Rick de Jager

May I present to you; a full copy of doom, running inside of a Rollercoaster Tycoon 1 save game exploit ✨ Thanks for everyone that came to check out our @DistrictCon Junkyard talk! We had a lot of fun putting it together. (check the thread for slides / exploit)

@hash_kitten Insane 🔥🔥🔥

I reported a pre auth RCE in Wordpress - it can be exploited with no preconditions, patch your instances! slcyber.io/research-cente…

@CapkaKarel Honestly mostly intuition. I saw there was a custom file format that unpacks other files to disk and just guessed it might have path traversal.

@rdjgr How do you find this?

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663. Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.

@uglybyte @pentest_swissky nope :(

@rdjgr @pentest_swissky Excellent!! was this eligible for bounty? or at least free game pass?

Finally, two huge shout-outs for the RE work: • @ZetaTwo for the excellent RE//verse talk • The intern who released AoE2DE_s_original.exe without obfuscation ;) The bug was patched in April (update 174992); MSRC just took a while to assign the CVE.

With this proxy, we can: 1. Advertise a custom map named with a path traversal. 2. Overwrite the bug reporter exe. 3. Crash the victim’s game using a crash bug. (left as an exercise to the reader) A stealthier attacker would overwrite a game DLL instead and go undetected.

unc still got it

And here's postgres bidirectional RCE no admin required, client infects server, server infects client ♻️🐛

@_sy1vi3 @v12sec

@v12sec glad to know that this was the last vulnerability to exist in any database software.

found another one! redis 8.8.0 bidirectional RCE we will release poc after the patch

AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow) we will release PoC post disclosure and patch

Meet our #DCTF26 speaker Rick de Jager (@rdjgr )! He will present "𝐙𝐞𝐫𝐨 𝐭𝐨 𝐑𝐂𝐄 𝐢𝐧 𝐚 𝐖𝐞𝐞𝐤𝐞𝐧𝐝: 𝐅𝐮𝐳𝐳𝐢𝐧𝐠 𝐎𝐥𝐝 𝐆𝐚𝐦𝐞𝐬 𝐟𝐨𝐫 𝐌𝐞𝐦𝐨𝐫𝐲 𝐂𝐨𝐫𝐫𝐮𝐩𝐭𝐢𝐨𝐧." Mid-2000s videogames are a great target for finding RCE exploits. In this talk we'll pick a classic 2000's game, go over the process of fuzzing the game's server with a very fancy snapshot fuzzer, and fuzzing the client with the dumbest possible bit-flipper I could write in an hour. Both of these approaches lead to bugs that we'll exploit for remote code execution. Free registration: events.dragonsec.si/dctf26/

@LiveOverflow @_mixy1 If FIFA allowed robot players, and 99% of accomplished soccer players said "we hate this, this ruins our sport", would we all go "this is just what the the word 'soccer' means now"? The community gets some say in what the word "CTF" means. And nearly noone there enjoys AI v. AI.

@rdjgr @DistrictCon Can confirm we have never seen RCT played like that before!

Some stuff that we ended up scrapping for time: - We were initially going to run the slides in RCT. We actually had working code for this, but dropped it in favor of the Doom demo. - The fuzzer actually had a screenshot mode to generate a timelapse of all the maps it's generating

We (@arctic0x78 and I) ended up winning best meme target for this! Many thanks to the Junkyard crew for running the competition. It's such a cool concept and I really enjoyed all the unhinged exploits people came up with!

May I present to you; a full copy of doom, running inside of a Rollercoaster Tycoon 1 save game exploit ✨ Thanks for everyone that came to check out our @DistrictCon Junkyard talk! We had a lot of fun putting it together. (check the thread for slides / exploit)