raptor@0xdea

When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

 Europe
0xdeadbeef.info
Joined July 2010
Pinned Tweet
raptor@0xdea
5 Oct 2021
It finally happened… I’ve been published on #Phrack! After more than five years since the last issue, #Phrack70 is out, featuring my article “Exploiting a Format String Bug in Solaris CDE”! I guess I can retire now 🐛 phrack.org/issues/70/13.html…
6
65
323
CVE-2022-26766: the CoreTrust bug "For years, macOS allowed any root certificate when checking code signatures, making code signing completely useless." // bug discovered by @LinusHenze // writeup by @zhuowei worthdoingbadly.com/coretrus…
12
423
1,287
“unprivileged users with UID > INT_MAX can successfully execute any systemctl command” 😱 github.com/systemd/systemd/i…
19
605
868
Sniffing SSH passwords TL;DR # pgrep -l sshd 6235 sshd # strace -f -p 6235 -e trace=write -o capture networklogician.com/2021/04/…
12
216
804
Automating binary vulnerability discovery with Ghidra and @Semgrep, by yours truly 💚 security.humanativaspa.it/au…
7
243
790
"The SQL injection is mitigated client-side" @vendorexcuses @Hackerfessions @thegrugq @SwiftOnSecurity @owasp
8
507
697
Command line Russian roulette #donttrythisathome
5
289
530
As it turns out, a non-negligible number of people in infosec don’t know what L0phtCrack is and, I assume by extension, what L0pht is. I suppose it’s somewhat normal but it shouldn’t be. Our roots are important. We should not forget them. I think.
42
57
500
The upcoming #Ghidra version 10 is full of new juicy features! Including the much anticipated debugger… github.com/NationalSecurityA…
4
156
478
Good primer on #windows access token abuse by @defte_ @sensepost @orangecyberdef Abusing Windows’ tokens to compromise #activedirectory without touching LSASS sensepost.com/blog/2022/abus… Tool release: github.com/sensepost/imperso…
6
123
492
53,280
Replying to @ParchmentScroll @thegrugq
👆
4
102
417
This remains a pretty accurate definition of hacking 🤟
Jerry Gamblin
@JGamblin
25 Mar 2017
Sometimes, hacking is just someone spending more time on something than anyone else might reasonably expect.
5
82
440
Always a great read: dolosgroup.io/blog/2021/7/9/… “We took a locked down FDE laptop, sniffed the BitLocker decryption key coming out of the TPM, backdoored a virtualized image, and used its VPN auto-connect feature to attack the internal corporate network.”
7
126
443
Google Compute Engine (GCE) VM takeover via DHCP flood - gain root access by getting SSH keys added by google_guest_agent 🤨 github.com/irsl/gcp-dhcp-tak…

GitHub - irsl/gcp-dhcp-takeover-code-exec: Google Compute Engine (GCE) VM takeover via DHCP flood -...

Google Compute Engine (GCE) VM takeover via DHCP flood - gain root access by getting SSH keys added by google_guest_agent - irsl/gcp-dhcp-takeover-code-exec

github.com
3
145
434
This is fascinating… 🦠 Reverse Engineering the source code of the BioNTech/Pfizer SARS-CoV-2 Vaccine berthub.eu/articles/posts/re…
4
150
375
A decompiler for VSCode: Integrating Ghidra/IDA Pro into Visual Studio Code 😮 marketplace.visualstudio.com…

Decompiler - Visual Studio Marketplace

Extension for Visual Studio Code - Decompile the $h*! out of things

marketplace.visualstudio.com
5
143
373
CVE-2020-16898 | Windows TCP/IP Remote Code Execution Vulnerability 😱 portal.msrc.microsoft.com/en…
4
182
375
Nice little tool to “search across a half million git repos” grep.app/
3
82
340
A cool vulnerability in FreeBSD ftpd thezdi.com/blog/2020/12/21/c…
5
129
309
My unsolicited advice to young hackers: don’t get stuck for too long with CTFs, don’t be afraid to move to real-world stuff. It’s more fulfilling and interesting than you think. Chances are that real-world challenges are even easier than CTFs (for some definitions of “easier”).
12
47
316
By the way, if you're into x86-64 assembly and you like riddles and/or poetry, I highly recommend "xchg rax, rax" by @realXorpd.
6
38
311
L0phtCrack is Now Open Source l0phtcrack.gitlab.io/
5
72
306
For all the people out there learning to hack their way through @offsectraining #OSCP and other #CTF-style challenges, I’m gonna tweet a few high quality resources. Here we go…
5
167
310
Wow
6
61
277
Demo exploitation of the POP SS vulnerability (CVE-2018-8897) leading to unsigned code execution with kernel privileges PoC: github.com/can1357/CVE-2018-… Writeup: blog.can.ac/2018/05/11/arbit…

GitHub - can1357/CVE-2018-8897: Arbitrary code execution with kernel privileges using CVE-2018-8897.

Arbitrary code execution with kernel privileges using CVE-2018-8897. - can1357/CVE-2018-8897

github.com
1
211
298
WordPress 5.0.0 Remote Code Execution “This blog post details how a combination of a Path Traversal and Local File Inclusion vulnerability lead to RCE in the WordPress core. The vulnerability remained uncovered for over 6 years.” blog.ripstech.com/2019/wordp…

Sonar blog

Sonar's blogs showcase our solutions and products: SonarQube Cloud, SonarQube Server, and SonarQube for IDE - trusted by over 7 million developers

sonarsource.com
4
199
297
The @qualys team is back at it! pwnkit: Local Privilege Escalation in polkit’s pkexec (CVE-2021-4034) openwall.com/lists/oss-secur…
94
281
CVE-2022-43995 is really something. Sudo 1.8.0 through 1.9.12 contains an array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by local users with access to Sudo by entering a password of 7 chars or fewer. github.com/sudo-project/sudo…
3
88
289
“AD is a system where any time you hack any computer on the network, you can become the domain controller, and own the whole company. That’s just how it works.” —@daveaitel
2
57
281
#Ubuntu Privilege Escalation bash one-liner using CVE-2023-32629 & CVE-2023-2640 github.com/ThrynSec/CVE-2023… Nifty #PoC! infosec.exchange/@raptor/111…

GitHub - ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation: Ubuntu Privilege Escalation bash...

Ubuntu Privilege Escalation bash one-liner using CVE-2023-32629 & CVE-2023-2640 - ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation

github.com
3
92
265
38,432
Just a reminder that sshuttle is awesome “Transparent proxy server that works as a poor man’s VPN. Forwards over ssh. Doesn’t require admin. Works with Linux and MacOS. Supports DNS tunneling.” github.com/sshuttle/sshuttle

GitHub - sshuttle/sshuttle: Transparent proxy server that works as a poor man's VPN. Forwards over...

Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling. - sshuttle/sshuttle

github.com
4
93
262
Here’s the collection of the most significant exploits that I’ve published in the past three decades or so. Enjoy! github.com/0xdea/exploits

GitHub - 0xdea/exploits: A handy collection of my public exploits, all in one place.

A handy collection of my public exploits, all in one place. - 0xdea/exploits

github.com
1
53
266
17,091
This is a bit dated, but it's a very well written article on the vulnerability research process, from setting up the environment to target selection, and from bug hunting via fuzzing to exploitation. Very recommended reading. medium.com/@maxi./finding-an…

Finding and exploiting CVE-2018–7445

Unauthenticated RCE in MikroTik’s RouterOS SMB

medium.com
1
55
262
Some good articles on modern heap exploitation by @Dooflin5 maxwelldulin.com/BlogPost/Ho… maxwelldulin.com/BlogPost/An… maxwelldulin.com/BlogPost/Ho… maxwelldulin.com/BlogPost/Ho… maxwelldulin.com/BlogPost/Ho…

House of Husk - In Depth Explanation

House of Husk - In Depth Explanation

maxwelldulin.com
6
78
243
Windows TCP/IP Remote Code Execution Vulnerability (CVE-2022-34718) 🤨 msrc.microsoft.com/update-gu…
1
78
233
Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFG connormcgarr.github.io/hvci/
1
82
221
“mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse.” github.com/blackarrowsec/mss…

GitHub - blackarrowsec/mssqlproxy: mssqlproxy is a toolkit aimed to perform lateral movement in...

mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse - blackarrowsec/mssqlproxy

github.com
1
115
214
I was investigating another 0day, when I noticed that Solaris 11 is also affected by the recent Xorg local privilege escalation vulnerability (CVE-2018-14665). Here’s my fresh exploit: github.com/0xdea/exploits/bl… Please read comments carefully before running it.
4
124
201
This writeup is amazing… How I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit blog.polybdenum.com/2021/05/…
73
209
Awesome Linux kernel vuln-dev writeup from a few months ago 👏 CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google’s KCTF Containers willsroot.io/2022/01/cve-202…
70
212
And here we are, finally! 🐛🚿 CVE-2019-3010 - Local privilege escalation on Solaris 11.x via xscreensaver techblog.mediaservice.net/20…
6
102
203
I’ve just got my #oscp certificate from @offsectraining It’s been a fun ride! 🥂
17
10
190
Replying to @AdrianEdmondson @thegrugq
My fav Bucky Fuller’s quote
3
31
157
Bypass CrowdStrike Falcon EDR protection against process dump like lsass.exe 🧐 medium.com/@balqurneh/bypass…
4
69
190
Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472) secura.com/blog/zero-logon Hmm, it looks bad. Looking forward to reading the whitepaper tomorrow!

Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472) |...

Bureau Veritas Cybersecurity is your independent, specialised advisor taking care of your digital security needs. We bundle our services into a complete portfolio that enables you to be proactive and...

cybersecurity.bureauveritas.com
94
193
Fixing the Unfixable: Story of a Google Cloud SSRF < well-written writeup with a couple of final twists 😅 bugs.xdavidhu.me/google/2021…
1
56
191
This is a good intro to (glibc) heap exploitation for beginners by @dhaval_kapil heap-exploitation.dhavalkapi…

Preface | heap-exploitation

heap-exploitation.dhavalkapil.com
1
62
194
Very well written #Windows #patchdiffing and #nday #exploitation walkthrough ✊ Dissecting and Exploiting TCP/IP RCE #Vulnerability EvilESP (CVE-2022-34718) // by Valentina Palmiotti securityintelligence.com/pos…
1
59
186
23,012
The exploit is here, by the way: pastebin.com/4nzunPB5

huawei 0day - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com
Nicolas Krassas
@Dinosn
29 Dec 2017
Huawei router exploit (CVE-2017-17215) involved in Satori and Brickerbot was leaked online securityaffairs.co/wordpress…
1
125
182
Shufflecake is a tool for Linux that allows to create multiple hidden volumes on a storage device in such a way that it is very difficult, even under forensic inspection, to prove the existence of such volumes. research.kudelskisecurity.co…
2
57
179
CVE-2023–26604: "[...] This presents a substantial security risk when running systemctl from Sudo, because #less executes as root when the terminal size is too small to show the complete systemctl output." medium.com/@zenmoviefornotif…
5
54
167
33,072
Magellan: remote code execution vulnerability in SQLite (affecting many applications and most notably Chromium): blade.tencent.com/magellan/i… Detailed bug description: news.ycombinator.com/item?id… PoC: worthdoingbadly.com/sqlitebu…
118
166
This is pretty cool: github.com/0xsobky/HackVault… jaVasCript:/*-/*`/*\`/*‘/*“/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/—!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Unleashing an Ultimate XSS Polyglot

A container repository for my public web hacks! Contribute to 0xSobky/HackVault development by creating an account on GitHub.

github.com
62
175
Ghidra 10 is out! ghidra-sre.org/ github.com/NationalSecurityA…
1
46
160
The Discovery and Exploitation of CVE-2022-25636 (a heap out of bounds write in the Linux kernel) nickgregory.me/linux/securit…
54
155
Here’s some useful #vulnerability #research and #secure #code #review resources High-level approach to code reviews: web.archive.org/web/20211209… alexplaskett.github.io/demys… frycos.github.io/vulns4free/… google.github.io/eng-practic… methodsandtools.com/archive/… fluentcpp.com/2021/11/30/how… 1/3
1
52
161
And here’s the original article that applied a similar methodology, by @wcbowling GitHub - RCE via git option injection (almost) - $20,000 Bounty devcraft.io/2020/10/18/githu…
1
37
160
It took just one Sunday morning of work to go from zero to 0day on a Solaris 11.4 box! I guess I haven’t lost my swing 🐛🚿
4
34
157
Long, detailed read that digs into the recent dirty pipe vulnerability of the Linux kernel Exploration of the Dirty Pipe Vulnerability (CVE-2022-0847) lolcads.github.io/posts/2022…

Exploration of the Dirty Pipe Vulnerability (CVE-2022-0847)

Intro This blog post reflects our exploration of the Dirty Pipe Vulnerability in the Linux kernel. The bug was discovered by Max Kellermann and described here . If you haven’t read the original...

lolcads.github.io
1
57
159
RCE in Intel AMT for all current CPUs intel.com/content/www/us/en/…
4
133
154
I love this! Draw.io libraries for #threatmodeling github.com/michenriksen/draw…
41
158
19,106
Eight years later, I’ve updated my most-starred @github repository with some new @fridadotre scripts, inspired by @spaceraccoonsec new book “From Day Zero to Zero Day”. Check it out: github.com/0xdea/frida-scrip…

GitHub - 0xdea/frida-scripts: A collection of my Frida instrumentation scripts to reverse engineer...

A collection of my Frida instrumentation scripts to reverse engineer mobile apps and more. - 0xdea/frida-scripts

github.com
37
160
8,725
LibSSH Authentication Bypass 😱 libssh.org/2018/10/16/libssh…
1
129
150
Nice argument injection in vscode, discovered by @SonarSource blog.sonarsource.com/securin…
3
38
153
An opinionated guide on how to reverse engineer software (part 1 and 2) by @withzombies margin.re/2021/11/an-opinion… margin.re/2022/11/an-opinion…

An opinionated guide on how to reverse engineer software, part 1

This is an opinionated guide. After 12 years of reverse engineering professionally, I have developed strong beliefs on how to get good at RE.

margin.re
1
41
146
Today I realized young hackers don’t know about THC/ADM/teso/etc. I also realized there are no modern hacking crews, except perhaps for CTF teams. That’s probably to be expected but it’s also kinda sad, dunno…
18
26
141
Search for open Amazon S3 Buckets and their contents  buckets.grayhatwarfare.com/
60
141
A minimal operating system (2K LOC) on #QEMU and a RISC-V board “This project's vision is to help every college student read all the code of an operating system.” 👏 github.com/yhzhang0128/egos-…

GitHub - yhzhang0128/egos-2000: Envision a future where everyone can read all the code of an...

Envision a future where everyone can read all the code of an educational operating system. - yhzhang0128/egos-2000

github.com
30
133
16,900
IBM trying to censor researchers in 2016 deserves to be publicly shamed 🙊
13
161
135
Excellent Linux kernel vuln-dev writeup by @kallsyms The Discovery and Exploitation of CVE-2022-25636 nickgregory.me/linux/securit…
1
52
144
So Long, and Thanks for All the Shells #Solaris github.com/0xdea/exploits/tr…
3
67
137
From open redirect to RCE in one week << cool writeup 👏 medium.com/@byq/from-open-re…
1
31
141
This is pretty handy: knowledge base of exploit mitigations available across numerous operating systems, architectures and applications and versions, by @NCCGroupInfosec github.com/nccgroup/exploit_…

GitHub - nccgroup/exploit_mitigations: Knowledge base of exploit mitigations available across...

Knowledge base of exploit mitigations available across numerous operating systems, architectures and applications and versions. - nccgroup/exploit_mitigations

github.com
2
47
134
Periodic reminder: if you’re a reverse engineering buff, you should check out the ASM poetry book at xorpd.net/pages/xchg_rax/sni…
2
69
133
Comprehensive list of CVE-2021-3156 sudo exploits targeting Linux x64, with writeup ✊ github.com/worawit/CVE-2021-…

GitHub - worawit/CVE-2021-3156: Sudo Baron Samedit Exploit

Sudo Baron Samedit Exploit. Contribute to worawit/CVE-2021-3156 development by creating an account on GitHub.

github.com
58
134
Impacket implementation of the PrintNightmare PoC originally created by Zhiniang Peng (@edwardzpeng) & Xuefeng Li (@lxf02942370) Tested on a fully patched 2019 Domain Controller Execute malicious DLL’s remotely or locally github.com/cube0x0/CVE-2021-…
1
46
134
Introducing the New Universal Android SSL Pinning Bypass (and more!) by my coworker Mattia Vinci, based on @fridadotre 🤟 techblog.mediaservice.net/20… @mobilesecurity_
5
63
134
Awesome #linux #kernel #vulnerability #research and #exploitation writeup by @ky1ebot [CVE-2022-1786] A Journey To The Dawn blog.kylebot.net/2022/10/16/…
37
131
18,649
Looking at patch gap vulnerabilities in the VMware ESXi TCP/IP stack, by @thezdi thezdi.com/blog/2022/7/25/lo…
41
122
You gotta love this W^X JIT bypass 💚 thezdi.com/blog/2022/8/17/bu…
1
30
126
Having fun with @Google #ProjectZero’s semantic grep tool weggli. It’s easy to setup and use, and I like it a lot! github.com/googleprojectzero…

GitHub - weggli-rs/weggli: weggli is a fast and robust semantic search tool for C and C++ codebas...

weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases. - weggli-rs/weggli

github.com
1
26
133
The new @OnionBrowser app version 2 looks nice 👍 #tor @torproject
36
106
unCaptcha: A Low-resource Defeat of reCaptcha’s Audio Challenge uncaptcha.cs.umd.edu/ Defeating the latest version of reCaptcha with 91% accuracy github.com/ecthros/uncaptcha…
47
118
Remote Deserialization Bug in Microsoft’s RDP Client through Smart Card Extension (CVE-2021-38666) 🤩 thalium.github.io/blog/posts…
50
118
Great intro to type confusion bugs in C++ by @gannimo 👍 media.ccc.de/v/34c3-8848-typ…
29
122
I've converted most of my C/C++ #Semgrep rules into weggli patterns. In this new article on the @hnsec blog I provide some guidance on how to integrate this small yet powerful tool in your #bug #hunting workflow. security.humanativaspa.it/a-… infosec.exchange/@raptor/111…
1
32
122
16,690
Qualys does it again! #regreSSHion: #RCE in #OpenSSH's server, on glibc-based #Linux systems (CVE-2024-6387) qualys.com/2024/07/01/cve-20…
1
45
124
17,445
Multiple Exploits are out for CVE-2020-0688 (Microsoft Exchange deserialization) github.com/Ridter/cve-2020-0… github.com/random-robbie/cve… github.com/Jumbo-WJB/CVE-202… github.com/Yt1g3r/CVE-2020-0… github.com/youncyb/CVE-2020-…

GitHub - Ridter/cve-2020-0688: cve-2020-0688

cve-2020-0688. Contribute to Ridter/cve-2020-0688 development by creating an account on GitHub.

github.com
1
46
123
My take on CVE-2018-14665: OpenBSD 6.3 and 6.4 local root privilege escalation via cron. github.com/0xdea/exploits/bl… Thanks to @hackerfantastic and @info_dox for the inspiration! @HackwithGithub @ExploitDB
2
80
120
Old-ish but fundamental #Linux and #Unix knowledge False Boundaries and Arbitrary Code Execution by @grsecurity: forums.grsecurity.net/viewto… /proc/self/mem: offlinemark.com/2021/05/12/a… Hacker’s Hut: win.tue.nl/~aeb/linux/hh/hh-… win.tue.nl/~aeb/linux/hh/hh-… win.tue.nl/~aeb/linux/hh/hh-…
1
32
126
Awesome writeups on embedded systems hacking “How I Hacked my Car” programmingwithstyle.com/pos… programmingwithstyle.com/pos… programmingwithstyle.com/pos… programmingwithstyle.com/pos…
3
39
123
Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the ALPC interface Advisory: kb.cert.org/vuls/id/906424 Exploit: github.com/SandboxEscaper/ra…

CERT/CC Vulnerability Note VU#906424

Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the ALPC interface

kb.cert.org
84
123
In praise of tactical exploitation: techblog.mediaservice.net/20… 6 new PoC tools released: github.com/0xdea/tactical-ex… No bugs were harmed 🐜👍
1
73
116
Be Careful with Python's New-Style String Format // h/t @ret2bed lucumr.pocoo.org/2016/12/29/…
4
33
114
I’ve just published my exploit for the LPE and RCE in OpenBSD’s OpenSMTPD recently disclosed by @qualys You can find it here: github.com/0xdea/exploits/bl… #opensmtpd_too_open
59
109
“A lot of us have built lives, careers, and considerable material comfort on top of something that people told us to stop doing for most of our youth.” — @halvarflake
26
105
And here are the latest #VulnerabilityResearch and #ReverseEngineering tools that I wrote in #Rust github.com/0xdea/rhabdomance… github.com/0xdea/haruspex github.com/0xdea/augur github.com/0xdea/oneiromance… Make sure to check the accompanying @hnsec blog posts for additional details 🪲🎯

GitHub - 0xdea/rhabdomancer: Vulnerability research assistant that locates calls to potentially...

Vulnerability research assistant that locates calls to potentially insecure API functions in a binary file. - 0xdea/rhabdomancer

github.com
23
117
5,443
Periodic reminder that eaphammer by @s0lst1c3 is perfect for all your WPA2-Enterprise evil twin attack needs 😈 and more… github.com/s0lst1c3/eaphamme…
1
49
113
New tool from p0: weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases. github.com/googleprojectzero…

GitHub - weggli-rs/weggli: weggli is a fast and robust semantic search tool for C and C++ codebas...

weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases. - weggli-rs/weggli

github.com
3
44
114