Danis Jiang @danis_jiang Twitter profile

Pinned Tweet

Danis Jiang

5 months

Over the past month or so, I have shared "URB Excalibur: The New VMware All-Platform VM Escapes" with @0x140ce at two conferences. Now both slides are already public (basically same), CanSecWest 2024: BlackHat Asia 2024:

0

29

80

Last Seen Profiles

@hotgirlmegsfw

@HartChelsie

@MoukhterM

@ayami

@sineadgibney

@Barbaraavecw

@ASSOBRAFIR

@Ambianceur_225

@jlord52760

@augsta_

@MaestroSpIinter

@HermensKar40634

@shirakooponponz

@AshNicoleMoss

@ecryto

@wangyeberr

@MAGAProud78

@aerisedtcpa

@loeyeolcom

@GustavoCadenasF

@Cristop158881

@detectivelily

@ivg_sg

@katiedrumm

@RegtheeReal

@YaIzidoro

@augustmarkie

@carinalanae

@fl5k_i

@terlugu

@asuramen_ikari

@Rav3nbaby

@lokwaiho1

@sin_sse

@krt_eray

@marcciella

Danis Jiang

@danis_jiang

2 years

Here is my demo of the VM escape exploit on the latest version of VMware Fusion along with ESXi and Workstation. It was used to participate in GeekPwn 2022 and won the championship.

25

299

2K

Danis Jiang

@danis_jiang

2 years

This is the VMware Workstation VM escape exploit I recorded earlier by the same vulnerability😀

8

103

529

Danis Jiang

@danis_jiang

11 months

Escape from VMware ESXi’s vm with my teammates @0x140ce and @ezrak1e , such an unforgettable moment🎉🎉🎉

15

22

329

Danis Jiang

@danis_jiang

5 months

Today my colleague @0x140ce and I shared the VMware VM escape we used at GeekPwn 2022, very cool🖖 I think the slides will be public soon.

Mr. Anthony 安東尼

@darkfloyd1014

5 months

Second episode on VM Escape. Thank you so much.

0

23

3

23

109

Danis Jiang

@danis_jiang

1 year

My talk was rejected by blackhat😢. I don’t know the reason for rejection, is it because virtual machine escape is no longer popular?

14

1

87

Danis Jiang

@danis_jiang

1 year

I’m so surprised and honored to win 🏆 @PwnieAwards for Best Privilege Escalation for my VMware VM escapes research last year🥳🥳. We have submitted our research to BlackHat EU and hope we can share with you on it.

Pwnie Awards

@PwnieAwards

1 year

Thanks so much for another excellent year of Pwns! If you missed the show check out the winners here:

1

17

42

3

5

74

Danis Jiang

@danis_jiang

11 months

Introducing my new workstation, 7950x with 128GB memory and 8TB M.2 SSD + 4TB HDD🤑

10

0

65

Danis Jiang

@danis_jiang

5 months

So many audiences! BlackHat Asia #BlackHat

6

0

60

Danis Jiang

@danis_jiang

2 years

VMware has published a security advisory on the vulnerability I used to participate in GeekPwn 2022 with Xinlei Ying. Very fast🙂 #VMware #GeekPwn

3

51

Danis Jiang

@danis_jiang

1 year

我们组正在招聘研究型实习生，欢迎感兴趣的同学投简历😉

3

1

38

Danis Jiang

@danis_jiang

1 year

Cool!

Daniel Cuthbert

@dcuthbert

1 year

Winner is

0

1

8

6

1

35

Danis Jiang

@danis_jiang

6 months

So excited to be here! #CanSecWest #Pwn2Own

1

0

36

Danis Jiang

@danis_jiang

8 months

Thank you CanSecWest, looking forward to it!😉

dragosr

@dragosr

8 months

CanSecWest 2024 Presentation: URB Excalibur: The New VMware All-Platform VM/Hypervisor Escapes - Yuhao Jiang, Ant Group

1

4

18

4

1

32

Danis Jiang

@danis_jiang

6 months

Just arrived in Vancouver, very torturous… Can’t wait to attend CanSecWest now

6

0

32

Danis Jiang

@danis_jiang

11 months

0x140ce — My Mentor — Master of Pwn

0x140ce

@0x140ce

11 months

Successfully bypassing the ArrayBuffer isolation in Adobe Reader and completing the fullchain with @ezrak1e , I will have the opportunity to share with how to perform heap layout under ArrayBuffer isolation and how my vul can reuse the ArrayBuffer as an arbitrary R/W primitive.

1

25

154

0

31

Danis Jiang

@danis_jiang

2 years

2

0

28

Danis Jiang

@danis_jiang

3 months

@G2NiKo Right choice

0

25

Danis Jiang

@danis_jiang

11 months

Finally got time to replace the air filter and wash my car😌

3

0

24

Danis Jiang

@danis_jiang

2 years

Upgrade my PC to 64GB RAM and 4TB PCIe 4.0 x4 SSDs😎

4

1

17

Danis Jiang

@danis_jiang

2 years

Correction: it also impacts on ESXi, but not has the capability to bypass the sandbox yet.

1

0

17

Danis Jiang

@danis_jiang

2 years

@_Freakyclown_

VMware Fusion escape

Here is my demo of the VM escape exploit on the latest version of VMware Fusion along with ESXi and Workstation. It was used to participate in GeekPwn 2022 a...

www.youtube.com

1

3

17

Danis Jiang

@danis_jiang

1 year

Fourth time to participate in organizing D^3CTF, but the first time to create a challenge. Very happy that someone thinks RealESXi is the best challenge this year.

2

0

14

Danis Jiang

@danis_jiang

1 year

Longjing Midnight

0

8

Danis Jiang

@danis_jiang

1 year

End my 6-day vacation😌

1

0

6

Danis Jiang

@danis_jiang

2 years

@0xhatim @c3rb3ru5d3d53c Do you mean Parallels Desktop? It definitely doesn't work, because they are different software. But they should have the same attack vector.

0

6

Danis Jiang

@danis_jiang

2 years

@0xhatim @c3rb3ru5d3d53c VMware ESXi, Workstation and Fusion has nearly the same code, so all three of them contain this vulnerability.

1

0

5

Danis Jiang

@danis_jiang

2 years

@boominath7

GitHub - xairy/vmware-exploitation: A collection of links related to VMware escape exploits

A collection of links related to VMware escape exploits - xairy/vmware-exploitation

github.com

0

5

Danis Jiang

@danis_jiang

2 years

@0x49736b No need.

0

4

Danis Jiang

@danis_jiang

5 months

@vv474172261 @BlackHatEvents @XiaoWei___ Impressive work. Didn’t know there will be a mouse device under the virtual hub before🤯🤯

1

0

4

Danis Jiang

@danis_jiang

1 year

@x2021x01 But thanks to @dcuthbert , he gave me some detailed evaluations🙂

0

4

Danis Jiang

@danis_jiang

2 years

30s win🫡

0

4

Danis Jiang

@danis_jiang

11 months

@ezrak1e @0x140ce master of pwn👍

1

0

3

Danis Jiang

@danis_jiang

1 year

@x2021x01 Actually they send this same email to all rejected talks.

1

0

2

Danis Jiang

@danis_jiang

1 year

@Vegetable_Lee 什么情况，跟我说说

0

3

Danis Jiang

@danis_jiang

7 months

@dcuthbert Many thanks🙂, I will try my best to present a good talk.

0

3

Danis Jiang

@danis_jiang

1 year

Thanks to Moesang and e99p1ant for helping me build the ESXi container environment, through cluster->docker->qemu->esxi, so it can be dynamically created and destroyed.

0

2

Danis Jiang

@danis_jiang

1 year

@PwnieAwards Much thanks for nominating my VMware VM escape, but there was a mistake that we demonstrated VMware Fusion escape on @GeekPwn 2022 not pwn2own. I emailed ian 10 days ago but you seem to have missed it😢

2

0

2

Danis Jiang

@danis_jiang

2 years

@403interdit Not release yet.

0

2

Danis Jiang

@danis_jiang

2 years