Mitigations bypassed: DEP, ASLR,KASLR, SafeSEH, CFG, Protected Mode, SMEP, PAC, ** ** list might be incomplete
Joined February 2010
- Tweets831
- Following34
- Followers6.5K
- Likes3
Following the herd to BlueSky: @wtfuzz.bsky.social
Will start tweeting research stuff again in 2025.
1
1
300
Ran into a custom xml -> java deserializer. Limited in what it did. Used reflection to set fields, no setter getter. Lot of objects blocked. Deserialized object was not used. Exploited it by overwriting static field values on object that was used in Authentication. #ExploitFun
1
484
It’s always convenient when the app you are poking at has a straight up “please execute this command for me” api endpoint once you bypass the auth.
1
465
After mainly writing pocs in python and C I just finished a poc written entirely in Java. I was too lazy to rewrite their auth lib in python, but what a frustrating experience. 1/10 would not recommend. Anyways, auth bypass + command injection means:
5
628
I’m thinking about turning some recent windows kernel research and exploits into a talk. Does anyone have suggestions for conferences that currently have their CFP open or will open shortly?
After many years and tons of fun I left ExodusIntelligence recently. Enjoying some nice time off right now, spending time with the kids and not IDA 😁 No plans yet for 2024 but I’m sure something exciting will show up.
5
20
1,445
I had almost forgotten what an assault Vegas is on the eyes and ears, but Vegas was luckily kind enough to remind me real quick.
1
Been a few years, but I'll actually be in Vegas for #bh2022 hoping to run into folks I haven't seen in ages.
5
Peter Vreugdenhil retweeted
Hopes are high that some normalcy can return in 2021 and we can see our colleagues again at Blackhat. We're hosting an in-person 5-day training around that time and looking for feedback on timing. Plan before, during, or after the conference?
31%Before
12%During
21%After
37%Austin in September
52 votes • Final results Peter Vreugdenhil retweeted
We're looking for someone to take on our infrastructure, grow it, secure it, modernize it, automate it, and generally make it more awesome. If you live in central Texas and are interested in starting a dialog. Reach out to us via [email protected]
ninjajobs.org/job/4d179c3280…
Peter Vreugdenhil retweeted
2019 was a great year for Exodus and 2020 is going to be even better. We're expecting to expand the team on a variety of fronts.
If interested visit exodusintel.com/careers.html and email [email protected] with a cv and references published work
Peter Vreugdenhil retweeted
Patch-gapping in practice: Google Chrome edition (by @_2can of our nDay team)
blog.exodusintel.com/2019/09…
Peter Vreugdenhil retweeted
@_2can of our Nday team takes a closer look at the recently patched Chrome vulnerability spotted in the wild (exploit included)
blog.exodusintel.com/2019/02…
ntdll!LdrpSetProtection(0xaddr, 0) good function for x64 exploits. 2 args and a fake PE Header (9 values) at 0xaddr and it'll mark it as RWX for you. Too bad its not exported. byte match: 48 89 5C 24 08 55 56 57 41 54 41 55 48 83 EC 40 45 33 C0 0F B6 EA 4C 8B E1 48 8B D1
I like how MS keeps insisting that UAC is not a security boundary but they do try to squash bugs and techniques to bypass it. But, it is indeed not as sturdy as some of the other protection they have despite recent changes.
2
Took some doing but 'NT AUTHORITY\SYSTEM' is back. Thanks for the challenge MS, I wonder how long its going to stay up and running ;)
8
Peter Vreugdenhil retweeted
@_2can of our N-day team busts some myths regarding security fixes:
blog.exodusintel.com/2018/10…
