pentestercrab

(63 points, 4 days ago, 431 comments) https://news.ycombinator.com/item?id=47972481

There seems to have been a recent uptick in phishers using goo.gl URLs. Yes, even without new URLs being accepted by registering expired domains with an old reference.

The risky.biz podcast episode got pulled too: https://bsky.app/profile/patrick.risky.biz/post/3lmioqiobks2...

Once again GTFOBins[0] proving to be a valuable resource.

[0] https://gtfobins.github.io/

Thanks for the feedback, fixed!

From the article:

Our leading theory is that the Great Firewall inside China is manipulating DNS responses due to blacklisted or blocked keywords. This affects any system that has to pass through the Great Firewall before it reaches the end-user/client. Most of the keywords relate to VPN software, proxies, adult sites, file and text sharing and torrents. This is consistent with the kinds of material that China is known to censor within its borders.

I have to agree with you. It is a shame the classic style isn’t available at an alternate subdomain or directory.

Has anyone tried rendering the current docs with the old theme?

One idea, maybe using file instead of virtual will avoid the bug and not require your added code.

    <!--#include file="issue-0001.html" -->

Also, be careful of any moves to supporting dynamic content as Server Side Includes can (sometimes?) lead to code exec even with IncludesNoExec.

https://blockstream.com/satellite/ - The Bitcoin blockchain from space. No internet required.

Previous discussion from 2018: - https://news.ycombinator.com/item?id=18659809

The fivefold repetition rule requires no claim by the players.

Security ========

* sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this option was enabled with a set of patterns that activated logging in code that runs in the low-privilege sandboxed sshd process, the log messages were constructed in such a way that printf(3) format strings could effectively be specified the low-privilege code.

   An attacker who had sucessfully exploited the low-privilege
   process could use this to escape OpenSSH's sandboxing and attack
   the high-privilege process. Exploitation of this weakness is
   highly unlikely in practice as the LogVerbose option is not
   enabled by default and is typically only used for debugging. No
   vulnerabilities in the low-privilege process are currently known
   to exist.

   Thanks to Ilja Van Sprundel for reporting this bug.

The second sentence of the blog post states:

   We were also unable to control the contents of a file on disk, and bruteforcing process identifiers (PIDs) and file descriptors found no interesting results, eliminating remote LD_PRELOAD exploitation.

Sounds very interesting, thanks for sharing. Do you have any more information or perhaps a URL to a write-up for this? Or do you remember the challenge name?

It does not require opening a browser, it can cause a browser to open.

Yes, that works fine. The hard part is finding a suitable .so already on the system. The following (credit to Tavis Ormandy) creates /tmp/testing

  $ RUBYOPT="-r/usr/lib64/libpcprofile.so" PCPROFILE_OUTPUT="/tmp/testing" ruby /dev/null

From TFA: These vulnerabilities would have allowed an attacker who claimed the S3 bucket to offer malicious firmware updates to Linux desktops and servers running legacy versions of fwupd.

Some extra discussion can be found in a Twitter thread[0] from the person who discovered the issues.

[0] https://twitter.com/justinsteven/status/1270113960021209088

Some extra details can be found in the relevant Twitter thread[0] relating to affected Linux distributions.

[0] https://twitter.com/justinsteven/status/1270113960021209088

http://geometrylearning.com/DeepFaceDrawing/ says "[Coming Soon]" for the code.

Extra context can be found in tweets by @_markel___[1].

[1] https://twitter.com/_markel___/status/1262697756805795841

On the topic of case and unicode, it's also important to remember that, somewhat surprisingly, the number of characters can change when a change in case occurs:

  $ irb
  >> puts RUBY_VERSION
  2.6.5
  >> "ß".chars.size
  => 1
  >> "ß".upcase.chars.size
  => 2

A great video on exploiting .NET deserialization was presented at Insomni'hack 2018 and can be found on YouTube[1].

[1] https://www.youtube.com/watch?v=eDfGpu3iE4Q

The same gadget chain can alsobe used to exploit YAML.load [0] with the following:

    --- !ruby/object:Gem::Requirement
    requirements:
      !ruby/object:Gem::DependencyList
      specs:
      - !ruby/object:Gem::Source::SpecificFile
        spec: &1 !ruby/object:Gem::StubSpecification
          loaded_from: "|id 1>&2"
      - !ruby/object:Gem::Source::SpecificFile
          spec:

[0] https://staaldraad.github.io/post/2019-03-02-universal-rce-r...

This brought back memories of CAP theorem[1] and Zooko's triangle[2], but this time with flavors.

[1] https://en.wikipedia.org/wiki/CAP_theorem

[2] https://en.wikipedia.org/wiki/Zooko%27s_triangle

Follow up thread here[0] that discussed how Facebook's "Advanced Matching for Web" works.

[0] https://twitter.com/thezedwards/status/1204965655482527744

More information on desynchronization attacks that can allow request smuggling can be found on the Portswigger blog[0].

[0] https://portswigger.net/research/http-desync-attacks-request...

Interesting comment from the author over on reddit[1] discussing using the research kernel to "find 0-day in software and hardware for about 2 years".

[1] https://old.reddit.com/r/programming/comments/csfj53/sushi_r...

Live tweeting of the raid can be found here: https://twitter.com/TheLyonsDen

The original advisory can be found here[0] and a Github repository with PoCs here[1].

[0] https://www.trustwave.com/en-us/resources/security-resources...

[1] https://github.com/scarvell/grandstream_exploits