The_Maxu

[The_Maxu @The_Maxu]

So good to be back on here after such a long time! Props to everyone still holding it down in the scene. I love seeing all the progress you guys are making. Just dropping by to say hi, big hug to all!

[The_Maxu @The_Maxu]

@thedarkprogr @notnotzecoxao @fail0verflow @theflow0 Nintendo will sue you for copying the method...😂

[The_Maxu @The_Maxu]

@notnotzecoxao Ok... Path Traversal in PSDescriptorFactory to overwrite the internal /userprefs file with a poisoned Java object (Payload) that, when processed without filters by readObject() in UserPreferenceManagerImpl, executes arbitrary code... ???

[The_Maxu @The_Maxu]

@CelesteBlue123 @ps3120 file:///app0/bdjstack/lib/ext/sunjce_provider.jar/../../../../../disc/BDMV/JAR/00000.jar

[The_Maxu @The_Maxu]

@bts_leandro https://t.co/BitzjKfn7B

[The_Maxu @The_Maxu]

WTF? #PS4 12.00 ¿OOB?

[The_Maxu @The_Maxu]

@bts_leandro @aldostools 🧐

[The_Maxu @The_Maxu]

@CelesteBlue123 In Java, you can use `!` to access the internal contents of a JAR file and load a specific class. It's simply one of the easy ways to exploit the bug before the patch.

[Jose Coixao @notnotzecoxao]

i've deleted previous tweet, but 15432 asked me to repost it again, so yeah.

path traversal is still possible on 13.04 because sony fucked big time. expect it to be patched on something like 13.50 or 14.00 though.

and if you think hackerone is what made the scene prosper, you are wrong :)

[The_Maxu @The_Maxu]

@notnotzecoxao 😉

[Kameleonre_ @Kameleonre_]

Smells like Bdjb for ps4 13.00 😜

[Jose Coixao @notnotzecoxao]

differences between 13.02 and 13.04 (what i could find at least)

[The_Maxu @The_Maxu]

@spammail350362 @notnotzecoxao BD-J bug where JAR paths were improperly validated.
Using .jar!/../../payload.jar could trick the runtime into treating an external JAR as if it were in lib/ext and grant it AllPermission.
The patch trims the path at .jar before canonicalization.
Sandbox escape via path confusion

[The_Maxu @The_Maxu]

@m0ur0ne @BlieDieBlaDie WTF?
Escribí eso en noviembre...
Que mal te debes de sentir por dentro...
¿Y ahora cambias la historia diciendo que es otro?
Lo que hay que ver...
Por lo menos espero que hagas buen uso del dinero.

Un saludo.

[The_Maxu @The_Maxu]

@Bushigan Good job, boss!😉

[David Lrt @Bushigan]

Just testing...

[Jose Coixao @notnotzecoxao]

Carkys team releasing these games, go check it out at https://t.co/QkFVqSE8ZW

[BlaDieBloe𐨆ۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖۖ​ۗۗۗۗۗۗۗۗۗۗ @BlieDieBlaDie]

@m0ur0ne The 10.000 is not yours .@Hacker0ne