πŸ”’
❌
There are new articles available, click to refresh the page.
βœ‡VoidSec

Browser Exploitation: Firefox Integer Overflow – CVE-2011-2371

By: voidsec β€”

In case you’re wondering why I’m not posting as regularly as before, with the new year, I’ve finally transitioned into a fully offensive vulnerability research and exploit development role at Exodus Intelligence that fulfilled my career dream (BTW, we’re currently hiring). In the last couple of months, I’ve worked on some exciting and challenging bugs. […]

The post Browser Exploitation: Firefox Integer Overflow – CVE-2011-2371 appeared first on VoidSec.

βœ‡VoidSec

Windows Drivers Reverse Engineering Methodology

By: voidsec β€”

With this blog post I’d like to sum up my year-long Windows Drivers research; share and detail my own methodology for reverse engineering (WDM) Windows drivers, finding some possible vulnerable code paths as well as understanding their exploitability. I’ve tried to make it as β€œnoob-friendly” as possible, documenting all the steps I usually perform during […]

The post Windows Drivers Reverse Engineering Methodology appeared first on VoidSec.

βœ‡VoidSec

Malware Analysis: Ragnarok Ransomware

By: voidsec β€”

The analysed sample is a malware employed by the Threat Actor known as Ragnarok. The ransomware is responsible for files’ encryption and it is typically executed, by the actors themselves, on the compromised machines. The name of the analysed executable is xs_high.exe, but others have been found used by the same ransomware family (such as […]

The post Malware Analysis: Ragnarok Ransomware appeared first on VoidSec.

βœ‡VoidSec

Merry Hackmas: multiple vulnerabilities in MSI’s products

By: voidsec β€”

This blog post serves as an advisory for a couple of MSI’s products that are affected by multiple high-severity vulnerabilities in the driver components they are shipped with. All the vulnerabilities are triggered by sending specific IOCTL requests and will allow to: Directly interact with physical memory via the MmMapIoSpace function call, mapping physical memory […]

The post Merry Hackmas: multiple vulnerabilities in MSI’s products appeared first on VoidSec.

βœ‡VoidSec

Driver Buddy Reloaded

By: voidsec β€”

As part of my continuous security research journey, during this year I’ve spent a good amount of time reverse-engineering Windows drivers and exploiting kernel-mode related vulnerabilities. While in the past there were (as far as I know), at least two good IDA plugins aiding in the reverse engineering process: DriverBuddy of NCC Group. win_driver_plugin of […]

The post Driver Buddy Reloaded appeared first on VoidSec.

βœ‡VoidSec

Homemade Fuzzing Platform Recipe

By: voidsec β€”

It’s no secret that, since the beginning of the year, I’ve spent a good amount of time learning how to fuzz different Windows software, triaging crashes, filling CVE forms, writing harnesses and custom tools to aid in the process. Today I would like to sneak peek into my high-level process of designing a Homemade Fuzzing […]

The post Homemade Fuzzing Platform Recipe appeared first on VoidSec.

βœ‡VoidSec

Root Cause Analysis of a Printer’s Drivers Vulnerability CVE-2021-3438

By: voidsec β€”

Last week SentinelOne disclosed a β€œhigh severity” flaw in HP, Samsung, and Xerox printer’s drivers (CVE-2021-3438); the blog post highlighted a vulnerable strncpy operation with a user-controllable size parameter but it did not explain the reverse engineering nor the exploitation phase of the issue. With this blog post, I would like to analyse the vulnerability […]

The post Root Cause Analysis of a Printer’s Drivers Vulnerability CVE-2021-3438 appeared first on VoidSec.

βœ‡VoidSec

Reverse Engineering & Exploiting Dell CVE-2021-21551

By: voidsec β€”

At the beginning of the month, Sentinel One disclosed five high severity vulnerabilities in Dell’s firmware update driver. As the described vulnerability appeared not too complicated to exploit, a lot of fellow security researchers started weaponizing it. I was one of, if not the first tweeting about weaponizing it into a _SEP_TOKEN_PRIVILEGES overwrite exploit, and […]

The post Reverse Engineering & Exploiting Dell CVE-2021-21551 appeared first on VoidSec.

βœ‡VoidSec

CVE‑2021‑1079 – NVIDIA GeForce Experience Command Execution

By: voidsec β€”

NVIDIA GeForce Experience (GFE) v.<= 3.21 is affected by an Arbitrary File Write vulnerability in the GameStream/ShadowPlay plugins, where log files are created using NT AUTHORITY\SYSTEM level permissions, which lead to Command Execution and Elevation of Privileges (EoP). NVIDIA Security Bulletin – April 2021 NVIDIA Acknowledgements Page This blog post is a re-post of the […]

The post CVE‑2021‑1079 – NVIDIA GeForce Experience Command Execution appeared first on VoidSec.

βœ‡VoidSec

Exploiting System Mechanic Driver

By: voidsec β€”

Last month we (last & VoidSec) took the amazing Windows Kernel Exploitation Advanced course from Ashfaq Ansari (@HackSysTeam) at NULLCON. The course was very interesting and covered core kernel space concepts as well as advanced mitigation bypasses and exploitation. There was also a nice CTF and its last exercise was: β€œWrite an exploit for System […]

The post Exploiting System Mechanic Driver appeared first on VoidSec.

βœ‡VoidSec

Software Testing Methodologies & Approaches to Fuzzing

By: voidsec β€”

This blog post is part of a series and a re-posting of the original article β€œFuzzing 101” that I have written for Yarix on YLabs. Introduction In this article, I would like to introduce fuzz testing as part of a vast overview of software testing approaches used to discover bugs and vulnerabilities within applications, protocols, […]

The post Software Testing Methodologies & Approaches to Fuzzing appeared first on VoidSec.

βœ‡VoidSec

Announcing ECG v2.0

By: voidsec β€”

We are proud to announce that ECG got its first major update. ECG: is the first and single commercial solution (Static Source Code Scanner) able to analyze & detect real and complex security vulnerabilities inΒ TCL/ADPΒ source-code. ECG’s v2.0 New Features On-Premises Deploy: Scan your code repository on your secure and highly-scalable offline appliance with a local […]

The post Announcing ECG v2.0 appeared first on VoidSec.

βœ‡VoidSec

Tivoli Madness

By: voidsec β€”

TL; DR: this blog post serves as an advisory for both: CVE-2020-28054: An Authorization Bypass vulnerability affecting JamoDat – TSMManager Collector v. <= 6.5.0.21 A Stack Based Buffer Overflow affecting IBM Tivoli Storage Manager – ITSM Administrator Client Command Line Administrative Interface (dsmadmc.exe) Version 5, Release 2, Level 0.1. Unfortunately, after I had one of […]

The post Tivoli Madness appeared first on VoidSec.

βœ‡VoidSec

.NET Grey Box Approach: Source Code Review & Dynamic Analysis

By: voidsec β€”

Following a recent engagement, I had the opportunity to check and verify some possible vulnerabilities on an ASP .NET application. Despite not being the deepest technical nor innovative blog post you could find on the net, I have decided to post it anyway in order to explain the methodology I adopt to verify possible vulnerabilities. […]

The post .NET Grey Box Approach: Source Code Review & Dynamic Analysis appeared first on VoidSec.

βœ‡VoidSec

CVE-2020-1337 – PrintDemon is dead, long live PrintDemon!

By: voidsec β€”

Banner Image by Sergio Kalisiak TL; DR: I will explain, in details, how to trigger PrintDemon exploit and dissect how I’ve discovered a new 0-day; Microsoft Windows EoP CVE-2020-1337, a bypass of PrintDemon’s recent patch via a Junction Directory (TOCTOU). Contents PrintDemon primer, how the exploit works? PrinterPort WritePrinter Shadow Job File Binary Diffing CVE-2020-1048 […]

The post CVE-2020-1337 – PrintDemon is dead, long live PrintDemon! appeared first on VoidSec.

βœ‡VoidSec

A tale of a kiosk escape: β€˜Sricam CMS’ Stack Buffer Overflow

By: voidsec β€”

TL;DR: Shenzhen Sricctv Technology Sricam CMS (SricamPC.exe) <= v.1.0.0.53(4) and DeviceViewer (DeviceViewer.exe) <= v.3.10.12.0 (CVE-2019-11563) are affected by a local Stack Buffer Overflow. By creating a specially crafted β€œUsername” and copying its value in the β€œUser/mail” login field, an attacker will be able to gain arbitrary code execution in the context of the currently logged-in […]

The post A tale of a kiosk escape: β€˜Sricam CMS’ Stack Buffer Overflow appeared first on VoidSec.

βœ‡VoidSec

Tabletopia: from XSS to RCE

By: voidsec β€”

During this period of social isolation, a friend of mine proposed to play some online β€œboard games”. He proposed β€œTabletopia”: a cool sandbox virtual table with more than 800 board games. Tabletopia is both accessible from its own website and from the Steam’s platform. While my friends decided to play from their browser, I’ve opted […]

The post Tabletopia: from XSS to RCE appeared first on VoidSec.

❌