Kirk Swidowski @de7ec7ed

de7ec7ed.com Joined March 2012

Tweets

641
Followers

77
Following

114
Likes

196

j00ru//vx @j00ru

6 years ago

This weekend, I updated the Windows syscall tables on my blog and GitHub (github.com/j00ru/windows-…) with the upcoming Windows 10 1903 (19H1). There's one new ntoskrnl syscall – NtCreateCrossVmEvent (STATUS_NOT_IMPLEMENTED), with 8 removed and 24 added in win32k since 1809.

2 180 388 0 31

Bill Demirkapi @BillDemirkapi

6 years ago

Remote Code Execution on most of all Dell machines d4stiny.github.io/Remote-Code-Ex…

31 571 1K 0 83

sigpwn @GHIDRA_RE

7 years ago

SOURCES ARE OUT! We get this a lot, most of the java sources are already out, it went out along with the released zip. Just look for *-src.zip files.

3 105 250 0 10

Download Image

Alex Matrosov @matrosov

7 years ago

Happy to announce all the chapters of bootkits.io now available in Early Access (~600 p). 4 years of writing/rewriting. The book almost a double the size from the original proposal (rootkits/bootkits, UEFI threats and modern forensics) Thx @billpollock and @nostarch!!

24 223 590 0 38

x0rz @x0rz

7 years ago

F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking (RCE as NT AUTHORITY\SYSTEM 😱) landave.io/2018/06/f-secu… #antivirus #vulnerability

10 335 549 0 16

Download Video

John Aakerblom @jaakerblom

7 years ago

iPhone X 11.3.1 kernel exploit simple PoC for the bug from my 30th May tweet: github.com/potmdehex/mult… I am not a developer and promise no further commits. Deres tur, ETA boys

16 121 296 0 8

bigric3 @bigric3_

7 years ago

#CVE-2018-8120 analysis and exploit code github.com/bigric3/cve-20…

4 94 128 0 6

chaignc - Sanson @chaignc

7 years ago

Leveraging a double-free in JPEG image to corrupt JS objects using a heap spray in Adobe Reader, and then call gate to get in ring 0 of windows. welivesecurity.com/2018/05/15/tal… Thx @cherepanov74 CVE-2018-4990 and CVE-2018-8120

1 67 126 0 2

Download Image

Dmytro Oleksiuk 💥 [email protected] @d_olex

7 years ago

More on security of Intel S1200 server motherboard series (thread: ). it seems there's no Boot Guard and PRx flash write protection configured, so, *any* System Management Mode vulnerability means full platform firmware pwnage [1/2]

2 32 57 0 1

Download Image

Zuk @ihackbanme

7 years ago

CVE-2018-8897 (POP SS CPU bug <3). POC + Write-up: blog.can.ac/2018/05/11/arb… Worse than Meltdown IMO but less coverage. Maybe because it doesn't have a cool name and logo ¯\_(ツ)_/¯ #YearOfCPUBugs

5 127 203 0 4

[email protected] @0xdea

7 years ago

Demo exploitation of the POP SS vulnerability (CVE-2018-8897) leading to unsigned code execution with kernel privileges PoC: github.com/can1357/CVE-20… Writeup: blog.can.ac/2018/05/11/arb…

1 214 303 0 12

Can Bölük @_can1357

7 years ago

Arbitrary Code Execution At Ring 0 Using CVE-2018-8897: blog.can.ac/2018/05/11/arb…

5 120 170 0 7

Nemi @0xNemi

7 years ago

Now that patches are out... See if you're vulnerable to CVE-2018-8897 on Windows: github.com/nmulasmajic/CV… (Precompiled binary at github.com/nmulasmajic/CV…) #infosec #security

0 75 86 0 3

Download Image

Nick Peterson 🇺🇲 @nickeverdox

7 years ago

Shout out to Andy Lutomirski(Linux) & Andrew Cooper(Xen) for doing additional testing and enlightening us to the fact that Intel is also vulnerable to a spurious #DB after SYSCALL, not just AMD. We've updated the paper to reflect this. everdox.net/popss.pdf

0 13 24 0 0

Alex Ionescu @aionescu

7 years ago

Hugo kudos to @0xNemi for discovering a huge cross-OS vulnerability in Intel and AMD processor architecture that leads to privilege escalation with a simple “pop SS”. This is way bigger than meltdown IMO ;-) cve.mitre.org/cgi-bin/cvenam…

7 290 462 0 7

Nick Peterson 🇺🇲 @nickeverdox

7 years ago

cve-2018-8897 whitepaper triplefault.io/2018/05/spurio…

2 178 225 0 7

Alex Ionescu @aionescu

7 years ago

Welp, it turns out the #Meltdown patches for Windows 10 had a fatal flaw: calling NtCallEnclave returned back to user space with the full kernel page table directory, completely undermining the mitigation. This is now patched on RS4 but not earlier builds -- no backport??