johncool

offsec and VR somewhere

[johncool @JohnCool__]

@mtarral @Apple Oh, that's my bad :). They should be now.

[johncool @JohnCool__]

We are hiring offensive security researchers @Apple!

We are looking for experienced profiles in a variety of fields.
Learn more here: https://t.co/QGYZXKqxCt

You are into Kernel or Userland Vulnerability Research? My team would love to hear from you!
DM me if you have questions

[cbayet @OnlyTheDuck]

New year, new adventure for me @Reverse_Tactics ! A lot of work to come, but hopefully lots of vulnerabilities and exploits ! Feel free to DM me to discuss or leak your bugs 🥸

[REverse_Tactics @Reverse_Tactics]

Welcome to @OnlyTheDuck who is joining REverse Tactics for handling exciting security challenges and discovering new vulnerabilities!

[johncool @JohnCool__]

@h0wdeee I can’t remember which release fixes the bug, but here is the relevant commit https://t.co/nqN1Gq1yHD

[johncool @JohnCool__]

@h0wdeee Hi, one of the original author here. This is indeed CVE-2022-43634. I confirm that this was a critical RCE in Netatalk. Exploiting it is non trivial but can be done reliably. Feel free to DM or ask here if you have any question

[Hexacon @hexacon_fr]

Thank you everyone for this amazing second edition!

We hope you all had a blast and all the team is already eager to see you all next year for #HEXACON2024 🚀

[johncool @JohnCool__]

@lcheylus @OnlyTheDuck @swapgs Et oui… Je pensais pas que ça partirait si vite. Mais c’est tant mieux que la conf génère autant d’engouement.

[johncool @JohnCool__]

Because I would love to see the magnificent @OnlyTheDuck on stage (and @swapgs (and the other one too))

[Root-Me @rootme_org]

The second batch for @GrehackConf 2023 was launched today, and guess what: tickets sold out in minutes 🫣.
But lucky you, we had reserved 2 tickets for you! 🤩 👉 Retweet and comment by telling us what motivates you to go to the conference. Random draw Monday lunchtime, we'll announce the winners right away.
Good luck to you all !

[Root-Me @rootme_org]

The second batch for @GrehackConf 2023 was launched today, and guess what: tickets sold out in minutes 🫣.
But lucky you, we had reserved 2 tickets for you! 🤩 👉 Retweet and comment by telling us what motivates you to go to the conference. Random draw Monday lunchtime, we'll announce the winners right away.
Good luck to you all !

[johncool @JohnCool__]

@0xor0ne @Flutsunami @Synacktiv Thanks! It was one of the funkiest bug we had to exploit! … and it’s everywhere 😏.

[0xor0ne @0xor0ne]

Excellent writeup on obtaining root command execution on Netatalk daemon on Western Digital MyCloudHom NAS.
credits: Etienne Helluy-Lafont and Luca Moro (@Synacktiv)

https://t.co/hpM8Dy2Fu8

#cybersecurity

[TrendAI Zero Day Initiative @thezdi]

At #Pwn2Own Toronto, @johncool__ earned $40K by exploiting the @westerndigital My Cloud Pro Series PR4100 with a classic buffer overflow. Now that it's patched (CVE-2022-29844), he provides the details of his research on our blog. Read all about it at https://t.co/mvaZOSIP4M

[johncool @JohnCool__]

@Synacktiv @OnlyTheDuck

[johncool @JohnCool__]

@alexjplaskett And here is the article https://t.co/HVUteTFBYZ

[Synacktiv @Synacktiv]

Ninja tricks to abuse TCP stacks and pwn NAS! Check out our #Pwn2Own Netatalk exploit by Etienne, @JohnCool__ and @OnlyTheDuck! https://t.co/sHlH5OnYBB

[johncool @JohnCool__]

Yay, the Netatalk pre-auth bug we used during #Pwn2Own Austin 2021 has been disclosed! Be ready for the upcoming exploit/write-up and its funkiest TCP shenanigans https://t.co/k19YCfjtPf

[Synacktiv @Synacktiv]

Ninja tricks to abuse TCP stacks and pwn NAS! Check out our #Pwn2Own Netatalk exploit by Etienne, @JohnCool__ and @OnlyTheDuck! https://t.co/sHlH5OnYBB

[TheZDIBugs @TheZDIBugs]

[ZDI-23-112|CVE-2022-29844] (Pwn2Own) Western Digital MyCloud PR4100 FTP Server Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8; Credit: @johncool__) https://t.co/kEnUOzm5Mf

[johncool @JohnCool__]

@pwning_me At the time we did not know about the previous form of that bug, and we could not argue that it was in fact a different vulnerability. That's why it ended up being a duplicate with your team during #pwn2own

[johncool @JohnCool__]

@pwning_me If i remember correctly, Netgear shipped a very outdated version of Netatalk that had a similar vulnerability which disappeared during a refactoring and was no longer upstream. In its new form there is indeed a special trick :) https://t.co/oWRiLQe9Ai

[TheZDIBugs @TheZDIBugs]

[ZDI-23-094|CVE-2022-43634] Netatalk dsi_writeinit Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8; Credit: @Synacktiv) https://t.co/JmFRSTi0o5