Day[0]

We've got a pretty nice root/super-use check bypass in XNU this week, and a sort of double fetch issue in Intel's SMM leading to a potential privilege escalation into the Management system. We've also got a few meme-able Shannon Baseband issues and some tough to exploit out of bound reads in MIT Kerberos V5. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/198.html [00:00:00] Introduction [00:00:27] Spot the Vuln - The Right Context [00:02:52] Discussion: Using GPT-4 to Spot Vulnerabilities in Code (and SecGPT) [00:11:05] A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM [00:19:32] Out-of-Bounds Read in the MIT Kerberos V5 (krb5) library [00:25:35] XNU: NFSSVC root check bypass; use after free due to insufficient locking in upcall worker threads [00:32:36] XNU: NFSSVC root check bypass; use after free due to insufficient locking in upcall worker threads [00:36:35] Shannon Baseband: Intra-object overflow in NrmmMsgCodec when decoding Service Area List The DAY[0] Podcast episodes are streamed live on Twitch twice a week: -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits. We are also available on the usual podcast platforms: -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063 -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

Recovering data from a cropped image (thanks to an undocumented API change, bypassing an origin check with an emoji, and a trivial SSRF filter bypass all in this week's bug bounty podcast. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/197.html [00:00:00] Introduction [00:00:32] SSRF Cross Protocol Redirect Bypass [00:08:08] EmojiDeploy: Smile! Your Azure Web Service Got RCE’d ._. [00:20:43] Multiple vulnerabilities in Apollo Configuration Management System [CVE-2023-25569, CVE-2023-25570] [00:29:00] Exploiting aCropalypse: Recovering Truncated PNGs The DAY[0] Podcast episodes are streamed live on Twitch twice a week: -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits. We are also available on the usual podcast platforms: -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063 -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

Some simple, but interesting vulnerabilities. A use-after-free because of wrong operation ordering, an interesting type confusion, an integer underflow and some OOB access in TPM 2.0 reference code. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/196.html [00:00:00] Introduction [00:00:27] Spot the Vuln - Just be Positive [00:03:42] oss-sec: Linux kernel: CVE-2023-1118: UAF vulnerabilities in "drivers/media/rc" directory [00:07:56] oss-sec: CVE-2023-1076: Linux Kernel: Type Confusion hardcodes tuntap socket UID to root [00:11:21] GitHub - fuzzingrf/openbsd_tcpip_overflow: OpenBSD remote overflow [00:14:36] Chat Question: What Language is Most Effective for Writing These Types of Exploits [00:18:22] Vulnerabilities in the TPM 2.0 reference implementation code [00:28:19] Chat Question: Skillset for Exploit Dev as part of a Red Team [00:33:40] Espressif ESP32: Glitching The OTP Data Transfer The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

A few varied issues this week, exploiting an apparently unexploitable CRLF injection, organization secrets exposure in GitHub, and a Jenkins XSS. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/195.html [00:00:00] Introduction [00:00:25] Abusing Hop-by-Hop Header to Chain A CRLF Injection Vulnerability [00:04:26] HubSpot Full Account Takeover in Bug Bounty [00:12:22] Unauthorized access to organization secrets in GitHub [00:17:39] CorePlague: Severe Vulnerabilities in Jenkins Server Lead to RCE [00:26:37] Firefly: a smart black-box fuzzer for web applications testing [00:29:27] EJS - Server Side Prototype Pollution gadgets to RCE The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

Just one vulnerability this week about hacking the Nintendo DSi browser, but we have a good discussion about fuzzing and a new paper "autofz". Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/194.html [00:00:00] Introduction [00:00:27] Spot the Vuln - Checking your Numbers [00:03:23] autofz: Automated Fuzzer Composition at Runtime [00:14:52] Alex Plaskett - Fuzzing Insights [00:23:08] Hacking the Nintendo DSi Browser [00:29:56] Espressif ESP32: Breaking HW AES with Electromagnetic Analysis [00:32:08] Finding 10x+ Performance Improvements in C++ with CodeQL – Part 2/2 on Combining Dynamic and Static Analysis for Performance Optimisation The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

This episode covers a lot of ground, from an insecure OAuth flow (Booking.com) to a crazy JSON injection and fail-open login system (DataHub) to hacking Bluetooth smart locks (Megafeis-palm). And even a new ImageMagick trick for a local file read. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/193.html [00:00:00] Introduction [00:00:26] Traveling with OAuth - Account Takeover on Booking.com [00:13:25] Megafeis-palm: Exploiting Vulnerabilities to Open Bluetooth SmartLocks [00:22:46] GitHub Security Lab audited DataHub: Here's what they found [00:33:43] ImageMagick: The hidden vulnerability behind your online images [00:38:49] CI/CD secrets extraction, tips and tricks [00:39:30] A New Vector For “Dirty” Arbitrary File Write to RCE The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

Just a couple issues this week, a cache coherency issue because the functions used to flush changes were not implemented on AARCH64. The second was using the "world's worst fuzzer" to find some bugs. Dumb fuzzer, but it worked. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/192.html [00:00:00] Introduction [00:00:24] Spot the Vuln - Targeting [00:06:16] Vulnerability Reward Program: 2022 Year in Review  - Correction: I mistakenly thought Google's Bug Hunter University was older than it is. It was started in 2021. [00:12:56] The code that wasn't there: Reading memory on an Android device by accident [00:22:37] Using the “World’s Worst Fuzzer” To Find A Kernel Bug In The FiiO M6 The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

Parameter pollution for an auth bypass, SQL injection in an ORM, CRLF injection for a WAF bypass...this episode has a great mix of issues. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/191.html [00:00:00] Introduction [00:00:26] OpenEMR - Remote Code Execution in your Healthcare System [00:10:13] Vulnerability write-up - "Dangerous assumptions" [00:18:05] Chat Question: How do we find topics for the podcast? [00:19:22] Exploiting Parameter Pollution in Golang Web Apps [00:24:10] Using CRLF Injection to Bypass a Web App Firewall [00:34:17] Microsoft Azure Account Takeover via DOM-based XSS in Cosmos DB Explorer The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

This week we talk about more Rust pitfalls, and fuzzing cURL. Then we have a couple bugs, one involving messing with the TCP stack to reach the vulnerable condition. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/190.html [00:00:00] Introduction [00:00:27] Spot the Vuln - Insecure by Default [00:02:20] cURL audit: How a joke led to significant findings [00:09:45] Rustproofing Linux (Part 4/4 Shared Memory) [00:11:25] Rustproofing Linux (Part 4/4 Shared Memory) [00:17:22] Exploiting a remote heap overflow with a custom TCP stack [00:34:20] mast1c0re: Part 3 - Escaping the emulator The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

A variety episode this week with some bad cryptography in PHP and Azure, information disclosure in suid binaries, request smuggling in HAProxy, and some research on testing for server-side prototype pollution. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/189.html [00:00:00] Introduction [00:00:22] PHP :: Sec Bug #81744 :: Password_verify() always return true with some hash [00:11:25] Readline crime: exploiting a SUID logic bug [00:18:05] Azure B2C Crypto Misuse and Account Compromise [00:24:32] BUG/CRITICAL: http: properly reject empty http header field names · haproxy/[email protected] [00:27:23] Server-side prototype pollution: Black-box detection without the DoS [00:30:47] ThinkstScapes 2022.Q4 The DAY[0] Podcast episodes are streamed live on Twitch twice a week:  -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities  -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits. We are also available on the usual podcast platforms:  -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063  -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt  -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz  -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9