Berlin in time for P2O. So, just stay at home with an <(´= ⩊ =`)> elf in my Triton console. Good luck to all contestants out there.