Moritz Sanft
1.1K posts
Moritz Sanft
@stdoutput
security software engineer, ctf @fluxfingers @[email protected]
Germany Katılım Mart 2019
785 Takip Edilen1.3K Takipçiler
@stdoutput moritz, don't worry, that's just the cleanshotx highlighting not matching our (better) border radius
English
There are so many things like this where you know it will nail it.
Why do it locally?
English
@ProgrammerDude @HSVSphere there are far easier ways to backdoor just about any package in nixpkgs unfortunately
English
@HSVSphere I can guarantee you threat actors are very eager to backdoor nixpkgs and the fact that FOD hashes can cross-contaminate derivations it's easy to sneak in backdoors that look begnin
English
Fedora package repos and nixpkgs unaffected, btw :D
Don't use garbage distros.
🐝🇬🇷@bee_fumo
Around 400 AUR packages compromised taken over and include NPM post install hooks. @lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/" target="_blank" rel="nofollow noopener">lists.archlinux.org/archives/list/…
English
Moritz Sanft retweetledi
A fun gadget I found recently! The .NET JIT compiler makes sure there are no rwx pages by using a memfd, but that turns file writes into straight shellcode execution 🐚
Sonar Research@Sonar_Research
Shellcode execution as a service! To exploit an argument injection in Jellyfin, we searched and found a gadget in the .NET runtime to turn file writes into code execution. Learn about the bug and this new technique: sonarsource.com/blog/jellyfin-… #appsec #security #vulnerability
English
The video recording of our talk is live now: youtube.com/watch?v=xmhxPZ…
The slides can be found here: docs.google.com/presentation/d…
Enjoy!
YouTube
offensivecon@offensive_con
SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud by @pspaul95 and @stdoutput
English
@stdoutput Thank you, much appreciated.
Your talk reminded me about another gem in Postgres security space - phrack.org/issues/71/8
English
Speaking about OffensiveCon - many good talks but one I really wanted to sink my teeth into (because I'm not looking for vulns in phones) was this one: offensivecon.org/speakers/2026/… by @stdoutput and Paul Gerste. Guys - any chance for the slides?
English
@ifsecure Any chance you could share the slides? Thanks for the great talk!
English
In my OffensiveCon talk on Site Isolation yesterday, a question was asked that I didn't quite get at the moment so my answer was probably irrelevant. My apologies, especially since the question, as I understand it now, totally makes sense. Answering it here:
English
Moritz Sanft retweetledi
SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud by @pspaul95 and @stdoutput
English
Moritz Sanft retweetledi
We @wiz_io just launched zeroday.cloud - a community for vuln researchers, by vuln researchers. Feat. writeups for PostgreSQL and MariaDB RCEs (@xint_official, @pspaul95 & @stdoutput)
Stay tuned for the bug tracker and upcoming events. Big things coming soon 👀
English
Our writeup of our ZeroDay.Cloud Postgres exploit is live. We think it's a pretty neat bug and the exploitation was really fun, so check it out!
Wiz@wiz_io
The secret's out.🤫 Introducing THE ZERODAY.CLOUD COMMUNITY 👾 Inside: • 0-day vuln deep dives from @xint_official, @stdoutput, @pspaul95 & more... • Access to events & a network of world-class hackers • CTFs with prizes Join now :)
English
Trying to get some new folks onto the AI for security research Discord server: discord.gg/sVy9ahuEv
Feel free to share with your peers in the field!🤖🐛
English
Moritz Sanft retweetledi
Pwning PostgreSQL was quite fun, excited to share our research at OffensiveCon!
offensivecon.org/speakers/2026/…
English
My colleague Paul (@katexochen) has done a great write-up of how a malicious host (e.g. cloud provider) can trivially compromise confidential VMs, and how we mitigated the attack at @EdgelessSystems. Read his blog post: lobste.rs/domains/katexo…
English
I‘m at @1ns0mn1h4ck today and tomorrow. Feel free to drop me a DM if anyone wants to meet :)
English
It's always like: how much do you squat? Never: how much do you curl?
"wow you have strong legs"
buddy, my bis are up here
English