[oss-security] Linux kernel: CVE-2022-1015,CVE-2022-1016 in nf_tables cause privilege escalation, information leak https://lwn.net/ml/oss-security/[email protected]/
How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/
David's Blog
How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables
Analysis and exploitation of Linux kernel vulnerabilities CVE-2022-1015 and CVE-2022-1016. I talk about how I found these vulnerabilities, explain the internals of nf_tables and come up with an local privilege escalation exploitation strategy.
Rip Raw: analyse the memory of compromised Linux systems https://securityonline.info/rip-raw-analyse-the-memory-of-compromised-linux-systems/
Cybersecurity News
Rip Raw: analyse the memory of compromised Linux systems
Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor
Defeating KASLR in modern operating systems https://medium.com/csg-govtech/defeating-kaslr-in-modern-operating-systems-f0d441c21b6c
Medium
Defeating KASLR in modern operating systems
Journey through this post to see how KASLR was previously bypassed on Windows 10, as well as tips on how to look for such bypasses
Fuzzing Like A Caveman 6: Binary Only Snapshot Fuzzing Harness https://h0mbre.github.io/Fuzzing-Like-A-Caveman-6/
The Human Machine Interface
Fuzzing Like A Caveman 6: Binary Only Snapshot Fuzzing Harness
Introduction It’s been a while since I’ve done one of these, and one of my goals this year is to do more so here we are. A side project of mine is kind of reaching a good stopping point so I’ll have more free-time to do my own research and blog again. Looking…
Digital Forensics Basics: A Practical Guide for Kubernetes DFIR https://sysdig.com/blog/guide-kubernetes-forensics-dfir/
Complete dissection of an APK with a suspicious C2 Server https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/
CVE-2022-25372: Local Privilege Escalation in Pritunl VPN Client https://rhinosecuritylabs.com/penetration-testing/cve-2022-25372-local-privilege-escalation-in-pritunl-vpn-client/
Rhino Security Labs
CVE-2022-25372: Local Privilege Escalation in Pritunl VPN Client
The Pritunl VPN Client service is vulnerable to an arbitrary file write as SYSTEM on Windows.
Randomizing the KUSER_SHARED_DATA Structure on Windows https://msrc-blog.microsoft.com/2022/04/05/randomizing-the-kuser_shared_data-structure-on-windows/
Analysis of CVE-2022-21882 "Win32k Window Object Type Confusion Exploit"
https://www.coresecurity.com/core-labs/articles/analysis-cve-2022-21882-win32k-window-object-type-confusion-exploit
https://www.coresecurity.com/core-labs/articles/analysis-cve-2022-21882-win32k-window-object-type-confusion-exploit
Coresecurity
Analysis of CVE-2022-21882 "Win32k Window Object Type Confusion Exploit" | Core Security
This blog analyzes the “Win32k Window Object Type Confusion” that abuses the CVE-2022-21882 vulnerability. It’s based on the existing Proof of Concept (POC), which is both interesting and quite complex. It can be treated as an interactive guide to be used…
Detecting malicious artifacts using an ETW consumer in kernel mode https://www.countercraftsec.com/blog/post/detecting-malicious-artifacts-using-an-etw-consumer-in-kernel-mode/
CounterCraft
Detecting Malicious Artifacts Using an ETW Consumer in Kernel Mode
Post-exploitation tooling is becoming increasingly sophisticated and often evades detection by EDRs, meaning sometimes we will not be able to detect when an attacker is able to load his code into memory. Here's a way to detect artifacts that are already loaded…
Dirty Pipe Explained - CVE-2022-0847 https://www.hackthebox.com/blog/Dirty-Pipe-Explained-CVE-2022-0847
Hack The Box
Dirty Pipe Explained - CVE-2022-0847
On 7th March’22, security researcher Max Kellermann published the vulnerability nicknamed ‘Dirty-Pipe’ which was assigned as CVE-2022-0847. This vulnerability affects the Linux kernel.
Exploiting CVE-2022-0778, a bug in OpenSSL vis-à-vis WebRTC platforms https://www.rtcsec.com/article/exploiting-cve-2022-0778-in-openssl-vs-webrtc-platforms/
Enablesecurity
Exploiting CVE-2022-0778, a bug in OpenSSL vis-à-vis WebRTC platforms
Exploiting CVE-2022-0778 in a WebRTC context requires that you get a few things right first. But once that is sorted, DoS (in RTC) is the new RCE!
CVE-2022-26381: Gone by others! Triggering a UAF in Firefox https://www.zerodayinitiative.com/blog/2022/4/7/cve-2022-26381-gone-by-others-triggering-a-uaf-in-firefox
Zero Day Initiative
Zero Day Initiative — CVE-2022-26381: Gone by others! Triggering a UAF in Firefox
Memory corruption vulnerabilities have been well known for a long time and programmers have developed various methods to prevent them. One type of memory corruption that is very hard to prevent is the use-after-free and the reason is that it has too many…
Nginx Zero-Day LDAP Reference Implementation Vulnerability Alert https://securityonline.info/nginx-zero-day-rce-vulnerability-alert/
Daily CyberSecurity
Nginx Zero-Day LDAP Reference Implementation Vulnerability Alert
An nginx Zero-Day RCE issue was identified in the nginx LDAP-auth daemon implementation, which was briefly leaked.
State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/
Check Point Research
State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage - Check Point Research
Introduction Geopolitical tensions often make headlines and present a golden opportunity for threat actors to exploit the situation, especially those targeting high-profile victims. In the past month while the Russian invasion of Ukraine was unfolding, Check…
CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html
Trend Micro
CVE-2022-22965 Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
Cado Discovers Denonia: The First Malware Specifically Targeting Lambda https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/
Darktrace
Solve Cloud Forensics at Scale
Darktrace has acquired Cado security, a cyber investigation and response solution provider and leader in cloud data capture and forensics.