Tim

𝘍𝘰𝘭𝘭𝘰𝘸𝘴 𝘺𝘰𝘶

[Tim @timwr]

@wvuuuuuuuuuuuuu https://t.co/Kr1RhXy1NN

[Tim @timwr]

@frostb1ten @frostb1ten Thermite?

[Tim @timwr]

@WynterErik https://t.co/YNEM3WLRAz ?

[Tim @timwr]

@KeyZ3r0 @Iron_Uniranger @alexjplaskett Fyi I couldn't get this to work in the chrome sandbox or low integrity. NtUpdateWnfStateData always returns 0xC0000022 (STATUS_ACCESS_DENIED)

[Tim @timwr]

@mistymntncop Interesting thanks!

[Tim @timwr]

@KeyZ3r0 @KunlunLab @Iron_Uniranger https://t.co/qUKBghYuWC

[Uniranger @Iron_Uniranger]

@alexjplaskett Hi Alex Plaskett! I am curious about how WNF stuffs can be used to escape the Chrome sandbox because when at Low\Untrusted Integrity,the NtUpdateWnfStateData will fail with ACCESS_DENIED. And the sd setting of Part 1 doesn't work at Low\Untrusted Integrity. Did you run into this?

[Tim @timwr]

@_ForrestOrr I thought CVE-2021-31956 might be a good Windows 10 chrome sandbox escape but I got stuck here: https://t.co/43Uj4LlmS4

[Uniranger @Iron_Uniranger]

@alexjplaskett Hi Alex Plaskett! I am curious about how WNF stuffs can be used to escape the Chrome sandbox because when at Low\Untrusted Integrity,the NtUpdateWnfStateData will fail with ACCESS_DENIED. And the sd setting of Part 1 doesn't work at Low\Untrusted Integrity. Did you run into this?

[Tim @timwr]

@davegardnerisme @jameslnicholson

[Tim @timwr]

@DaveManouchehri @ScottyBauer1 @Fire30_ @timstrazz But how do you go from file overwrite to kernel r/w. Overwriting the vdso region like VIKIROOT?

[Tim @timwr]

@catc0n I put that I have 15 years of Blockchain experience on my LinkedIn profile, it's amazing how many recruiters ask me about it.

[Tim @timwr]

@cutesmilee__ What device(s) did you test this on @cutesmilee__ ? Nice work!

[Tim @timwr]

@kmkz_security Interesting thanks. I'll ping you if I get around to testing this. Confusingly it looks like Safari 14.1 was released with iOS 14.5? https://t.co/Wz1wMrtzHT
Nice work btw!

[Jack Rhysider 🏴‍☠️ @JackRhysider]

Want to learn Metasploit? I highly recommend downloading this guide and having it handy while learning. https://t.co/ZuGaQfpAcO

[Tim @timwr]

@wifi_py @samirestefan @avantgame How do you pull private app data over adb via recovery? Surely it's encrypted with the pin?

[Tim @timwr]

@wifi_py @samirestefan @avantgame What if you need the data on it?

[Tim @timwr]

@wifi_py @samirestefan @avantgame Most unoffical (Android) repair shops I've been to previously will demand the PIN/Passcode before doing any repairs, in order to test the functionality. Surely there should be a way to test the microphone, front/back camera, etc in recovery? What if you actually need the data?