Yuhang Wu

A member of the CTF team Straw hat, Nu1L, and (former) Tea Deliverers.
Security Researcher at @depthfirstlabs ヾ(@^▽^@)ノ

[Yuhang Wu @wupco1996]

@AmitaiCo @depthfirstlabs We did not request CVE identifiers. We reported the GitLab vulnerability to GitLab through its HackerOne vulnerability disclosure program. No separate CVE identifier was assigned to us for the GitLab-level exploit chain during that process.😂

[Yuhang Wu @wupco1996]

We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!

Read more about this in the comment...

[Yuhang Wu @wupco1996]

@lyq_sqsp @depthfirstlabs Thanks! You can give the LLM plenty of context and ask it to generate an SVG, which you can then convert into an “informative picture”.

[DARPA @DARPA]

Congrats to the 7 companies that will receive $1 million each to develop AI-enabled cyber reasoning systems that automatically find and fix software vulnerabilities as part of the #AIxCC Small Business Track! Full announcement: https://t.co/SC6yEFsooy.

[Yuhang Wu @wupco1996]

My first front-end Web challenge (ytiruces) is online at #N1CTF2023. Welcome to play!
https://t.co/nUFf2JAX0T

[Yuhang Wu @wupco1996]

@disasterharbor @phithon_xg Ah, that's easy, just use PHP namespace feature `\x5c\x00....`

[Yuhang Wu @wupco1996]

@disasterharbor @phithon_xg

[Yuhang Wu @wupco1996]

@disasterharbor @phithon_xg You can find the specific name by using `php -d https://t.co/iN51AnKzFg=1 -d vld.execute=0 -f index.php`

[Yuhang Wu @wupco1996]

My solution for `true_web_assembly` in the @hxpctf . 1. Upload an evil python file named `https://t.co/FsgTBXlu5b` to the bbs. 2. Make the bot visit the attachment link. 3. RCE triggered in the bot's docker container due to the automatic file download(`import re` in admin . py)

[Yuhang Wu @wupco1996]

@arkark_ https://t.co/5p7ZaTgVzt

[Yuhang Wu @wupco1996]

@arkark_ I solved the light-note, thank you for the nice challenge

[Yuhang Wu @wupco1996]

@arkark_ @ankursundara @sqrtrev Is that about secure context or hidden global variables which could be overwritten through DOM Clobbering?

[Yuhang Wu @wupco1996]

@arkark_ @ankursundara @sqrtrev Yes, that’s what I struggled with. I have bypass the dompurify, but did not get the solution to break the sanitizer API

[Yuhang Wu @wupco1996]

@arkark_ @ankursundara @sqrtrev Could you please give us some hints? THX

[Black Hat @BlackHatEvents]

Cautious: A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe | At this #BHUSA briefing, presenters will review a novel exploitation method pushing the dirty pipe to the next level. Learn more>> https://t.co/WyuoCYvq5w

[Yuhang Wu @wupco1996]

@zwad3 @RealWorldCTF I'm very sorry for the bad coding ...... I completed this challenge in a very short time, but only did a simple check. Thanks for exploring this solution! 👍