samarth

fellow disruptor of space-time; security @ JP Morgan. Views are my own.

[samarth @riddl3sec]

@IndiShell1046 Thank you bhaiji 🙏🏼

[samarth @riddl3sec]

ScoutSuite doesn’t flag environment variables associated with Lambda functions, or EC2 metadata which can contain secrets for "security" and "privacy" reasons. Made some scripts to do the work, can be used with old result files too:
https://t.co/YmV40KjqxP

[samarth @riddl3sec]

@domchell @MDSecLabs LFG!

[Dominic Chell 👻 @domchell]

Some new wall decor for the @MDSecLabs office

[samarth @riddl3sec]

If you run into a situation where Azure App Registrations are allowed for users but access is denied from the portal, I have written down this quick and dirty PowerShell script to automate the process.
https://t.co/IEaZ9eBF7n

[samarth @riddl3sec]

@chvancooten @MarcOverIP @_xpn_ Actually, “look at mE, I am @_xpn_” 🤣

[samarth @riddl3sec]

@chvancooten @MarcOverIP @_xpn_ Everyone with the badge is @_xpn_

[Adam Chester 🏴‍☠️ @_xpn_]

For anyone who's badge I managed to "Pwnz0rz111" today at RedTreat, you can revert back to the "original" FW by booting the badge, and once my spooky purge face shows up, press the middle button (the up button) and then the top button (the select button).

The image just overlays a hidden menu option, so you're just selecting "Unpwn Badge" in the background which switches the badge over to OTA0 (original files).

Thanks to @max__grim and @c3c for the awesome badges, and to @MDSecLabs and @OutflankNL for the amazing CON!

[samarth @riddl3sec]

@chvancooten @_dirkjan barely have a voice this morning. Worth it!

[samarth @riddl3sec]

One with the guy who got me into Azure. @_dirkjan

[samarth @riddl3sec]

@kc_8002 🤣🤣🤣

[samarth @riddl3sec]

Absolutely surreal being in the room with the best of the best hackers in the world aaaand getting this cool badge!

[Marc Smeets @MarcOverIP]

We’re so back! 💪

[samarth @riddl3sec]

@domchell …

[Manish Kishan Tanwar @IndiShell1046]

If you are coming to VulnCon conference, please don't forget to attend my talk 😇🙌

[samarth @riddl3sec]

2024 and it's insane how many servers still have a Pass.txt from ages ago with valid passwords. 🤢

[samarth @riddl3sec]

This one was quite a journey. A lot of help and support from a few great people, all mentioned in there.

“Mining for Bitcoin Miners with Memory Horses” by Samarth Vashisht
https://t.co/2iLNEGF0Tm

[Peter Winter-Smith @peterwintrsmith]

Today I am pleased to announce the release of a code analyser I’ve been working in my free time - wSAST (https://t.co/0eF9G5b81E)

wSAST aims to make code analysis easier for application security consultants by providing tools to graph relationships, find paths between functions, and identify entry points into codebases as well as perform full dataflow and static analysis using a powerful rules engine.

Rules for analysis can propagate taints, express arbitrary relationships between variables, and attach arbitrary data to variables as they flow through the application during simulated execution. Rules can be written as simple XML format rules (for simpler types such as function rules, variable and type rules, and data rules), or in .NET for completely customised rules which can then be as convoluted as you like.

Multiple sources can be attached to any variable and multiple sinks to any trace, which then come and go from execution scope per a specified scope anchor.

Since wSAST is implemented over a custom intermediate language (WSIL) to which all supported languages are translated it will be able to support multiple languages. At the moment only Java core language support has been completed, and C support is about 95% complete but has no rules at this time.

My plan for the moment is to keep the core engine closed source but make all the rules, the front end, rules engine all open source and .NET based. I plan to make further steps towards this by releasing the code for these components to the wSAST GitHub when developer guides are finished. It will be possible for developers to add custom language support (if they’re brave enough!) using the interfaces provided, and the C to WSIL translator will be open source as an example.

I hope people find this useful! Don’t hesitate to contact me if you have any questions, on here or on @wsastsupport

[Andrei Scutariu @xnand_]

For anyone that has ran this PoC, consider your data stolen. This is what eventually runs on your host after a few stages. If you wanna analyse it, don't use a web browser or your IP will get blacklisted. #CVE_2023_35829 #backdoor

[Dominic Chell 👻 @domchell]

Enjoyed reading the red team report on this one, great work from @TheXC3LL