Julian Storr

Likes creme-eggs, ms08-067, chicken and coffee

[AmberWolf @AmberWolfSec]

"You need to be admin to run the installer anyway."

A common pushback that misses an entire class of attack. New research from @buffaloverflow on exploiting NSIS installer bugs to escalate from a standard user to SYSTEM in Zscaler Client Connector.

[Rich Warren @buffaloverflow]

What comes after the patch? Bypass of course! 😜

Delinea Protocol Handler RCE - Return of the MSI. By my colleague @johnnyspandex

https://t.co/1QQfNHB8kU

[Rich Warren @buffaloverflow]

👀

[Rich Warren @buffaloverflow]

Spotted at a vendor hall near you

#ZeroTrustTotalBust #defcon33

[AmberWolf @AmberWolfSec]

Maybe some info at #defcon33 on Saturday, Track 3, 15:30 "Zero Trust, Total Bust - Breaking into thousands of cloud-based VPNs with one bug"

[AmberWolf @AmberWolfSec]

🎤 #DEFCON33 - We’re Presenting!
Big news: AmberWolf is hitting the DEF CON 33 stage this August.
Our very own Rich Warren and David Cash (@buffaoverflow and @jonnyspandex respectively) will be presenting Zero Trust, Total Bust – Breaking into thousands of cloud VPNs with one bug

[Rich Warren @buffaloverflow]

Today, we're releasing NachoVPN, our VPN client exploitation tool, as presented at SANS #HackfestHollywood 2024 🌮🔒

Find the details on the @AmberWolfSec blog, along with the individual advisories, including a not-yet-fully fixed PaloAlto GlobalProtect client RCE👀

[AmberWolf @AmberWolfSec]

Today, AmberWolf released two blog posts and our tool "NachoVPN" to target vulnerabilities in major VPNs, including CVE-2024-29014 (SonicWall NetExtender SYSTEM RCE) and CVE-2024-5921 (Palo Alto GlobalProtect RCE and Priv Esc), after our SANS HackFest presentation.🧵

[AmberWolf @AmberWolfSec]

Today, we released details for CVE-2024-45488, an authentication bypass in Safeguard for Privileged Passwords dubbed "Skeleton Cookie" We explain how we discovered it, provide scripts to check vulnerability, and show how it could lead to RCE on the server.
https://t.co/mf3pc1eKOx

[AmberWolf @AmberWolfSec]

AmberWolf researchers Richard Warren and David Cash found high-risk vulnerabilities in Cato Client, including remote code execution and SYSTEM privilege escalation. Learn more in our blog series: https://t.co/LsW6DqHxfv #vulnerability

[Rich Warren @buffaloverflow]

not sure that its the same post-auth as the itw pulse secure exploit, but its *an* RCE 😛
Still need an auth bypass ..

[Rich Warren @buffaloverflow]

🚨 SonicWall have released a security update for GMS and Analytics, which addresses 15 vulnerabilities reported by my colleague Sean and myself

Some of the bugs are rated critical (CVSS 9.8), and include RCE, SQLi and auth bypass

Get patching ‼️

https://t.co/b9jwC7DUa0

[Julian Storr @Jstorr]

@twaijn @johnnyspandex @mubix A little social engineering required

[Johnny Fishcake @johnnyspandex]

DroppedConnection - a fake VPN server that captures credentials and executes code via the Cisco AnyConnect client.

https://t.co/X8IlRj8BIt

[Julian Storr @Jstorr]

@nmap I thought the only reason Internet Exploder still exists was to download hacking tools and malware...

[Johnny Fishcake @johnnyspandex]

Stealing NetNTLM hashes using Outlook signatures https://t.co/vigXbI5Yan

[Julian Storr @Jstorr]

@HSBC - How is your verification that this is a "Genuine Call" a spoofable SMS which provides a phone number to call back? #securitytheatre

[Sun Tzu @SunTzuCyber]

"The enemy does not check your risk register prior to attacking." - Sun Tzu, The Art of Cyber War

[Julian Storr @Jstorr]

@SophosLabs @Tara_Windwalker What happens when you have more than 1 APT group in a given country?