Arbitrary code execution

I made a video about this recently, but I gave the example of like in 2024...

there was a Windows 11 vulnerability that because of an IPv6 fragmentation issue, you could get RCE in the Windows kernel, okay, remotely, like on off, like really, really bad.

Now, some people in the industry may call it a backdoor.

Well, for that to truly be a backdoor by the definition of a backdoor, There would have to be intent by Microsoft to leave that vulnerability there to enable some third-party actor, intelligence agency, whatever, to use that vulnerability to get into Windows, okay? And while that may be the case in some scenarios, I think generally it is truly just a issue that Microsoft had where they left bad code in, shit happens, right? Their fuzzers missed it, whatever.

The worm works across both Android and iOS and doesn't require users to answer the incoming call.

It's powered by an RCE exploit that Tencent has now patched.

And that is all for this podcast edition.

Today's show was brought to you by Authentic.

And so we would like to do something to, you know, just the Android and all of, you know, the defenders would like to do something to make it a little bit more difficult for attackers.

Even if they were to get in this context, it's not like now they own the phone just because they got this, they got an RCE in a media codec.

And so there's actually a sandbox and it's intended to be a sandbox on Android called media codec sandbox.

And this is the context that we end up popping into.

So we did two separate phones.

We did the Pixel 9 and the Pixel 10, and it's two CVEs on each phone to do the full chain.

And for the RCE, it's the same CVE and the Pixel 9, but on the LPE, it's two different CVEs.

So you mentioned off-camera, it's like two and a

Yeah.

So in this case, it allows for unauthenticated remote code execution or RCE directly on the nCentral server.

No username, no password, no prior access required.

Which perfectly explains the 10.0 severity.

Overall, the community viewed the feat as a major milestone, while emphasizing ongoing challenges and ensuring trustworthiness of such AI-produced proofs.

Title, actively exploited sandbox RCE in all Chromium versions.

Source, nvd.nist.gov.

The news story reports on a vulnerability in Chromium-based browsers that allows remote code execution inside the sandbox.

Exploitation requires a published Elementor pro form widget with a File Upload field.

Attackers can bypass validation to upload malicious PHP files which are then accessible for Remote Command Execution.

Administrators should immediately upgrade and inspect the plugins Form Upload directory for PHP files which WordFence says are a strong indicator of compromise.

Representatives Thomas Massie and Eric Burlison have introduced the Flock Off Act which would prohibit federal funding for automated license plate readers and biometric surveillance cameras The bill wouldn't ban Flock Safety cameras outright, but federal agencies would have to remove federally funded systems while state and local recipients would have one hundred eighty days to stop operating them.

But when I was hacking on that, one of the main things that I found that kind of blew my mind was a certificate auth problem.

And it just gave you RCE.

And it's like, okay, literally I give you an invalid certificate and you let me in the front door and that's it.

It's game over.

is a good tool to maybe give your AI to just start eating up some of those cookies.

But generally, trying to apply, looking at your corpus of reports and saying, where have I found Auth Bypass in the past? Where have I found ways to get arbitrary account takeover? And then using that to just go ham.

Because I think that is a lot easier to get, in my opinion, than RCE.

Like, I think everybody has auth.

Actually, I'm not even sure if a CVE number got assigned to it by MITRE or otherwise.

But basically, it was a two-click RCE in Omaki, specifically because of the setup of how its Chrome is configured.

So again, the issue with a lot of these distros like this, where you have custom Foo installed, is there's kind of this opacity, this lack of transparency to what exactly is inside of it, what is running by default.

And as you kind of build these systems out, if you don't have clear agreements on what does what, you can have maybe conflicting security boundaries.

And so this vulnerability in particular is actually what got the Omaki security team created.

It was a vulnerability in the Omaki Chromium extension that basically if you were tricked into doing a keystroke and then clicked on a notification, so it's a two-click RCE, they would get RCE on your computer, right? The underlying vulnerability is pretty interesting.

It actually has to do with, like, the Omarkey Chromium extension by default comes with a program called YouTube DLP for downloading and, like, basically ripping videos off YouTube, very common piece of software, like nothing wrong with that being on the computer.

But the issue is within YouTube DLP, You know, when you download the piece of software, or you download the video rather, it may open the video in a video editor or a video player.