Peter Vreugdenhil

Mitigations bypassed: DEP, ASLR,KASLR, SafeSEH, CFG, Protected Mode, SMEP, PAC, **

** list might be incomplete

[Peter Vreugdenhil @WTFuzz]

Following the herd to BlueSky: @wtfuzz.bsky.social
Will start tweeting research stuff again in 2025.

[Peter Vreugdenhil @WTFuzz]

Ran into a custom xml -> java deserializer. Limited in what it did. Used reflection to set fields, no setter getter. Lot of objects blocked. Deserialized object was not used. Exploited it by overwriting static field values on object that was used in Authentication. #ExploitFun

[Peter Vreugdenhil @WTFuzz]

It’s always convenient when the app you are poking at has a straight up “please execute this command for me” api endpoint once you bypass the auth.

[Peter Vreugdenhil @WTFuzz]

@mdowd Don’t let it drag you down.

[Peter Vreugdenhil @WTFuzz]

After mainly writing pocs in python and C I just finished a poc written entirely in Java. I was too lazy to rewrite their auth lib in python, but what a frustrating experience. 1/10 would not recommend. Anyways, auth bypass + command injection means:

[Peter Vreugdenhil @WTFuzz]

@zlowram_ @alexjplaskett Looks like I have a bit more than 2 months to waste time trying to find the perfect latex lib to generate slides that can display objects in memory and their relationships. Leaving me 2 weeks for actual content 😁

[Peter Vreugdenhil @WTFuzz]

I’m thinking about turning some recent windows kernel research and exploits into a talk. Does anyone have suggestions for conferences that currently have their CFP open or will open shortly?

[Peter Vreugdenhil @WTFuzz]

@bsdaemon @alexjplaskett @h2hconference 21, that’s quite impressive. I’d joke about finally being able to drink and such, but that only works on Americans :)

[Peter Vreugdenhil @WTFuzz]

@alexjplaskett Thnx, that’s a good one. I had the pleasure of being there last year, had a great time.

[Peter Vreugdenhil @WTFuzz]

After many years and tons of fun I left ExodusIntelligence recently. Enjoying some nice time off right now, spending time with the kids and not IDA 😁 No plans yet for 2024 but I’m sure something exciting will show up.

[Peter Vreugdenhil @WTFuzz]

I had almost forgotten what an assault Vegas is on the eyes and ears, but Vegas was luckily kind enough to remind me real quick.

[Peter Vreugdenhil @WTFuzz]

Been a few years, but I'll actually be in Vegas for #bh2022 hoping to run into folks I haven't seen in ages.

[Exodus Intelligence @XI_Research]

Hopes are high that some normalcy can return in 2021 and we can see our colleagues again at Blackhat. We're hosting an in-person 5-day training around that time and looking for feedback on timing. Plan before, during, or after the conference?

[Exodus Intelligence @XI_Research]

We're looking for someone to take on our infrastructure, grow it, secure it, modernize it, automate it, and generally make it more awesome. If you live in central Texas and are interested in starting a dialog. Reach out to us via [email protected]

https://t.co/mGMWfuFrNL

[Exodus Intelligence @XI_Research]

2019 was a great year for Exodus and 2020 is going to be even better. We're expecting to expand the team on a variety of fronts.
If interested visit https://t.co/TabRGeAJyP and email [email protected] with a cv and references published work

[Exodus Intelligence @XI_Research]

Patch-gapping in practice: Google Chrome edition (by @_2can of our nDay team)

https://t.co/weB7xd1hYl

[International Justice Mission NL @IJMnl]

En de finish! #MudRaise https://t.co/L6BNQaCbiv

[Exodus Intelligence @XI_Research]

@_2can of our Nday team takes a closer look at the recently patched Chrome vulnerability spotted in the wild (exploit included)
https://t.co/StjtBHA2Nk

[Peter Vreugdenhil @WTFuzz]

ntdll!LdrpSetProtection(0xaddr, 0) good function for x64 exploits. 2 args and a fake PE Header (9 values) at 0xaddr and it'll mark it as RWX for you. Too bad its not exported. byte match: 48 89 5C 24 08 55 56 57 41 54 41 55 48 83 EC 40 45 33 C0 0F B6 EA 4C 8B E1 48 8B D1

[Peter Vreugdenhil @WTFuzz]

I like how MS keeps insisting that UAC is not a security boundary but they do try to squash bugs and techniques to bypass it. But, it is indeed not as sturdy as some of the other protection they have despite recent changes.