Q5Ca

Chief Remote Work Officer at @u0Kplusplus

[Q5Ca @_q5ca]

Happy to share that my colleague @vudq16 and I will be speaking at PHDays in Moscow 🇷🇺 next week, May 24th. I’ll share a story from one of our red team projects, with techniques to maximize stealth during the operation.
Hope to make new connections there:D
https://t.co/PkfCZfiT7v

[Orange Tsai 🍊 @orange_8361]

And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work

— excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦

[TrendAI Zero Day Initiative @thezdi]

Locked in! Le Duc Anh Vu (@vulda17) of Viettel Cyber Security (@vcslab) exploited Cursor, earning $30,000 and 3 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[TrendAI Zero Day Initiative @thezdi]

Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[TrendAI Zero Day Initiative @thezdi]

There it is! Orange Tsai (@orange_8361) of DEVCORE Research Team was able to exploit Microsoft Exchange! If confirmed, they win a whooping $200,000 and 20 Master of Pwn points. Off to the disclosure room to explain how they did it and seal the deal. #Pwn2Own #P2OBerlin

[TrendAI Zero Day Initiative @thezdi]

Boom! @rewhiles of Viettel Cyber Security was able to exploit Anthropic Claude Code! If confirmed, they win $40,000 and 4 Master of Pwn points. They're off to the disclosure room to explain how they did it. #Pwn2Own #P2OBerlin

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Q5Ca @_q5ca]

@D1iv3 Thanks for the hint. Allow me to farm some aura 😉 https://t.co/WCXiFtuGyh

JFYI, codex 5.4 xhigh implemented most of it.

[Q5Ca @_q5ca]

@ZackKorman Happened to me. Tried to remind you guys 😂

[Q5Ca @_q5ca]

Just a quick reminder: Copilot on https://t.co/eLVLz54TkG (https://t.co/kp59kwHIFU) is not on scope for bounty 🥲

https://t.co/97nAwrizaT

[Q5Ca @_q5ca]

@GodfatherOrwa @aditi_singghh 👀

[Q5Ca @_q5ca]

@huyvinhptit @grok 👀

[Q5Ca @_q5ca]

Ước 🥹

[Khoa Dinh @_l0gg]

Blog for ToolShell
Disclaimer: The content of this blog is provided for educational and informational purposes only.
https://t.co/gT0aoKXkig
#SharePoint #ToolShell

[Q5Ca @_q5ca]

@S1r1u5_ Cool!

[Q5Ca @_q5ca]

@by6153 @haxor31337 Yes, but I think it didnt help much 😅

[Q5Ca @_q5ca]

@GodfatherOrwa @HusseiN98D @haxor31337 Remember that! I’m comming!

[Q5Ca @_q5ca]

@vudq16 Slide: https://t.co/ef1eUieyCr

Recording: https://t.co/M8BlNFmOvB

[Q5Ca @_q5ca]

Happy to share that my colleague @vudq16 and I will be speaking at PHDays in Moscow 🇷🇺 next week, May 24th. I’ll share a story from one of our red team projects, with techniques to maximize stealth during the operation.
Hope to make new connections there:D
https://t.co/PkfCZfiT7v

[Q5Ca @_q5ca]

@pfiatde @haxor31337 Here is it: https://t.co/ef1eUieyCr

Please tell me if there is any problem 😅

[Q5Ca @_q5ca]

@HusseiN98D @haxor31337 Keep what’s in Moscow in Moscow man 🙏

[Q5Ca @_q5ca]

@haxor31337 @GodfatherOrwa let see if we can get more views than you 🤣