Y4er

Happy!

[Y4er @Y4er_ChaBug]

Chinese-linked actors are targeting edge devices across Southeast Asia, leveraging DoH for C2 communications and large-scale DNS hijacking via iptables.

See details:

EN: https://t.co/32wGyWROwR
CN: https://t.co/7mpQgo4I6V

[Y4er @Y4er_ChaBug]

@DarkNavyOrg @BlackHatEvents ?

[Y4er @Y4er_ChaBug]

This is friend’s analysis of the SolarWinds SEM RCE I discovered.

[X1r0z @X1r0z]

My detailed analysis report of SolarWinds Security Event Manager AMF Deserialization RCE (CVE-2024-0692), with two methods to achieve RCE

https://t.co/Z7Q6rZa3Pg
https://t.co/G9nuOFJX7f

[Y4er @Y4er_ChaBug]

@wvuuuuuuuuuuuuu In fact, the deserialization entry is obvious, and finding the appropriate gadget is the key.

[Y4er @Y4er_ChaBug]

@wvuuuuuuuuuuuuu haha,you got this🤪

[Y4er @Y4er_ChaBug]

@testanull @sourceincite hahaha

[Y4er @Y4er_ChaBug]

demo

[Y4er @Y4er_ChaBug]

公开了一些文章

VMware vROPS RCE of java bean https://t.co/xskA0Gdum9
VMware vROPS 文件读取到反序列化RCE https://t.co/c2xdbauQMn
Apache Geode/VMware GemFire Deserialize RCE https://t.co/cag81Lx0Xc
Trend Micro Mobile Security 认证绕过/文件上传/文件包含 RCE https://t.co/sldZU9Ke52

[Y4er @Y4er_ChaBug]

@MCKSysAr @W01fh4cker it doesn't work by default,need administrator config ldap setting first.

[Y4er @Y4er_ChaBug]

SysAid On-Prem Software CVE-2023-47246

Reproduced

[John Hammond @_JohnHammond]

We've recreated a proof-of-concept for the SysAid CVE-2023-47246 remote code execution and compromise -- blog post coming ASAP😜

Big thanks to @gleeda @HuskyHacksMK @DaveKleinatland @calebjstewart and the whole @HuntressLabs crew helping dig into this one!

[Y4er @Y4er_ChaBug]

@_JohnHammond Nice job, can you share the trial license?

[Y4er @Y4er_ChaBug]

@suanve 还敢交洞？立马没收违法所得

[Y4er @Y4er_ChaBug]

fuck js

[andrej @reactive_dude]

JavaScript in the glorious spirit it was originally designed

[Y4er @Y4er_ChaBug]

@steventseeley @VietPetrus Haha, maybe just know how to ask ChatGPT🤣

[Y4er @Y4er_ChaBug]

CVE-2023-39476 Inductive Automation Ignition JavaSerializationCodec Deserialization RCE

https://t.co/oNoQA5KWf4

[Y4er @Y4er_ChaBug]

@VietPetrus I think both are needed😄

[Y4er @Y4er_ChaBug]

After two days, I finally reproduced the CVE-2023-39476 Inductive Automation Ignition JavaSerializationCodec Deserialization RCE vulnerability submitted to ZDI by @steventseeley

[Soroush Dalili @irsdl]

Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP .NET Framework (CVE-2023-36899)

https://t.co/tCulyANgJk

#Appsec #bugbountytips

[Y4er @Y4er_ChaBug]

Actually, I can still use the `init` attack vector like this

[Calif @calif_io]

Reproducing CVE-2023-38646: Metabase Pre-auth RCE

https://t.co/T3aMMt1epS

CC @peterjson @testanull