HN user

pentestercrab

2,247 karma
Posts219
Comments55
View on HN
unherd.com 2mo ago

When Dawkins met Claude – Could this AI be conscious?

pentestercrab
64pts434
nastystereo.com 6mo ago

Ruby Array Pack Bleed

pentestercrab
62pts1
nastystereo.com 6mo ago

Ruby Array Pack Bleed – Impacts Ruby 1.6.7 to 4.0.0

pentestercrab
9pts0
portswigger.net 10mo ago

Inline Style Exfiltration: leaking data with chained CSS conditionals

pentestercrab
1pts0
blog.trailofbits.com 11mo ago

Marshal madness: A brief history of Ruby deserialization exploits

pentestercrab
25pts4
arxiv.org 11mo ago

Breaking the Sorting Barrier for Directed Single-Source Shortest Paths

pentestercrab
99pts3
www.elttam.com 1y ago

New Method to Leverage Unsafe Reflection and Deserialisation to RCE on Rails

pentestercrab
1pts0
nastystereo.com 1y ago

Escaping Ruby's Gem:SafeMarshal Sandbox

pentestercrab
2pts1
nastystereo.com 1y ago

Escaping Ruby's Gem:SafeMarshal Sandbox

pentestercrab
3pts0
github.com 1y ago

RubyGem's Gem:SafeMarshal buffer overrun with length larger than fit into a byte

pentestercrab
1pts0
pentesterlab.com 1y ago

CORS Vulnerabilities in Go: Vulnerable Patterns and Lessons

pentestercrab
1pts0
nastystereo.com 1y ago

Shiny Vulnerabilities in R's Most Popular Web Framework

pentestercrab
1pts0
pentesterlab.com 1y ago

PentesterLab: Web Hacking and Security Code Review 600 exercises and 700 videos

pentestercrab
1pts0
nastystereo.com 1y ago

Cross-Site Post Requests Without a Content-Type Header – CSRF Attack

pentestercrab
2pts0
github.blog 1y ago

Execute commands by sending JSON? Ruby deserialization vulnerabilities

pentestercrab
2pts0
pentesterlab.com 1y ago

JWT Libraries Block Algorithm Confusion: Key Lessons for Code Review

pentestercrab
3pts0
eprint.iacr.org 1y ago

Chosen-Prefix Collisions on AES-Like Hashing

pentestercrab
2pts0
nastystereo.com 1y ago

Ruby 3.4 Universal RCE Deserialization Gadget Chain

pentestercrab
2pts1
nastystereo.com 1y ago

Ruby's String Slice is Broken

pentestercrab
3pts2
github.com 1y ago

Evaluate Markdown code blocks within Vim

pentestercrab
68pts18
nastystereo.com 1y ago

SQL Injection Polyglot Payloads

pentestercrab
1pts0
www.assetnote.io 1y ago

Insecurity Through Censorship: Vulnerabilities Caused by the Great Firewall

pentestercrab
2pts1
www.assetnote.io 1y ago

Insecurity Through Censorship: Vulnerabilities Caused by the Great Firewall

pentestercrab
4pts0
www.fuzzmap.io 2y ago

Fuzz Map – fuzzer for GUIs that automatically builds a visual map

pentestercrab
1pts0
nastystereo.com 2y ago

nastystereo.com

pentestercrab
1pts0
greg.molnar.io 2y ago

A Single File Ruby on Rails Application

pentestercrab
3pts4
gitlab-com.gitlab.io 2y ago

Devfile file write vulnerability in Gitlab – walkthrough finding CVE-2024-0402

pentestercrab
3pts0
tantosec.com 2y ago

Judge0 Sandbox Escape – allows obtaining root permissions

pentestercrab
3pts0
blog.includesecurity.com 2y ago

Discovering Deserialization Gadget Chains in Rubyland

pentestercrab
2pts0
portswigger.net 2y ago

Blind CSS Exfiltration: exfiltrate unknown web pages

pentestercrab
2pts0

From the article:

Our leading theory is that the Great Firewall inside China is manipulating DNS responses due to blacklisted or blocked keywords. This affects any system that has to pass through the Great Firewall before it reaches the end-user/client. Most of the keywords relate to VPN software, proxies, adult sites, file and text sharing and torrents. This is consistent with the kinds of material that China is known to censor within its borders.

Security ========

* sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this option was enabled with a set of patterns that activated logging in code that runs in the low-privilege sandboxed sshd process, the log messages were constructed in such a way that printf(3) format strings could effectively be specified the low-privilege code.

   An attacker who had sucessfully exploited the low-privilege
   process could use this to escape OpenSSH's sandboxing and attack
   the high-privilege process. Exploitation of this weakness is
   highly unlikely in practice as the LogVerbose option is not
   enabled by default and is typically only used for debugging. No
   vulnerabilities in the low-privilege process are currently known
   to exist.

   Thanks to Ilja Van Sprundel for reporting this bug.

The second sentence of the blog post states:

   We were also unable to control the contents of a file on disk, and bruteforcing process identifiers (PIDs) and file descriptors found no interesting results, eliminating remote LD_PRELOAD exploitation.

Sounds very interesting, thanks for sharing. Do you have any more information or perhaps a URL to a write-up for this? Or do you remember the challenge name?

Yes, that works fine. The hard part is finding a suitable .so already on the system. The following (credit to Tavis Ormandy) creates /tmp/testing

  $ RUBYOPT="-r/usr/lib64/libpcprofile.so" PCPROFILE_OUTPUT="/tmp/testing" ruby /dev/null

On the topic of case and unicode, it's also important to remember that, somewhat surprisingly, the number of characters can change when a change in case occurs:

  $ irb
  >> puts RUBY_VERSION
  2.6.5
  >> "ß".chars.size
  => 1
  >> "ß".upcase.chars.size
  => 2