Moritz Sanft

security software engineer, ctf @fluxfingers
@[email protected]

[Moritz Sanft @stdoutput]

091e82fbb2795d4516d2e464c96c3f41cbedd9b85755fee808b7dbd06d3ee5bf

[Moritz Sanft @stdoutput]

@brokenpacifist

[BlackAlps @BlackAlpsConf]

📅#BlackAlps26 FRIDAY AM PROGRAM incl. @stdoutput from @EdgelessSystems S. Duc from @Adnovum M. Vaitsman & D. Taler from @varonis & @FrenchYeti
#MultiTaintAnalysis #ConstantTimeVerification #0Day #PQCMigration #M365CopilotAbusing
Don't miss it https://t.co/drtSYT7STS

[Moritz Sanft @stdoutput]

@thorstenball I have recently thought about this, and currently think that 1) holds true at least for lower-level software that building (testing, ...) is costly for an agent. Think security-critical OS parts, etc. - I believe 2) to be true for pretty much the whole rest of the stack.

[Moritz Sanft @stdoutput]

@thorstenball You should be accurate. This is not standard roast-chicken flavor, but "Poulet im Chörbli" (roast-chicken in a basket). You need to account for the basket.

[Moritz Sanft @stdoutput]

@AmpCode if I report a bug through the "report bug" form, it'd be great to get some feedback on if / where I'll be notified if the bug is fixed, needs further input, etc.

[Moritz Sanft @stdoutput]

@thorstenball grr, gotta complain at cleanshotx then :p

[Moritz Sanft @stdoutput]

@ProgrammerDude @HSVSphere there are far easier ways to backdoor just about any package in nixpkgs unfortunately

[Moritz Sanft @stdoutput]

@es3n1n realtired might be some good lingo

[pspaul @pspaul95]

A fun gadget I found recently! The .NET JIT compiler makes sure there are no rwx pages by using a memfd, but that turns file writes into straight shellcode execution 🐚

[Moritz Sanft @stdoutput]

The video recording of our talk is live now: https://t.co/cWdn8LCRsE

The slides can be found here: https://t.co/N564j3RAAM

Enjoy!

[offensivecon @offensive_con]

SELECT shell FROM postgres: Digging up a 20-year-old bug for https://t.co/sOCysMhhpT by @pspaul95 and @stdoutput

[Moritz Sanft @stdoutput]

@es3n1n same pls ping if you find one

[Moritz Sanft @stdoutput]

@carste1n That one indeed is a gem. You’ve got good taste;)

[Moritz Sanft @stdoutput]

@ifsecure Any chance you could share the slides? Thanks for the great talk!

[offensivecon @offensive_con]

SELECT shell FROM postgres: Digging up a 20-year-old bug for https://t.co/sOCysMhhpT by @pspaul95 and @stdoutput

[Nir Ohfeld @nirohfeld]

We @wiz_io just launched https://t.co/ShlGzDWU0O - a community for vuln researchers, by vuln researchers. Feat. writeups for PostgreSQL and MariaDB RCEs (@xint_official, @pspaul95 & @stdoutput)

Stay tuned for the bug tracker and upcoming events. Big things coming soon 👀

[Moritz Sanft @stdoutput]

Our writeup of our https://t.co/tZbARHSwYe Postgres exploit is live. We think it's a pretty neat bug and the exploitation was really fun, so check it out!

[Wiz @wiz_io]

The secret's out.🤫

Introducing THE https://t.co/iULfuMrtEd COMMUNITY 👾

Inside:
• 0-day vuln deep dives from @xint_official, @stdoutput, @pspaul95 & more...
• Access to events & a network of world-class hackers
• CTFs with prizes

Join now :)