Preskoči na sadržaj

My Work

27. ožujka 2018.
The Teaserbook of vulnerability research
Fotografija korisnika/ce @alisaesage
· 16. ožu 2018.

Got my 1st VM escape vulns in VirtualBox, via unprivileged guest to hypervisor on the host. A little late for ... Still a personal record: one month from zero (knowledge about the target) to zero (day). VirtualBox is nice and well-designed, I enjoyed looking at it

21 reply 170 proslijeđenih tweetova 570 korisnika označava da im se sviđa
· 31. sij 2018.

Dynamic ROP chain builder for browsers Uint8Array.prototype.rop = function(t) { function d(r,o,p) { if (r!=t[0]) return 0; for (q=0;q<t.length;q++) { if (undefined==t[q]) continue; if (p[o+q]!=t[q]) return 0; } return 1; } return this.findIndex(d); }

64 proslijeđena tweeta 165 korisnika označava da im se sviđa
· 17. ruj 2016.

New challenge solved: HackSys Extreme Vulnerable Driver Uninitialized Heap Variable Challenge :)

8 replies 69 proslijeđenih tweetova 211 korisnika označava da im se sviđa
· 26. kol 2015.

E̶x̶p̶l̶o̶i̶t̶i̶n̶g̶ Self-patching Microsoft XML with misalignments and factorials

43 proslijeđena tweeta 44 korisnika označavaju da im se sviđa
· 24. ožu 2017.

Proof of exploitable for the recent IE11/Edge googl0day vulnerability, which lay unpatched in general public for 2 weeks:

15 replies 113 proslijeđenih tweetova 143 korisnika označavaju da im se sviđa
· 21. ožu 2017.

Extremely bored in my lonesome hideaway. Here is a matrix of IE11 memory bytes disclosed via the image pixels 0day

6 replies 31 proslijeđeni tweet 88 korisnika označava da im se sviđa
· 13. lip 2016.

Sometimes a DEP violation is just a DEP violation... Even though the full stack is bananas.

1 reply 8 korisnika označava da im se sviđa
· 27. tra 2016.

Kernel's own win32k.sys ! xxxRealDrawMenuItem() patched in April MS16-039 - I think this is actually cve-2016-0143:

19 proslijeđenih tweetova 24 korisnika označavaju da im se sviđa
· 19. lis 2015.

The Windows Shell CVE-2015-2515 (MS15-109) is definitely an Use after free. /cc

5 proslijeđenih tweetova 14 korisnika označava da im se sviđa
· 25. lis 2015.
Odgovor korisniku/ci

observe the call stack 0_o (cve-2015-2515)

1 reply 1 proslijeđeni tweet 10 korisnika označava da im se sviđa
· 27. lis 2015.
Odgovor korisniku/ci

[3/3] This exploit has nearly torn my brains apart. I wish I sticked to the malware analysis lounge.

3 proslijeđena tweeta 13 korisnika označava da im se sviđa
· 8. velj 2015.
Odgovor korisniku/ci

w00t -2013-0007

1 reply 3 proslijeđena tweeta 14 korisnika označava da im se sviđa
· 28. sij 2015.
Odgovor korisniku/ci

The strange case of -2013-0007…

1 reply 3 proslijeđena tweeta 12 korisnika označava da im se sviđa
· 26. sij 2015.

Having fun with an old but fun -2013-0007 (msxml rce) :

6 korisnika označava da im se sviđa
· 15. lis 2014.

Я просто зашла в и-банк подписать платежки по зарплатам. Переполнение стека в BSS Internet Client

5 proslijeđenih tweetova 5 korisnika označava da im se sviđa
· 8. srp 2014.

Double-dip exploitable: two distinct heap uafs / two softwares / one trigger

2 korisnika označavaju da im se sviđa
· 3. srp 2014.

One thing I miss from my fuzzers is black coffee added to their morning delivery: still a human is required for this

1 proslijeđeni tweet 9 korisnika označava da im se sviđa
· 26. lip 2014.

Once in a lifetime you see this for the first time… STATUS_BUFFER_OVERRUN

1 proslijeđeni tweet 7 korisnika označava da im se sviđa
· 17. lip 2014.

Another beautiful bug. Run, baby:

1 reply 7 korisnika označava da im se sviđa
· 23. lip 2014.

Poor thing windbg, it just didn't expect a windows programmer to reset the locals stack pointer in the ebp register:

1 reply 3 korisnika označavaju da im se sviđa
· 12. lip 2014.

You know it's time to take a break from bughunting when useful software starts to fail at your glance to ASCII EIPs:

11 proslijeđenih tweetova 9 korisnika označava da im se sviđa
· 2. lip 2014.

A bug hunter's Lucky Clover, in the wild:

22 proslijeđena tweeta 28 korisnika označava da im se sviđa
· 30. kol 2011.

Did you know that SoftIce still works on XP SP3? I am such a snob.

2 proslijeđena tweeta 9 korisnika označava da im se sviđa
· 7. tra 2018.

Note: it’s not even a fraction of my actual work - eg. does not include malware analysis from prev years, full stack DFIR, pentest, entrepreneurship, nonprofit, community management, and building a hackerspace from scratch. I have no idea where I am going with all that knowledge

19 korisnika označava da im se sviđa
· 27. tra 2018.

I could compose a dozen of sad puns on the role of type confusions in my life. Let’s just say that browser was wrong... again window.__lookupGetter__('event').call(0x42424242 >> 1); // crashes more nicely on x86 Microsoft Edge CVE-2018-0893 (March 2018)

26 proslijeđenih tweetova 77 korisnika označava da im se sviđa
· 4. srp 2018.

Found a little vuln in Chrome recently. Nothing super fancy, just an uninitialized variable in ANGLE via unchecked API call to Microsoft DirectX, which can (in theory) be leveraged into a memory disclosure in the GPU process. The bug was just derestricted:

20 proslijeđenih tweetova 90 korisnika označava da im se sviđa
· 1. ruj 2018.

Guys from the Zero Day Initiative wrote a blog post about the simpler kind of bugs in Oracle VirtualBox, including those discovered by myself (hey, thanks for sparing me a write-up! 😜). Most importantly, they dropped a working PoC. Go ahead, it’s easy ->

104 proslijeđena tweeta 228 korisnika označava da im se sviđa
· 19. lip 2018.

Was awarded my 1st ‘top tier’ security bounty from Microsoft recently (15$k for a single vuln) via Edge WIP bounty program. Not a big deal, ofc - just a conveniently objectivized milestone for independent white hacker’s career. Try it ->

12 replies 9 proslijeđenih tweetova 149 korisnika označava da im se sviđa
· 31. svi 2019.

Got teaser pics, too :P

12 replies 93 proslijeđena tweeta 354 korisnika označavaju da im se sviđa
· 21. lip 2019.

To be fair, Firefox team refactored the old uconv code out of the mainline branch (non ESR). Now instead of 100 SLOC of old and buggy Unicode code they have 10000000000 SLOC of old, buggy, and also third-party ICU nightmare

My theoretical analysis of one of the vulns that I found in Firefox last year CVE-2018-5144: Overflow in nsUnicodeToBIG5::GetMaxLength can create memory-safety bugs in callers
Prikaži ovu nit
9 proslijeđenih tweetova 25 korisnika označava da im se sviđa
· 21. lip 2019.

My theoretical analysis of one of the vulns that I found in Firefox last year CVE-2018-5144: Overflow in nsUnicodeToBIG5::GetMaxLength can create memory-safety bugs in callers

1 reply 27 proslijeđenih tweetova 97 korisnika označava da im se sviđa
· 20. lip 2019.

Screen from my experiments with nginx CVE-2018-16845

5 replies 24 proslijeđena tweeta 115 korisnika označava da im se sviđa
· 14. lip 2019.

Accidentally crashed aarch64-gdb while trying to take a pretty picture of a breakpoint hit in Android kernel source code

1 proslijeđeni tweet 15 korisnika označava da im se sviđa
· 14. lip 2019.

Have set up Android kernel debugging with gdb and kernel patches. UART-less, no special cables required

12 proslijeđenih tweetova 87 korisnika označava da im se sviđa
· 7. lip 2019.

Nginx CVE-2009-2629 proof of concept testcase nginx.conf: http { ... merge_slashes off ... } HTTP request URI: //%2e%2e/

2 proslijeđena tweeta 15 korisnika označava da im se sviđa
· 4. lip 2019.

Adding a picture of Hyper-V debug log (via LIS) with a bit of extra logging added by myself, to prove as much as possible that it’s not some random BSOD

13 proslijeđenih tweetova 53 korisnika označavaju da im se sviđa
· 4. lip 2019.

Guys are asking me to move on and find more bugs. OK This is a zero-day vuln in Microsoft Hyper-V. Tier 1 memory corruption in Root Partition ring0. DoS only :P

14 replies 153 proslijeđena tweeta 561 korisnik označava da mu se sviđa
· 31. svi 2019.

Heads Up! Most recent versions of — one of the most popular web servers that powers huge portion of the Internet today — contains an unpatched remote code execution (RCE) vulnerability. Keep an eye out for the advisory and critical patch update in next 1-2 months.

Got teaser pics, too :P
Prikaži ovu nit
8 replies 331 proslijeđeni tweet 345 korisnika označava da im se sviđa
· 24. svi 2019.

Oracle is now explicitly promoting VirtualBox 3D acceleration: << that, after multuple security researchers independently confirmed that it’s extremely insecure, and I alone have found and reported a few dozens of VM escape bugs in this component last year

23 proslijeđena tweeta 65 korisnika označava da im se sviđa
· 22. svi 2019.

Btw, I checked out modern RDP internals a few weeks ago. Microsoft is currently working hard on refactoring the entire Terminal Services infrastructure

Now that Ms RDP aka Terminal Services is finally getting hot as an offensive research target (it’s scheduled for pwn2own for the 1st time, + recently published paper on client-side bugs), here is a little research on TS reversing that I presented in 2011:
Prikaži ovu nit
1 reply 11 proslijeđenih tweetova 35 korisnika označava da im se sviđa
· 9. velj 2019.

Now that Ms RDP aka Terminal Services is finally getting hot as an offensive research target (it’s scheduled for pwn2own for the 1st time, + recently published paper on client-side bugs), here is a little research on TS reversing that I presented in 2011:

7 replies 36 proslijeđenih tweetova 96 korisnika označava da im se sviđa
· 18. svi 2019.

I have reverse-engineered Qualcomm’s Linux kernel interfaces and the DIAG protocol to enable verbose logging of things such as physics variables from the radio interface, RTOS complaints, and OTA signals with PLMN from the baseband; a big deal for this crazy blackbox

6 replies 35 proslijeđenih tweetova 183 korisnika označavaju da im se sviđa
· 18. svi 2019.

A bit of my work from the past weeks: Qualcomm baseband debug-level diagnostic logging on production mobiles

8 replies 30 proslijeđenih tweetova 176 korisnika označava da im se sviđa
· 9. sij 2019.

Received my first Award of 2019: ZDI Silver. Who else, girls? (:

7 proslijeđenih tweetova 99 korisnika označava da im se sviđa
· 12. lis 2018.

Achievement unlocked: compiled a large piece of open source software that I use in my nightly work 🤓

1 reply 2 proslijeđena tweeta 35 korisnika označava da im se sviđa
· 14. ruj 2018.

Accidentally stumbled upon an (almost°) perfect storage box for my offline calc-popping scraps 😻🌈 — ° it can’t hex

1 reply 3 proslijeđena tweeta 20 korisnika označava da im se sviđa
· 26. lis 2018.

Did they forget a DCOM/RPC endpoint?

2 proslijeđena tweeta 19 korisnika označava da im se sviđa
· 2. srp 2019.

I have reverse-engineered 's patch for the vuln in VMWare ESXi that was exploited at 2018 to take it down for the first time. It's an uninitialized stack variable usage RCE in the host-side code of vmxnet3 network adapter. Binary diff via Workstation 15.0.0/15.0.1

5 replies 89 proslijeđenih tweetova 307 korisnika označava da im se sviđa
· 4. srp 2019.

Getting back to one of the less boring projects of mine. Can you recognize the ISA without referring elsewhere?

10 replies 9 proslijeđenih tweetova 53 korisnika označavaju da im se sviđa

Još aktualnih događaja
Doug Jones of Alabama says he will vote yes to convict Trump on both articles of impeachment
Politics prije 52 minute min
The Democratic senator, who is vying for re-election in Alabama, announced he'll vote to convict President Donald Trump.
1 oznaka "sviđa mi se"
I circled the world in 37 hours because of the coronavirus
prije 2 sata h
Because of the coronavirus outbreak, which led 34 countries to impose travel restrictions, I didn’t know I would be starting a journey that would be a super-accelerated version of literary character Phileas Fogg’s 80-day circumnavigation of the world
1 oznaka "sviđa mi se"
Palestinian teen killed by Israeli forces in West Bank during clashes over Trump's Middle East plan
World news prije 56 minuta min
Palestinian officials say 17-year-old Mohammed al-Haddad was shot dead in Hebron on Wednesday during clashes sparked by President Trump's recently announced "Deal of the Century." The Israeli military says the teen had thrown a molotov cocktail at soldiers.
Meet Teen Vogue's Young Hollywood Class of 2020 🌟
prije 3 sata h
These nine emerging actors see the world like us: beautifully complicated, malleable, and full of stories that need to be told.

The following Moment may contain sensitive content.

Prethodni
Sljedeće