Worawit Wang

[ö @r0keb]

Good morning! Just published a deep dive into PatchGuard internals: how it works, key internal functions, context init, and possible bypasses. https://t.co/1Be0hI4vtw

[Yehuda Smirnov @yudasm_]

What if you skipped VirtualAlloc, skipped WriteProcessMemory and still got code execution?
We explored process injection using nothing but thread context.
Full write-up + PoCs:
https://t.co/Sa1oUSYyqU

[Orange Tsai 🍊 @orange_8361]

The detailed version of our #WorstFit attack is available now! 🔥
Check it out! 👉 https://t.co/EWlBSgXhpx

cc: @_splitline_

[Qualys @qualys]

The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. https://t.co/uDHHSuzd5f

[MDSec @MDSecLabs]

Exploiting CVE-2024-20656, a Local Privilege Escalation in the VSStandardCollectorService150 Service https://t.co/zCj3o31RPn - new research from @filip_dragovic

[Boris Larin @oct0xor]

We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. https://t.co/hsQo6JIPMJ

[Soroush Dalili @irsdl]

The new Cookieless variant (CVE-2023-36560) has been added to https://t.co/tCulyANgJk

@mwulftange 😇

[Tavis Ormandy @taviso]

New write-up on an Intel Ice Lake CPU vulnerability, we can effectively corrupt the RoB with redundant prefixes! 🔥 An updated microcode is available today for all affected products, cloud providers should patch ASAP.
https://t.co/7fPo45iddV

[Worawit Wang @sleepya_]

@x1aoxia0xiao The error message means no formatting library. I only tested on Debian sid/trixie with default packages, g++ version is 13.2.0.

[Worawit Wang @sleepya_]

Initial public #blutter tool for #reversing flutter app by compiling/using Dart runtime https://t.co/Mu53Qdw9YM
Now, support only Android target. It should still be useful even it is lack of analysis feature.

[Worawit Wang @sleepya_]

@x1aoxia0xiao I've never tried that version. But it should have no problem.

[Daniel Moghimi @flowyroll]

Dropping #Downfall, exploiting speculative forwarding of 'Gather' instruction to steal data from hardware registers. #MeltdownSequel
- Practical to exploit (POC/Demo)
- Defeat all isolation boundaries (OS, VM, SGX)
- Bypass all Meltdown/MDS mitigations.
https://t.co/udgnfAWCE2

[HITBSecConf @HITBSecConf]

#HITB2023HKT COMMSEC: B(l)utter – Reversing Flutter Applications by using Dart Runtime - Worawit Wangwarunyoo - https://t.co/XycQ8qDXR7

[Satoshi Tanda @standa_t]

A new blog post on Intel VT-rp! Part 1 is about how HLAT prevents the remapping attack, taking Windows as an example platform.
https://t.co/m2nBGmP09g

Sample hypervisor code:
https://t.co/f9jAnuipwB

[Tavis Ormandy @taviso]

First big result from our new CPU research project, a use-after-free in AMD Zen2 processors! 🔥 AMD have just released updated microcode for affected systems, please update! https://t.co/NVPWFpVopz

[Andrei Scutariu @xnand_]

For anyone that has ran this PoC, consider your data stolen. This is what eventually runs on your host after a few stages. If you wanna analyse it, don't use a web browser or your IP will get blacklisted. #CVE_2023_35829 #backdoor

[Mor Davidovich @dec0ne]

Introducing DavRelayUp - A port of #KrbRelayUp with modifications to allow for NTLM relay from WebDAV to LDAP and abuse #RBCD in order achieve #LPE in domain-joined windows workstations where LDAP signing is not enforced.
Demo in second tweet.
https://t.co/mUYoUJin2l

[Worawit Wang @sleepya_]

The approach does not work when Intel VT-rp (HLAT) is used. The code is at https://t.co/POOQvYhbwG

[Worawit Wang @sleepya_]

My approach to call a kernel function and process creation callback against Windows HVCI https://t.co/XXQWhGj58z. In short, I modified page table of SSDT. Then, change the jump target to another kernel function. For the callback, I used procmon driver functions and SEH.

[Oliver Lyak @ly4k_]

Today we're publishing new techniques for recovering NTLM hashes from encrypted credentials protected by Windows Defender Credential Guard.

These techniques also work on victims logged on before the server was compromised.

https://t.co/euNIyX2dwW