"1" — @zerologon Telegram-kanali

1

7 Sep, 20:01

I'm lazy ass.

No, I'm serious. Why did my lazy ass even create this channel if I'm not posting anything?
Two writeups in 9 months. Am I pregnant or what?
It's time to get back to work.

Good news: I plan to publish couple writeups in the coming days. Shocking, I know.
Two of them are about mobile game hacking.
One is a bootkit that doens't exist yet, because some retard hasn't even started coding it. Guess who.

18 0 1

1

20 Aug, 22:01

84 0 4

1

13 Jun, 00:14

Writeup is out. Covers the full path from fuzzer crash to exploitation.
Fuzzing GoldSrc: Weaponizing Network Packets for RCE in Counter-Strike 1.6

Fuzzing GoldSrc: Weaponizing Network Packets for RCE in Counter-Strike 1.6

How I used the WTF fuzzing framework to find bugs in the GoldSrc engine and exploit a stack buffer overflow for RCE in Counter-Strike 1.6.

226 1 5

1

7 Jun, 23:33

00:26

Video oldindan ko‘rish uchun mavjud emas

Telegram'da ko‘rish

On days during WTF fuzzer testing, I discovered a stack-based 4 byte buffer overflow in Counter-Strike 1.6.

The vulnerability resides in CL_ParseServerMessage, within one of the client-side message parsing functions.
This results in Server -> Client RCE.

All versions are affected, including pirated ones.
Other games on the same engine are likely vulnerable as well.

The GoldSrc engine makes it an attractive target. It ships without ASLR, CFG and other mitigations, which makes exploitation relatively easy.
Attached is a short PoC video, DEP is disabled on the victim system because I'm lazy ass to build a ROP chain.

I decided to not report it to the Valve, so expect writeup soon.

175 0 1

1

15 May, 02:40

Code by Charles Petzold

Decent book for noobs like me.
Don't let name fool you, it’s not about coding.
It explains how computers were invented and how they work internally.

I like that it starts with something completely unrelated to computers and uses it to explain the complex architecture behind them.

This book inspired the way I structured my latest Spectre & Meltdown writeup, and it will probably shape my future writeups too.

Explaining difficult ideas through things people already understand.
I guess that’s the secret to explaining anything complex.

172 0 2

1

9 May, 22:41

Back after almost a year. New writeup. Spectre & Meltdown.
Performance over security: Speculative execution vulnerabilities

Performance over security: Speculative execution vulnerabilities (Spectre & Meltdown)

A deep dive into Spectre and Meltdown, two hardware-level vulnerabilities that traded security for performance.

157 0 0

1

9 May, 00:04

00:09

Video oldindan ko‘rish uchun mavjud emas

Telegram'da ko‘rish

Telegram: t.me/sinkholing
Github: github.com/3a1
Write-ups: z3bra.cat

152 0 1

Telegram Analytics

TGStat Bot

TGAlertsBot

SearcheeBot

1

Kanal geosi va tili

Toifa

1

1

1

1

1

1

1

24

Kanalda mashhur

Sayt tili