redpathintel @RedpathIntel

redpathintel.com Austin, TX, USA Joined July 2016

Tweets

41
Followers

10
Following

138
Likes

239

Tavis Ormandy @taviso

2 years ago

New write-up on an Intel Ice Lake CPU vulnerability, we can effectively corrupt the RoB with redundant prefixes! 🔥 An updated microcode is available today for all affected products, cloud providers should patch ASAP. lock.cmpxchg8b.com/reptar.html

12 348 1K 412K 206

kylebot @ky1ebot

4 years ago

Thanks to @itszn13 , now you can click a play button in the #how2heap main page and start learning various heap exploitation techniques! Want to learn heap in newer libc? No problem. Just select it in the panel on the left!

2 129 496 0 108

Download Image

Phil Huggins @oracuk

4 years ago

Brilliant work by our cyber security operations centre: digital.nhs.uk/cyber-alerts/2…

1 33 94 0 14

Grzegorz Tworek @0gtweet

4 years ago

Want to know if someone dumped lsass.exe? Maybe your NTFS journal keeps some #DFIR traces about *lsass*.dmp. Simple, but working! Fully functional PoC C source code (and the compiled exe) as usual: github.com/gtworek/PSBits…

3 133 344 0 60

Download Image

Cyber Advising @cyber_advising

4 years ago

SSRF to RCE with Jolokia and MBeans... thinkloveshare.com/hacking/ssrf_t…

2 93 291 0 62

Download Image

Grzegorz Tworek @0gtweet

4 years ago

Finally had a moment to test Winlogon password leaking (a.k.a. notifying) on Windows 11. No big surprise. And the flow is: -user enters password -winlogon loads mpnotify.exe -mpnotify opens RPC channel -winlogon sends pass via RPC -mpnotify forwards to DLL -DLL stores it on disk

34 697 2K 0 395

Download Image

PortSwigger Research @PortSwiggerRes

4 years ago

We wanted to fuzz all 0x10ffff characters in unicode for various CSS keywords. So we built a cool fuzzer! Want to know what characters break out of CSS strings? portswigger-labs.net/css-fuzzer/ind…

0 47 143 0 19

Brandon Falk @gamozolabs

4 years ago

Hello, I now have a streaming schedule. I'll have two educational days, and one random hacking days. There may be other unscheduled streams, but this is what the people want! twitch.tv/gamozo/schedule Tomorrow we start by getting Rust running on NT3.5 for MIPS and start hacking!

2 11 72 0 0

Joshua Wright @joswr1ght

4 years ago

No one told me I couldn't, so I'm running a free Cloud Attack and Response workshop on 11/10 using 3 modules and 3 labs from SANS SEC504 Hacker Tools, Techniques, and Incident Response. Even if you can't attend, sign up to access the lab resources! sans.org/webcasts/tech-…

11 104 333 0 75

Josh Stroschein | The Cyber Yeti @jstrosch

4 years ago

Added a maldoc that downloads formbook 👉 github.com/jstrosch/malwa…

0 2 7 0 0

Download Image

Richard Johnson @richinseattle

4 years ago

I’ve been getting quite a few inquiries about the next Advanced Fuzzing and Crash Analysis class. The next one (and last one of 2021) is November 21-24 on US Pacific time. If you can’t make it, I will continue to offer training in 2022 as well! sectrain.hitb.org/courses/advanc…

3 10 35 0 1

Trend Zero Day Initiative @thezdi

4 years ago

Confirmed! The @Synacktiv team leveraged a configuration error bug to get code execution on the PR411. They earn $40,000 and 4 Master of Pwn points. They are now in a tie for 3rd in Master of Pwn standings. #Pwn2Own #P2OAustin

0 6 40 0 0

Trend Zero Day Initiative @thezdi

4 years ago

Success! Q. Kaiser & T. Shiomitsu from IoT Inspector Research Lab were able to get code execution on the LAN interface of the Cisco RV340 router. They head off to the disclosure call to provide the details. #Pwn2Own #P2OAustin

0 2 7 0 0

Trend Zero Day Initiative @thezdi

4 years ago

Success! The @Synacktiv team didn't take long getting their root shell on the WD My Cloud Series PR4100 NAS. The head off to the disclosure Zoom to provide the details. #Pwn2Own #P2OAustin

0 3 25 0 0

Trend Zero Day Initiative @thezdi

4 years ago

Confirmed! @theori_io used a stack-based buffer overflow to get code execution on the 3TB My Cloud Home Personal Cloud from WD. This earns them $40,000 and 4 Master of Pwn points, giving them a 1 day total of $80K and 8 points. #Pwn2Own #P2OAustin

1 12 52 0 2

Trend Zero Day Initiative @thezdi

4 years ago

Confirmed! The THEORI team combined an OOB Read and a stack-based overflow to take over the WD My Cloud Pro Series PR4100. It's a unique bug chain, so they win the full $40,000 and 4 Master of Pwn points. #Pwn2Own #P2OAustin

0 19 74 0 1

Trend Zero Day Initiative @thezdi

4 years ago

Confirmed! The Synacktiv team used a heap overflow to take over the #Canon ImageCLASS MF644Cdw printer. In doing so, they win $20,000 and 2 Master of Pwn points. #Pwn2Own #P2OAustin

1 41 222 0 8

Download Image

Trend Zero Day Initiative @thezdi

4 years ago

The full schedule for #Pwn2Own Austin is now live! We had to deconflict many attempts and work around some logistical challenges, but we aren't complaining about 58 entries. See the schedule at zerodayinitiative.com/blog/2021/11/1… and watch the attempts live on YouTube and Twitch.

1 18 42 0 2

Trend Zero Day Initiative @thezdi

4 years ago

Registration for #Pwn2Own Austin is closed, and it's going to be our biggest ever with more than 55 entries. We'll be paying full price for all unique exploit chains. It's going to be an amazing contest full of exploits and intrigue. #P2OAustin #HaveFun

3 14 70 0 2

Haifei Li @HaifeiLi

4 years ago

Two more Chrome zero-days detected in the wild, let’s find out where is the Internet Explorer and start to use it. chromereleases.googleblog.com/2021/10/stable…