The amount of free training courses available these days for #cybersecurity is wild. People ask me if its worth paying for a specific course? First, have you seen all the free material out there?
Lets dig into a selection! 👇
1/ Modern Binary Exploitation by @RPISEC. This was a university course developed and run solely by students to teach skills in vulnerability research, reverse engineering, and binary exploitation.
2/ OpenSecurityTraining by @XenoKovah Not strictly binary exploitation but all the fundementals needed for this. Architecture, debugging, reverse engineering, vulns and exploitation courses.
3/ by @Zardus and @TheConnorNelson is an education platform for students (and other interested parties) to learn about, and practice, core cybersecurity concepts in a hands-on fashion.
6/ This workshop introduces fuzzing and how to make the most of using American Fuzzy Lop, a popular and powerful fuzzer, through a series of challenges where you rediscover real vulnerabilities in popular open source projects.
Learn how to analyze malware, including computer viruses, trojans, and rootkits, using disassemblers, debuggers, static and dynamic analysis, using IDA Pro, OllyDbg and other tools:
Continuing on from my previous thread on remote exploits (macOS/Linux) here is the eagerly antipated Windows version!
A small selection from multiple areas!
#cybersecurity #windows
TCP/IP
1/ ICMPv6 Router Advertisement packets by @0vercl0k
A remote kernel DoS vulnerability when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. Patch diffing, reverse engineering tcpip.sys and creating a POC.doar-e.github.io/blog/2021/04/1…
2/ Sending a IPv6 fragmented datagram via IPsec ESP packets leads to a OOB write by @chompie1337
Another critical issue in tcpip.sys, patch diffing + investigation of the bug. A DoS poc and possible exploit primitives which could be used for RCE.securityintelligence.com/x-force/dissec…
The Era 100 is Sonos’s flagship device, released on March 28th 2023 and is a notable step up from the Sonos One. @NCCGroupInfosec found multiple weaknesses within the bootloader which could lead to full compromise
2/ According to Sonos, the issues reported were patched in an update released on the 15th of November with no CVE issued or public details of the security weakness. Users of Sonos devices should ensure to apply any recent updates to remediate the risk.
3/ In this article we document the process of analysing the hardware, discovering several issues and developing a persistent secure boot bypass for
the Sonos Era 100.
Everyone knows that a firewall is meant to provide network security. However, what happens if that appliance has vulnerabilities on your external perimeter?
Here’s 5 firewall and VPN exploit research from the past:
Want to know how to find bugs through fuzzing others miss? 10 insights from practical experience 👇
1/ Identify fresh attack surface - if there’s a public tool out there it’s likely either been published when it stops finding bugs or the vendor themselves are running at a scale you can’t match and your issues will likely become dupes.
2/ Develop custom tooling or extend reliable public fuzzers - Most the interesting bugs I have found have been from private tooling or massively extended public tools. Certain types of bugs (e.g. race condition issues) can be difficult to trigger with non specialist fuzzers.
At the end of last year I decide to take a look into consumer router security (Netgear, TP-Link, Synology) and dam was there a lot of great previous research! Here are some articles which practically demonstrate RCE from a LAN or WAN perspective:
Netgear Routers
1/ Puckungfu: A NETGEAR WAN Command Injection @_mccaulay
The pucfu binary executes during boot and will attempt to connect to a domain and retrieve a JSON response. This is hijacked with a specially crafted JSON response to perform command injection.