AmberWolf

Offensive Cyber, Risk Management & Governance, Vulnerability Research and Technical Due Diligence

[Rich Warren @buffaloverflow]

Next, Next, SYSTEM: Exploiting NSIS installer bugs to escalate privileges in Zscaler Client Connector

In this blog post I show how patch gaps in Zscaler's bundled NSIS versions led to LPE..

includes PoCs and yara rule to help you find other affected s/w

https://t.co/cFiDsPFDES

[AmberWolf @AmberWolfSec]

Full writeup, exploitation walkthroughs, and PoC on the blog: https://t.co/rwytRjESiL

[AmberWolf @AmberWolfSec]

"You need to be admin to run the installer anyway."

A common pushback that misses an entire class of attack. New research from @buffaloverflow on exploiting NSIS installer bugs to escalate from a standard user to SYSTEM in Zscaler Client Connector.

[AmberWolf @AmberWolfSec]

NSIS is embedded in thousands of products. Any that launch a vulnerable installer from a privileged service could be affected.

Both CVEs are patched - but silent patching from vendors means most customers never knew they were exposed.

[AmberWolf @AmberWolfSec]

We reported this in September 2025. Netskope restricted the unauthenticated routes in November 2025.
Full write-up: https://t.co/WYLWSrjpUk (6/6)

[AmberWolf @AmberWolfSec]

🧵 Patch Bypass: Netskope Client for Windows — Local Privilege Escalation via Rogue Server (1/6)

[AmberWolf @AmberWolfSec]

Spin up a NachoVPN server on Azure App Service, reach it via rproxy, supply the hostname over IPC, and the allowlist check passes.
SYSTEM shell in ~30 seconds. No changes to the original exploit chain required. (5/6)

[AmberWolf @AmberWolfSec]

If you recognise any of these sensors from your own building, and they are visible from outside the building - you might want to reach out to us for a chat.

[AmberWolf @AmberWolfSec]

This weekend at @BSidesLondon , Darren McDonald delivered a workshop teaching attendees how to work with our DIY high-powered IR "death lasers" and trigger IR door exit sensors from outside the building!

[Abertay Hackers @AbertayHackers]

It is our pleasure to announce the first Platinum Sponsor and our Opening Keynote Speakers for Securi-Tay 2026 - AmberWolf!

[AmberWolf @AmberWolfSec]

👉 Full blog + demo: https://t.co/p4RE8ApDVu

[AmberWolf @AmberWolfSec]

🌌✨ The Saga Continues: MSI Strikes Back ✨🌌

TL;DR: Bypass for CVE-2024-12908 - Code execution via Delinea's protocol handler is back. Patch now!

[AmberWolf @AmberWolfSec]

A long time ago (well… last year), in a protocol handler not so far away, we showed how Delinea’s URL handler could be abused during update (CVE-2024-12908). We’ve now found a new path using msiexec’s PATCH to pull a remote MSP and execute code - even when the MSI is signed!

[AmberWolf @AmberWolfSec]

Netskope has not issued a CVE, noting only in release notes that a “𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘨𝘢𝘱” was fixed. Full technical details are on our blog: https://t.co/whdQdKrtOT

[AmberWolf @AmberWolfSec]

𝐉𝐮𝐬𝐭 𝐛𝐞𝐜𝐚𝐮𝐬𝐞 𝐢𝐭 𝐬𝐚𝐲𝐬 “𝐒𝐞𝐜𝐮𝐫𝐞” 𝐝𝐨𝐞𝐬 𝐧𝐨𝐭 𝐦𝐞𝐚𝐧 𝐢𝐭 𝐢𝐬

Authentication bypasses are not always just about going from unauthenticated to authenticated. What if other customers could gain access to your multi-tenant environment?

[AmberWolf @AmberWolfSec]

We also found all the credential material needed to exploit it available through OSINT, meaning the risk was not necessarily limited to other customers.