OSCE // OSCP // Ethical Hacker & Red Teamer // Full Stack Developer // CTF Player @DonkeysTeam
Amsterdam, NL
Joined March 2011
- Tweets1.1K
- Following3.9K
- Followers3.2K
- Likes2.1K
Pinned Tweet
Process Creation is Dead, Long Live Process Creation — Adding BOFs Support to PEzor
Since the release of Beacon Object Files (BOFs), I wanted to support them as a new kind of output format in PEzor... Let’s dive into this short journey!
iwantmore.pizza/posts/PEzor4…
Francesco Soncina retweeted
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
Francesco Soncina retweeted
Another approach to disable EDRs (with anti-tampering). Credit goes to @sixtyvividtails for the idea🧙♂️
PendingFileRenameOperations and an NTFS junction, we can ask Windows to delete EDR binaries on reboot (with Admin privs)
A link to a complete GitHub PoC follows in replies
Francesco Soncina retweeted
I read Google's paper about their quantum computer so you don't have to.
They claim to have ran a quantum computation in 5 minutes that would take a normal computer 10^25 years.
But what was that computation? Does it live up to the hype?
I will break it down.🧵
Francesco Soncina retweeted
GitHub - TheN00bBuilder/cve-2024-11477-writeup: CVE-2024-11477 7Zip Code Execution Writeup and Analysis - github.com/TheN00bBuilder/cv…
Francesco Soncina retweeted
Releasing full 2+hr video of my browser exploitation workshop from VXCON 2024: youtube.com/live/b9OhamkAY2I
In which I show what goes inside the mind of a skilled hacker while exploiting a highly non-trivial vulnerability in v8, from zero to exploit concept.
Especially this workflow requires advanced abstract thinking, thereby emphasize the role of theoretical modeling in attacking hard zeroday research targets, which is a part of why it's fun. @zerodaytraining
Francesco Soncina retweeted
This has been one of my favorites for a while, but now it's time to let it go.
Here's my preferred way of getting the KeePass db that we often hunt for:
downgrade the executable to version 2.53, use CVE-2023-24055 and wait for the busy admin to trigger the dump of the database.
The target can remain clean and you can simply check for the dump creation.
KeePass version 2.53 can still open kdbx created with the version 2.57 and if using a proper xml the user will likely notice nothing.
Update alerts can also be disabled within the xml.
gist.github.com/naksyn/6d566…
Francesco Soncina retweeted
In part 3 of his series on exploiting #Exchange #Powershell after ProxyNotShell, ZDI researcher @chudyPB chains 3 bugs that lead to RCE, mainly by abusing the single-argument constructor conversions. Read the details at zerodayinitiative.com/blog/2…
Francesco Soncina retweeted
New blog from me on manually manipulating Vectored Exception Handlers to evade some EDRs and perform threadless process injection.
securityintelligence.com/x-f…
Accompanying code: github.com/xforcered/Vectore…
Francesco Soncina retweeted
Google Chrome In-The-Wild Type Confusion in V8 (CVE-2024-7971 [360700873]) happens when handling loop inputs inside WASM baseline (A.K.A Liftoff) compiler/assembler:
chromium-review.googlesource…
Francesco Soncina retweeted
Allocating new exploits
Pwning browsers like a kernel & Digging into PartitionAlloc and Blink engine
phrack.org/issues/71/10.html
Francesco Soncina retweeted
[RELEASE] Following the talk at DEF CON, I'm releasing all the POC projects associated with DriverJack. More info in the repos. For any additional info, hit me up ;)
- github.com/klezVirus/DriverJ…
- github.com/klezVirus/RpcProx…
- github.com/klezVirus/koppeli…
Francesco Soncina retweeted
In the UPDATE section of my post decoder.cloud/2024/04/24/hel…, I explained why you won't find my acknowledgment for CVE-2024-38061 any more.
Francesco Soncina retweeted
With the #GhostWrite CPU vulnerability, all isolation boundaries are broken - sandbox/container/VM can't prevent GhostWrite from writing and reading arbitrary physical memory on affected RISC-V CPUs. Deterministic, fast, and reliable - no side channels. ghostwriteattack.com/
Francesco Soncina retweeted
My talk demonstrating how with minor tweaks you can really frustrate command line-based detections across Windows, Linux and MacOS is now live:
⚡ youtube.com/watch?v=52tAmVLg…
@BSidesDublin #threatdetection #threathunting #lolbas #offsec
Francesco Soncina retweeted
Here’s a blog post covering all the technical details behind a strcpy bug I found in the Tony Hawk video game series that can be used to hack several gaming consoles and even get RCE on the over the network icode4.coffee/?p=954
Francesco Soncina retweeted
We're not talking about espionage. This new LaurieWired video is about Inter-process communication.
(ok, it's also about espionage, but only because it's a great analogy)
youtu.be/Fb4UoqXPEtI?si=bgYY…
Francesco Soncina retweeted
Checkout FizzBuzz101's corCTF 2024 challenge writeups!
Leaking Flags from Initramfs with Spectre v1: willsroot.io/2024/08/just-a-…
KVM Escape from a nested L2 guest to the L1 hypervisor: willsroot.io/2024/08/trojan-…
Francesco Soncina retweeted
How to achieve code execution with an Out-of-Bounds Write in Chrome V8 engine (Maglev compiler)
blog.exodusintel.com/2024/01…
Credits Javier Jimenez and Vignesh Rao
#chrome #cybersecurity
Francesco Soncina retweeted
Heap overflow in JPEG loading in Samsung's Little Kernel in bootloader allows a privileged attacker to execute persistent arbitrary code (it survives reboots and factory reset) CVE-2024-20832 by @quarkslab
Paper: sstic.org/media/SSTIC2024/SS…
Slides: sstic.org/media/SSTIC2024/SS…
