d0ntrash

Did You Train on My Voice? Exploring Privacy Risks in ASR This post explores a recent research paper on membership inference attacks targeting Automatic Speech Recognition (ASR) models. It breaks down how subtle signals like input perturbation and model loss...

Think your speech model is secure?
It might be quietly leaking what it was trained on.

In a new blog post, we explain membership inference attacks and why they matter for cyber security experts.
🔗 neodyme.io/en/blog/memb...

Pwn2Own Ireland 2024: Canon imageCLASS MF656Cdw This blogpost starts a series about various exploits at Pwn2Own 2024 Ireland (Cork). This and the upcoming posts will detail our research methodology and journey in exploiting different devices. We st...

At #Pwn2Own Ireland 2024, we successfully targeted the SOHO Smashup category. 🖨️
Starting with a QNAP QHora-322 NAS, we pivoted to the Canon imageCLASS MF656Cdw - and ended up with shellcode execution.
Read the full vulnerability deep dive here 👉 neodyme.io/en/blog/pwn2...

HTML to PDF Renderer: A tale of local file access and shellcode execution In a recent engagement, we found an HTML to PDF converter API endpoint that allowed us to list local directories and files on a remote server. One of the PDF files we created, revealed that the conver...

From iframes and file reads to full RCE. 🔥

We found an HTML-to-PDF API allowing file reads and SSRF - then chained it into remote code execution via a Chromium 62 WebView exploit.

👉 Read the full write-up here: neodyme.io/en/blog/html...

Interested in learning about Windows exploitation?

This August, join us in Las Vegas for an intensive, hands-on 4-day DEFCON training:
Binary Exploitation on Windows, led by Felipe and Kolja!

🗓️ When: August 9–12, 2025
📍 Where: Las Vegas Convention Center

The Key to COMpromise - Writing to the Registry (again), Part 4 In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all r...

Wrapping up our COM hijacking series! 🎉

In the final part, we discuss a custom IPC protocol, use a registry write to gain SYSTEM privileges, and explore Denial of Service attacks on security products. 💥💻

Don't miss it! neodyme.io/en/blog/com_...

Introducing HyperHook: A harnessing framework for Nyx In this post, we introduce HyperHook, a harnessing framework for snapshot-based fuzzing for user-space applications using Nyx. HyperHook simplifies guest-to-host communication and automates repetitive...

🪝Introducing HyperHook! 🪝
A harnessing framework for snapshot-based #fuzzing using Nyx. ⚒️
HyperHook simplifies guest-to-host communication & automates repetitive tasks, making snapshot-fuzzing easier & more efficient!
🔗 Read more: neodyme.io/en/blog/hype...

The Key to COMpromise - Abusing a TOCTOU race to gain SYSTEM, Part 2 In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all r...

🔎Part 2 of our COM hijacking series is live!
This time, we discuss a vulnerability in AVG Internet Security, where we bypass an allow-list, disable self-protection, and exploit an update mechanism to escalate privileges to SYSTEM 🚀💻
neodyme.io/en/blog/com_...

On Secure Boot, TPMs, SBAT, and downgrades -- Why Microsoft hasn't fixed BitLocker yet On Secure Boot, TPMs, SBAT and Downgrades -- Why Microsoft hasn't fixed BitLocker yet

From startups to large companies, we've seen this setup used by many corporate clients in the wild. Here's why this is so difficult to fix and Microsoft has not changed the exploitable default settings yet: neodyme.io/blog/bitlock...

If you are using BitLocker and hardware attacks were not enough to convince you to enable preboot authentication, check out my colleague's posts on a software-only attack to dump the encryption key from RAM.

The Key to COMpromise - Pwning AVs and EDRs by Hijacking COM Interfaces, Part 1 In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all r...

Following our #38c3 talk about exploiting security software for privilege escalation, we're excited to kick off a new blog series! 🎊
Check out our first blog post on our journey to 💥 exploit five reputable security products to gain privileges via COM hijacking: neodyme.io/blog/com_hij...

Kids these days don't even know how much opportunity they have to learn hacking from actual pros.

I know there is a lot of content out there, so it can be hard to find the good stuff. But 10 years ago you had to be lucky to find at least something.

Anyway, watch this 👇

GitHub - 0x4d5a-ctf/38c3_com_talk: Slides for COM Hijacking AV/EDR Talk on 38c3 Slides for COM Hijacking AV/EDR Talk on 38c3. Contribute to 0x4d5a-ctf/38c3_com_talk development by creating an account on GitHub.

Slides for our talk "The Key to COMpromise" (AV/EDR privilege escalation) are on GitHub.

If you want to discuss this stuff, you can find @k0lj4.bsky.social or me at the CTF area of #38c3

github.com/0x4d5a-ctf/3...

To little surprise it seems that multiple #antivirus vendors have been ignoring COM hijacking as a self-defense bypass and LPE vector since at least 2018, when I first published about this technique (see my prev post).

At #38c3 guys from Neodyme demonstrated some more elegant
1/2

ND people are @ #38C3 in Hamburg, Germany. Be sure to check out our two talks about LPEs in AV/EDR Products (Saturday, 4 PM YELL) and a not yet mitigated Bitlocker Flaw! (Saturday, 7:15 PM HUFF)

Watch the recording of my #ekoparty talk "Advanced #Fuzzing with #LibAFL" here:

youtu.be/FI7C37lz4Rg?...

Thanks @fede-k.bsky.social for this amazing event!

Thanks for sharing! 🙏
Let me know if you have questions/feedback 🙂

Gotta RE 'em All: Reversing C++ Virtual Function Tables with Binary Ninja C++ can be frustrating to reverse engineer. Explore how to reverse engineer those with Binary Ninja.

Reversing C++ structures can be tricky. Binary Ninja makes it easier. I wrote up a walkthrough to clean up those pesky vtables. @binary.ninja

www.seandeaton.com/gotta-re-em-...

#binaryninja #reverseengineering #ghidra #ida

Honored to see my own work on the list! 😊

From Guardian to Gateway: The Hidden Risks of EDR Vulnerabilities Explore the hidden risks within security software as we dive into vulnerabilities of Wazuh, a popular EDR solution. This post reveals how even trusted tools can become targets, highlighting the import...

💥When security software itself becomes a target! 💥
Learn how we've uncovered critical vulnerabilities in Wazuh, turning a powerful security tool into an unexpected attack vector.
👉 Read more about the findings:
neodyme.io/en/blog/wazu...

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...
GitHub: github.com/decoder-it/K...

Confirmed! Team Neodyme (@Neodyme) used a stack-based buffer overflow to exploit the HP Color LaserJet Pro MFP 3301fdw printer. The earn $20,000 and 2 Master of Pwn points. #Pwn2Own #P2OIreland

Don't really know the purpose of starter packs yet, but here's some people who fuzz(ed). Let me know who I forgot

go.bsky.app/EhGFSVj

Advanced Fuzzing With LibAFL @ Ekoparty 2024 Advanced Fuzzing With LibAFL Dominik Maier Ekoparty 2024-11-15 1

Slides for my @ekoparty talk "Advanced Fuzzing
With LibAFL"
- >
docs.google.com/presentation...

From Guardian to Gateway: The Hidden Risks of EDR Vulnerabilities Explore the hidden risks within security software as we dive into vulnerabilities of Wazuh, a popular EDR solution. This post reveals how even trusted tools can become targets, highlighting the import...

Just published a blog post about some critical vulnerabilities I discovered in Wazuh last year! The post covers details on how I found these vulnerabilities and highlights why security tools like EDRs can themselves become valuable targets for attackers.
#infosec

neodyme.io/en/blog/wazu...