phoenhex team

Fine writeups & exploits by @5aelo @_niklasb @edgarboda @bkth_

[Bruno @bkth_]

I wrote a thing about a Chakra RCE for which the JIT trigger is tweetable :)
function opt(o) {
o.pwn = o.a;
}
https://t.co/79NjgeQwoo

[Niklas B @_niklasb]

I wrote a thing about my macOS sandbox escape & LPE from Pwn2Own https://t.co/8EetvFz2i5

[Bruno @bkth_]

New blog post written together with my friend @S0rryMybad about using the JIT to abuse a non-JIT bug in Chakra (CVE-2019-0812) https://t.co/c2GMTQewHO

[Bruno @bkth_]

I published the slides of the presentation I gave @BlueHatIL and @offensive_con about Attacking Edge through the JIT compiler. I also contains exploit code for CVE-2018-8266 https://t.co/01ZoFkmBBq

[offensivecon @offensive_con]

Attacking Edge through the JavaScript Just-In-Time compiler by @bkth_ https://t.co/flFRIK9Xrc

[offensivecon @offensive_con]

IPC you outside the sandbox: One bug to rule the Chrome broker by @_niklasb https://t.co/EDFWlBhBKC

[offensivecon @offensive_con]

FuzzIL: Guided Fuzzing for JavaScript Engines by @5aelo https://t.co/LGUIvQG9Lz

[Samuel Groß @5aelo]

My #pwn2own exploit chain from this year, essentially 3 logic bugs to go from Safari to kernel on macOS up to 10.13.3, is now open source: https://t.co/AXhKn3rDxF. The README also links to a few slide decks which contain some more background information :)

[SSD Secure Disclosure @SecuriTeam_SSD]

#Hack2Win eXtreme @bevxcon - SSD Advisory – Firefox Remote Code Execution https://t.co/RPiZ4HrNV9

[offensivecon @offensive_con]

Browser Exploitation by @5aelo
https://t.co/1Vg5sGJE4G

[Niklas B @_niklasb]

Two RCE bugs in the Spidermonkey JIT fixed in Firefox 62.0.3. One was a pretty old bug in the IonMonkey register allocator.

[phoenhex team @phoenhex]

Today we have a short new blog post about CVE-2018-4358, an infoleak bug in Safari found by @bkth_ @5aelo and @_niklasb that got patched by Apple in their last updates: https://t.co/dGqZJG9tjH

[TyphoonCon🌪️ @typhooncon]

First #Hack2win eXtreme winners, @_niklasb @bkth_ @5aelo, 3 categories: Firefox RCE, Firefox InfoLeak and Chrome RCE, beautifully done, for a total prize of 170,000$USD. Still have 330,000$USD to give out to anyone that can show their skills - disclosure soon via @SecuriTeam_SSD

[Samuel Groß @5aelo]

Here are the slides from my #BlackHatUSA talk about just-in-time compilers for JavaScript and the @webkit bug I used as part of my Pwn2Own chain this year =) https://t.co/RpASPLSfr1

[Niklas B @_niklasb]

New blog post: Fuzzing the CS:GO map file loader with AFL in QEMU mode. Includes full fuzzing harness + triaging tools to reproduce. Will still find heap overflows, because Valve says these are not security issues :> So get yourself some 0days now! https://t.co/MDSQrvt1UZ

[Niklas B @_niklasb]

Here's @bkth_'s, who clearly plays too much dota

[Niklas B @_niklasb]

I added a PKGBUILD to get a full debug build of the latest VirtualBox version for Arch Linux, with the 3D security fixes from July reverted: https://t.co/0XR5MCmasB

[Niklas B @_niklasb]

I published a small Python Linux library for experimenting with HGCM and VBoxSharedCrOpenGL (3D accel) from a VirtualBox guest. Includes a full exploit for CVE-2018-30{55,85} demonstrating some useful heap exploitation techniques for the 3D component https://t.co/xtXuqN5qGk

[Niklas B @_niklasb]

Best idea ever to order ESPR+phoenhex keyboards <3

[Bruno @bkth_]

Got CVE-2018-8266 for a bug inside ChakraCore that led to RCE :) https://t.co/upyPEv8BcY