I build things ... and break others.
Photo by Vinoth Ragunathan on unsplash Recently, bl4sty created vibe coded sl0p.foo , a streaming platform where you can live stream your agents working in tmux sessions for fun. I liked the idea, and it finally got me to experiment with AI-assisted vulnerability research and exploit development. Most of the publications I’ve seen so far have focused on browsers and operating systems. These are…
Long time no see ! Last time I published was four years ago. Since then I joined ONEKEY and most of my stuff is published on our research blog over there. I also started teaching vulnerability research and exploitation to college students here in Belgium, which is what got me to write this blog. Since I started teaching that VR/XDEV course I stayed on the same target: Cisco RV routers. I know them…
In the previous article we covered the different authentication mechanisms implemented by Dell EMC Networker, pointed out the flaws in each of them (identification in oldauth, trust-on-first-use for nsrauth), and provided clear recommendations to Dell EMC Networker administrators that are close to what is said in the EMC NetWorker Security Configuration Guide . Today we release multiple…
This report outlines vulnerabilities found in Askey TCG300 cable modems provided by Orange Belgium to its subscribers. The modems are vulnerable to authenticated and unauthenticated remote code execution through the web administration server. These vulnerabilities arise from memory corruptions due to insecure function calls when handling HTTP requests. These vulnerabilities can be exploited by…
In a previous life I came upon Dell EMC Networker in different environments and found different ways to exploit the nsrexecd daemon in similar ways than CVE-2017-8023 , without ever being 100% sure that it indeed was that specific CVE. The CVE description clearly mentions “unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when oldauth…
This report outlines the VOOdoo vulnerabilities found in NETGEAR CG3100 and CG3700B cable modems provided by VOO to its subscribers. These modems use a weak algorithm to generate default WPA2 pre-shared keys, allowing an attacker in reception range of a vulnerable modem to derive the WPA2 pre-shared key from the access point MAC address. The modems are also vulnerable to remote code execution…
Starting around mid-december 2020, I started receiving a lot of sponsored content from Huawei about the decision that Belgium authorities took to block Huawei 5G gear from being deployed. The campaign was quite aggressive, so I took screenshots with the idea of coming back to it in the future. In the meantime, excellent investigative work have been produced by people on the subject, one Twitter…
In early 2019, I had to assess the latest version (at the time) of Pulse Secure Connect Client, an IPSEC/SSL VPN client developed by Juniper. Given that the client allow end users to save their credentials, one of my tests included verifying how an attacker could recover them. The attacker perspective was simple: access to an employee’s laptop (either physical access or remote access with low…
This is the second part of a two part blog series on patch diffing Cisco RV firmware where I try to identify fixed flaws (namely CVE-2020-3323, CVE-2020-3330, and CVE-2020-3332). In the first part we identified the static credentials present in Cisco RV110 firmware up to version 1.2.2.5 included. In this post, we will perform more serious patch diffing to identify memory corruption and command…
I received an email last week from someone looking into vulnerabilities affecting Cisco RV110W. They were wondering if I had any information about CVE-2020-3323 , CVE-2020-3330 , or CVE-2020-3331 that were released at the same time than the ones I had found . CVE-2020-3323 and CVE-2020-3331 are described as unauthenticated remote code execution , while CVE-2020-3330 is a system account with…