ret2eax @ret2eax

#VulnResearch #ReverseEngineering #ExploitDev | 🥷🏽 homecrew.dev Australia Joined March 2016

Tweets

41
Followers

353
Following

387
Likes

288

sakura @eternalsakura13

9 months ago

My first V8 sandbox bypass vulnerability has been fixed, and I will continue to discover more. chromium.googlesource.com/v8/v8.git/+/7f…

10 39 313 19K 90

Elon Musk @elonmusk

11 months ago

Great energy from @SpaceX fans in Mexico

17K 62K 716K 114.1M 41K

Download Video

j j @mistymntncop

a year ago

In light of the issue page for CVE-2024-5274 being made public. Me and @buptsb have decided to make our exploit public. It's a bit different than the issue page POC. github.com/mistymntncop/C…

12 49 243 25K 108

j j @mistymntncop

2 years ago

type confusion causes human confusion

4 2 31 4K 2

1377 High-yield Nukes @buptsb

a year ago

CVE-2024-4947, another weird looking oob write...

3 7 57 7K 22

Download Image

Quentin M @0xdagger

3 years ago

The slides of my Hexacon talk « Attacking Safari in 2022 » are available there: synacktiv.com/sites/default/…

0 62 177 0 33

Just dropped my exploit with new cross-{cache,bucket} techniques (I love the creativity of kernel exploits, it gave me a very cool experience with SLAB allocators), the coolest part for me is the exploit, basically almost any memory corruption in Blink/Chrome can achieve RCE :D

xvonfers @xvonfers

a year ago

0 43 133 42K 59

Download Image

8 40 150 21K 65

Samuel Groß @5aelo

6 years ago

I'm very excited to share my blogpost series (including PoC code) about a remote, interactionless iPhone exploit over iMessage: googleprojectzero.blogspot.com/2020/01/remote…

21 501 1K 0 177

0xor0ne @0xor0ne

a year ago

Great blog post by @ret2eax on analysing and exploiting CVE-2020-16040 (Chrome's V8 heap corruption) homecrew.dev/posts/cve-2020… #chrome

0 27 117 10K 49

Download Image

jeff @jeffssh

a year ago

Rough copy of the FORCEDENTRY code is now available. Most relevant code is here: github.com/jeffssh/CVE-20… Blog soon!

1 44 158 27K 72

ret2eax @ret2eax

a year ago

Cool to see @Starlink tackle the plasma blackout period upon re-entry! Amazing realtime footage @SpaceX @elonmusk

Starlink @Starlink

a year ago

Cool to see @Starlink tackle the plasma blackout period upon re-entry! Amazing realtime footage @SpaceX @elonmusk

2K 5K 40K 6.2M 1K

1 0 3 356 0

Jack Ren @bjrjk

2 years ago

Full chain analysis for CVE-2022-4262 to commemorate my time spent on this non-trivial type confusion! Shoutout to @mistymntncop for his crafted artful exploit and discussion with me! And shoutout to @_clem1, @5aelo, @alisaesage for their prior work :). github.com/bjrjk/CVE-2022…

5 53 165 33K 57

VR|XD Community @zerodaylinks

2 years ago

Chromium [WIP] internal fuzzing map by source code directory, official dashboard analysis.chromium.org/coverage/p/chr…

0 9 42 18K 21

Samuel Groß @5aelo

2 years ago

Some really cool recent work by @_tsuro: * We now have a V8 exploit bounty ($10k) in the form of the V8CTF: github.com/google/securit… * A blog post about our CFI plans: v8.dev/blog/control-f…

4 9 64 10K 19

[email protected] @0xdea

3 years ago

These #Phrack articles by @5aelo are the best primers on attacking #JavaScript engines A case study of JavaScriptCore and CVE-2016-4622 phrack.org/issues/70/3.ht… #Exploiting Logic #Bugs in JavaScript JIT Engines phrack.org/issues/70/9.ht…

1 29 91 16K 37

Download Image

Samuel Groß @5aelo

2 years ago

Sharing another V8 Sandbox design document more widely: docs.google.com/document/d/1CP… This one discusses how to protect code pointers - probably the most performance sensitive part touched by the sandbox - with (almost) no performance overhead.

2 62 223 27K 65

j j @mistymntncop

2 years ago

CVE-2023-3079 is tweetable :-). function set(arr, key, val) { arr[key] = val; } function leak_hole() { for(let i = 0; i < 10; i++) { set(arguments, "foo", 1); } set([], 0, 1); set(arguments, 0, 1); return arguments[1]; } %DebugPrint(leak_hole());