I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)
Just finished Portswigger's new Burp Suite Certification. I've always been a huge fan of the
@WebSecAcademy
and this is an excellent capstone on the labs. Thanks
@PortSwigger
for all the educational content!
#burpsuitecertified
@WebSecAcademy
Thanks for this round of labs! The last two are definitely the most challenging. For anyone stuck, I *highly* recommend this blog post from
@_atorralba
: . Although the conditions are different, it's an excellent walkthrough of the process.
I'm really excited for this video! I got a chance to collab with
@LiveOverflow
and share the process for discovering the localhost bypass for CVE-2021-45046 with code review and differential fuzzing. :)
After the log4shell vulnerability was patched with version 2.15, another CVE was assigned. Let's have a closer look at the localhost JNDI connections bypass and learn about fuzzing Java applications.
My team
@praetorianlabs
just published our work in reverse engineering the Proxylogon patches for CVE-2021-26857, CVE-2021-26855, and CVE-2021-27065. I learned a lot more about Exchange than I thought I'd ever need, but had a blast.
@albinowax
@webtonull
A few years ago I accidentally found a vuln like this while using Turbo Intruder for password guessing. Was getting inconsistent results (e.g. valid session for a user with an invalid password). Thought I'd found a bug in Turbo Intruder, but it was a race condition in my target.
@solardiz
This is an excellent point, I had only been considering the simple case where the values were e.g. 2*1+0, but it makes more sense that they'd be large ints to look less suspicious. I'll update the .patch later today.
@julianor
@vx__notduck1e
@CodeAsm_
I've tested and signature replay works as expected, allowing modification of the command (except the first 5 chars). But I agree it is unrealistic until we actually capture a real signature (which may never happen).
@therealshodan
Did you capture SSH certificates as well? The payload is embedded in the CA signing key in the cert and will always start with 16 bytes that match a specific pattern.
(see for the payload format)