SinSinology's banner

SinSinology

@SinSinology • 13,051 subscribers

Pwn2Own 20{22,23,24*2,25*3,26*2}, i look for 0-Days but i find N-Days & i chase oranges 🍊

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

really proud of this one, i was stuck a while on solving the filesystem persistence issue which all the previous citrix research were pointing to "process continuity" as the solution. but the memory was so much smashed during the exploitation that i just couldn't achieve continuity LLMs didn't have anything novel to offer and kept saying suggesting the same technique (i'm probably using them wrong) but when i dig deeper on why netscaler reboots, i thought about this idea (after reversing the watchdog) since its the signal handlers that are causing the reboot to happen by catching the SIGSEGV, why not instead use the shellcode to neutralize the signal handlers, it felt really cool when it worked, i did some googling after but couldn't see any blog/writeup talking about it. if anyone has used *sigaction* syscall for this purpose in their shellcode before, let me know so i can read your writeup. anyway, enjoy 💛

really proud of this one, i was stuck a while on solving the filesystem persistence issue which all the previous citrix research were pointing to "process continuity" as the solution. but the memory was so much smashed during the exploitation that i just couldn't achieve continuity LLMs didn't have anything novel to offer and kept saying suggesting the same technique (i'm probably using them wrong) but when i dig deeper on why netscaler reboots, i thought about this idea (after reversing the watchdog) since its the signal handlers that are causing the reboot to happen by catching the SIGSEGV, why not instead use the shellcode to neutralize the signal handlers, it felt really cool when it worked, i did some googling after but couldn't see any blog/writeup talking about it. if anyone has used sigaction syscall for this purpose in their shellcode before, let me know so i can read your writeup. anyway, enjoy 💛

15,815 views • 1 month ago

it took me so much time to finish this exploit but I finally did it! my first guest-to-host virtualbox escape is finally ready, using a combination of 2 bugs I can target the latest version :) Eternal thank you to my dear friend Corentin cbayet for constantly encouraging me and guiding me how to approach, research and exploit hypervisors ✊⭐️

it took me so much time to finish this exploit but I finally did it! my first guest-to-host virtualbox escape is finally ready, using a combination of 2 bugs I can target the latest version :) Eternal thank you to my dear friend Corentin cbayet for constantly encouraging me and guiding me how to approach, research and exploit hypervisors ✊⭐️

79,203 views • 1 year ago

PoV: you wakeup and go run a pwn2own exploit TrendAI Zero Day Initiative

PoV: you wakeup and go run a pwn2own exploit TrendAI Zero Day Initiative

48,017 views • 11 months ago

First and foremost, Thank you God for all of this. Second, our eternal respect to the amazing teams TrendAI Zero Day Initiative and @TrendMicro for making this competition possible! Third, thank you to the film crew (blackrabbitint) working with zdi to make all of those great videos of us! Finally, we have prepared a message from all of us SummoningTeam (McCaulay, Ken Gannon (伊藤剣), Dimitri Os, hypr, and myself).

First and foremost, Thank you God for all of this. Second, our eternal respect to the amazing teams TrendAI Zero Day Initiative and @TrendMicro for making this competition possible! Third, thank you to the film crew (blackrabbitint) working with zdi to make all of those great videos of us! Finally, we have prepared a message from all of us SummoningTeam (McCaulay, Ken Gannon (伊藤剣), Dimitri Os, hypr, and myself).

32,548 views • 11 months ago

No more content to load