Marco 'segfault' Ortisi

[Marco 'segfault' Ortisi @redtimmysec]

If you like VPN exploits as much as us, you're going to love this course Zeroshi is bringing to @_ringzer0

We will walk students into opening up edge devices for research, mapping their attack surface, finding vulns and building full exploit chains.
https://t.co/oeOVHZ7d9C

[Marco 'segfault' Ortisi @redtimmysec]

Heads up!

[ringzerø.training && @[email protected] @_ringzer0]

Routers. Firewalls. Industrial devices.
Edge systems are prime targets.

Learn exploitation techniques from Marco Ortisi @redtimmysec — penetration tester, red team manager & vulnerability researcher since 1999.
March 2026 (Virtual)

🔗 https://t.co/sG0SBrZ5k0

[Marco 'segfault' Ortisi @redtimmysec]

March 5th, I'll give a virtual workshop in collaboration with Ringzer0 Training titled "ENEMY AT THE GATES: WEAKNESSES IN EDGE DEVICES". Registration is available via this form: https://t.co/vkWO2QjfbV

[Marco 'segfault' Ortisi @redtimmysec]

I tested the latest virtual appliance (branch 16.x) — and the issue is still present. I produced a follow-up video in English showing how easy this trick is.

https://t.co/iBSAHBLh2E

[Marco 'segfault' Ortisi @redtimmysec]

Last week I posted a YouTube video (inspired by a Reddit thread) about the least privilege principle and how many vendors still fail to apply it correctly.

[Marco 'segfault' Ortisi @redtimmysec]

The video started from a Reddit question about what to check when buying a WAF; I recommended first verifying whether the vendor implements least privilege. Then I decided to demonstrate a real case: a privilege-escalation trick I discovered 5–6 years ago on Cisco ESA.

[Marco 'segfault' Ortisi @redtimmysec]

Part 4 is out: in this video we programmatically attach alternate data streams with malicious paths and payloads to innocent-looking decoy files.

Try the exploit yourself and tell me if it works :-)
https://t.co/TqCQIUWtxD

[Marco 'segfault' Ortisi @redtimmysec]

Vulnerability exploitation walkthrough: CVE-2025-8088 was a 0-day vulnerability patched in late July 2025. I decided to write an exploit from scratch, with no external libs or dependencies.

[Marco 'segfault' Ortisi @redtimmysec]

Part 3 is out
In this third part of our series on exploiting CVE-2025-8088 in WinRAR, we continue building our proof of concept by introducing a custom file header definition. https://t.co/mRw7VFC0eL

[Marco 'segfault' Ortisi @redtimmysec]

In part 2, I start to perform a manual analysis with a hex editor of a malicious RAR file observed in the wild and explain how to add RAR signature + main archive header to the exploit poc (https://t.co/AisPhkN30l)

[Marco 'segfault' Ortisi @redtimmysec]

Exploitation is as simple as opening a malicious RAR archive in a vulnerable WinRAR version and viewing or extracting a file to trigger the infection.

[Marco 'segfault' Ortisi @redtimmysec]

https://t.co/zBcWU5GEsM

[Marco 'segfault' Ortisi @redtimmysec]

Tried the public POCs for CVE-2025-25257 (Fortinet FortiWeb SQLi → RCE)…
Same firmware, same steps… guess what?
💥 No shell, no glory.

[Marco 'segfault' Ortisi @redtimmysec]

Recorded the full journey (validation → adaptation → shell).
Video w/ ENG SUBS, link in first comment 👇

[Marco 'segfault' Ortisi @redtimmysec]

That damned shell just refused to pop 😅
So instead of rage-quitting, I hacked together my own working exploit, recycling their code. ♻️

[Marco 'segfault' Ortisi @redtimmysec]

Vulnerability analysis experiments: explaining the exploitation of CVE-2025-25257 (Fortinet FortiWeb SQL Injection to RCE) - ENG SUB, MAIN ITA

https://t.co/qiKBuMbmTm

#fortinet #fortiweb #cve_2025_25257 #vulnerability #exploit #BugBounty

[Marco 'segfault' Ortisi @redtimmysec]

ENG SUB added for part 2 twoo
https://t.co/0UAkCQJXAB