-
Analyzing a Modern Linux Kernel Vulnerability (CVE-2023-0266)
Deep dive into CVE-2023-0266, a race condition vulnerability in the Linux kernel sound subsystem that was exploited in-the-wild against Android devices. Exploring the technical details of how 32-bit/64-bit compatibility layers introduced a use-after-free condition.
read more → -
Local Privilege Escalation Vulnerability in Ant Media Server (CVE-2024-32656)
Disclosure of a local privilege escalation vulnerability in Ant Media Server arising from an unauthenticated JMX remote management interface accessible to unprivileged local users, enabling code execution as root.
read more → -
DoubleQlik: Bypassing the Fix for CVE-2023-41265 to Achieve Unauthenticated Remote Code Execution
Patch diffing Qlik's fix for CVE-2023-41265 revealed an exact string comparison against "chunked" in the proxy's new header validation. Sending "tchunked" instead reintroduces the CL.TE request tunneling issue, and a HEAD request to a font path reaches it unauthenticated. Tracked as CVE-2023-48365.
read more → -
ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal
Full technical writeup of CVE-2023-41265 and CVE-2023-41266 in Qlik Sense Enterprise for Windows. Chaining an HTTP request tunneling flaw in the C# proxy service with a path traversal authentication bypass to impersonate the sa_repository service account and achieve unauthenticated remote code execution via external program tasks.
read more → -
Bypassing Akamai's Web Application Firewall Using an Injected Content-Encoding Header
How we bypassed Akamai's XSS filtering by combining a CRLF injection vulnerability with response compression to inject a Content-Encoding header and deliver a compressed malicious payload.
read more → -
Elevating Privileges with Authentication Coercion Using DFSCoerce
DFSCoerce abuses the MS-DFSNM interface to coerce a domain controller into authenticating to an attacker-controlled host, giving another coercion primitive alongside PrinterBug and PetitPotam for driving relay attacks.
read more → -
Relaying to ADFS Attacks
Active Directory Federation Services accepts Windows Integrated Authentication, which makes it a viable relay target. Covers relaying coerced NTLM authentication to ADFS to obtain tokens for federated cloud applications, and the conditions that make it work.
read more → -
Computer Account Relaying Vulnerabilities Part 2
Part two revisits Computer AdminTo Computer relationships with newer coercion primitives and relay targets, and covers what changed in the technique since the original writeup.
read more → -
Palo Alto Networks GlobalProtect Remote Code Execution Vulnerability (CVE-2022-0016)
Disclosure of CVE-2022-0016 in the Palo Alto Networks GlobalProtect VPN client. The Connect Before Logon feature spawned an embedded browser on the Windows login screen, and escaping it yielded code execution as SYSTEM before any user authenticated.
read more → -
PortBender: TCP Port Redirection for Red Team Operations
How to redirect traffic from an incoming TCP port using the PortBender utility to perform SMB relay attacks and simulate Duqu 2.0-style persistence through a C2 framework like Cobalt Strike.
read more →