Munich, Germany
- Tweets 1,141
- Following 72
- Followers 3,434
- Likes 2,804
Decrypted the whole Fortinet 8.0.1, found vulns and encryption keys were dumped from memory, rootfs is also decrypted.
The size is pissing me off, wym its 44 GB....
1
14
151
7,970
Is this how femboys and trans people converse on the daily? @ghstwnn ghost groomed me in 1995, ... joking @cantstopnyxia
2
6
659
This is Germany for you! The best Country ever, where German citizens leave their country due to these stupid conditions!
5
12
1,923
Next Pwnbox update will be huge when it comes to ricing hardening and compatibility.
Added 150 domains with custom css that is picked by the wallpaper and/or theme you will make. It applies it to every app. Had to make it's own firefox extension just to load them from pywal since stylus has a sandbox and u cant add local files
1
14
1,088
If you guys wonder how @vxunderground got unbanned on twitter with in a day, this is them :P
1
25
1,151
Yeah well woops, didn't see that. Same it's the exact same firmware I have downloaded and checked.
1
148
Oh yeah, this is the allowed host for the CWP backdoor. 151.80.90.202 Whoever gets access to it literally has ssh access and priv keys to all the CWP instances in the world :).
Support backdoor :)
2
5
36
3,370
Holy F. That’s expensive. I got it fully built just need new frames and I will be the happiest human alive ngl
1
5
865
People that love cybersec and cyber talks etc should join our discord server!
discord.gg/0xFF
1
12
77
4,290
You guys can gladly go spit a POC for Supabase and confirm this against a Docker container :).
11
1,224
Hey guys i'm a robber. today i'll teach you how to rob quiche's keys, impersonate the server, read and inject traffic, and get code exec to root >.<
1
2
31
1,767
Job artifacts leak registry creds, image tags are mutable and unpinned. chain: env dump -> login with stolen creds -> overwrite qemu/debian:latest -> next pipeline runs your image -> exfil the rest of the CI secrets from inside the job. same tag, new digest.
3
13
991
QGA's command policy falls back to allow-all by default. any client on the agent channel -> guest-file-write /root/.ssh/authorized_keys as root -> ssh in, persistence done. or just guest-exec for instant root RCE. the channel itself has no authentication.
2
12
807
unauth QMP socket (default config) -> blockdev-add with the curl driver = SSRF running inside the hypervisor. fetch 169.254.169.254, export the node over NBD, read IAM creds back over your own socket. then chardev-add = raw TCP pivot into the internal network. no auth, no negotiation, just "oob".
1
2
23
1,422
WAKE UP NEW MARIADB RCE DROPPED!
FILE privilege + unrestricted secure_file_priv + UDF loading → full RCE as the mysqld user :P
4
25
185
13,272
"Give every AI model secure access to your business data." - @directus
Anyway, here’s a PoC for an authenticated RCE in their latest version, v12.3.1.
1
4
13
790
