vmpr0be

Enjoyer of hypervisors, windows kernel, static binary analysis, participating in CTFs and security research.

[vmpr0be @vmpr0be]

Authoring pwn for Hackअस्त्र CTF (https://t.co/9oFReteDMP), it starts tomorrow!

[m411k @m411k_]

We are happy to share our ai-free (lol) research on the decade old ReDoS topic, we go through a couple findings, for example if you use IsPhoneNumber decorator in say your nestjs application, your currently trivially vulnerable to getting your server 🥶
https://t.co/6QQyVXf3fv

[vmpr0be @vmpr0be]

@citeflag https://t.co/Epi2J0kTbx

[vmpr0be @vmpr0be]

I’ll be authoring pwn challenges for @citeflag CTF this year.

Registrations are open, qualifiers start April 3rd, and there will be prizes for the winners.

[vmpr0be @vmpr0be]

@bellis1000 amazing work man

[vmpr0be @vmpr0be]

@z0v3r1n thank you

[vmpr0be @vmpr0be]

I did some vulnerability research on bareiron minecraft server project and found 3 vulnerabilities which resulted in RCE:

CVE-2025-69806
CVE-2025-69808
CVE-2025-69809

https://t.co/UHva8KbwPd

[OtterSec @osec_io]

We achieved a guest-to-host escape by exploiting a QEMU 0-day where the bytes written out of bounds were uncontrolled.

Full breakdown of the technique, glibc allocator behavior, and our heap spray/RIP-control primitive ↓

[vmpr0be @vmpr0be]

@FAMASoon thank you

[vmpr0be @vmpr0be]

@peter_clowncs thank you

[vmpr0be @vmpr0be]

@mihomoparty thank you

[vmpr0be @vmpr0be]

@Zophikel unfortunately i won't be making one, but i do show where the vulnerability is and POC here: https://t.co/PgP4QgnSe3

[vmpr0be @vmpr0be]

@gumkora thank you

[vmpr0be @vmpr0be]

@m411k_ thank you <3

[vmpr0be @vmpr0be]

@Mr_nyly thank you

[vmpr0be @vmpr0be]

@momo5502 What advantages does this offer? is it just about speed?

[Maurice Heumann @momo5502]

I started working on a small side project:
https://t.co/cZ9KMQlP40

It's an ahead-of-time binary translation toolchain.
It transpiles windows binaries to any other OS/platform.

It is super limited right now, but managed to translate a 32 bit windows binary to x86_64 linux 🥳

[vmpr0be @vmpr0be]

@m411k_ @Mr_nyly good job man :O

[m411k @m411k_]

CVE-2026-24486

w/ @Mr_nyly

[Synacktiv @Synacktiv]

At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.

🔍 Full technical write-up 👇
https://t.co/R0E5Uqql1E