NEW BOT Телеграм, страница

Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample

The general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called by ROP chain to modify the shellcode memory to PAGE_EXECUTE_READWRITE, and the code execution flow is jumped to shellcode by ROP chain finally. After Windows 8.1, Microsoft introduced CFG (Control Flow Guard)[1] mitigation to verify the indirect function call, which mitigates the exploitation of tampering with vtable to get code execution.

However, the confrontation is not end. Some new methods to bypass CFG mitigation have emerged. For example, in chakra/jnoscript9, the code execution flow is hijacked by tampering with the function return address on the stack; in v8, WebAssembly with executable memory property is used to execute shellcode. In December 2020, Microsoft introduced CET(Control-flow Enforcement Technology)[2] mitigation technology based on Intel Tiger Lake CPU in Windows 10 20H1, which protects the exploitation of tampering with the function return address on the stack. Therefore, how to bypass CFG in a CET mitigation environment has become a new problem for vulnerability exploitation.

https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html

iamelli0t’s blog

Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample

The general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called…

2.62K viewsAdeL, 19:19

HackerOne

Iran Calls Natanz Atomic Site Blackout 'Nuclear Terrorism'

https://ift.tt/3mF8sEE

SecurityWeek

Iran Calls Natanz Atomic Site Blackout ‘Nuclear Terrorism’

Iran on Sunday described a blackout at its underground Natanz atomic facility an act of “nuclear terrorism,” raising regional tensions as world powers and Tehran continue to negotiate over its tattered nuclear deal.

2.53K viewsAdeL, 00:23

HackerOne

Exclusive: #RUMINT Rumor Intelligence from Iran 🇮🇷 via Israel 🇮🇱.

Nuclear facility at Natanz, Iran has suffered major damage by an attack.

Rumor 1: Israel launched a cyber attack at the facility.

Rumor 2: Israel used local assets and used explosives (likely a sabotage) and / or cyber tactics during the attack.

Rumor 3: It was an accident.

However, the facility sustained power damage and no nuclear leak occurred, as per reliable source.

2.81K viewsAdeL, 19:41

HackerOne

2.54K viewsН Е К И Б Е Р Л Е О, 09:22

HackerOne

https://swarm.ptsecurity.com/rce-cockpit-cms/

PT SWARM

From 0 to RCE: Cockpit CMS

Our team searched for bugs in the source code of Cockpit, an open-source content management system. Here is the denoscription of Cockpit from its official site: Cockpit is a headless CMS with an API-first approach that puts content first. It is designed to…

2.6K viewsAmir Kiani, 03:26

HackerOne

https://github.com/r4j0x00/exploits/tree/master/chrome-0day

2.71K viewsAmir Kiani, 05:48