@Rairii@haqueers.com
@Rairii@haqueers.com avatar

Rairii

@Rairii@haqueers.com

Reversing (malware and otherwise); appsec and websec; embedded security; exploit dev; software preservationist; knows how not to use cryptography.

Currently finding bugs in Windows bootloaders.

You may also know me from capcom.sys.

#nobot

This profile is from a federated server and may be incomplete. Browse more on the original instance.

stacksmashing, to random

Breaking Bitlocker: Bypassing the Windows Disk Encryption - using less than $10 of equipment

https://www.youtube.com/watch?v=wTl4vEednkQ

Rairii,
@Rairii@haqueers.com avatar

@stacksmashing you might find this interesting : https://github.com/Wack0/bitlocker-attacks

I commented on your video but I didn't link the repo as the last time I tried to link it in a youtube comment, the comment never showed up.

bontchev, to random
Rairii,
@Rairii@haqueers.com avatar

@bontchev alt-text:

Twitter post by x0rz

Things on a current Ivanti VPN box:
NSA (17 years)
China military (5 years)
Unknown TA (3 years)
xmrig (2 weeks)

Rairii, to random
@Rairii@haqueers.com avatar

so yesterday i read a .ppt from 1993 that mentioned setting up nt kernel debugging over a modem

...i wonder how many people wardialling back then found nt kernel debuggers open to the world

Rairii, to random
@Rairii@haqueers.com avatar

turns out that MmInit* was failing hard because I had a bug in the ARC firmware when setting up the memory map lol

now it's getting as far as showing the version number before bugchecking

Rairii, to random
@Rairii@haqueers.com avatar

progress is progress, the entire bugcheck text shows now

(oh, and I fixed the HAL text printing lol)

Rairii, to random
@Rairii@haqueers.com avatar

"entering a url into a web browser violates an injunction"

https://torrentfreak.com/google-bans-downloader-app-tv-outfits-claim-browser-violates-injunction-230523/

Rairii, to random
@Rairii@haqueers.com avatar

so there's a ransomware group of bronies now and they have 0days?

don't tell me they're not bronies, why else would they name themselves cl0p?

Rairii, to random
@Rairii@haqueers.com avatar

the only bluesky that's any good is electric light orchestra's

Rairii, to random
@Rairii@haqueers.com avatar

we all know NT really stands for NinTendo

Rairii, to random
@Rairii@haqueers.com avatar

with known hate groups roaming free on threads

why is there anything different between federating with threads and federating with gab

Rairii, to random
@Rairii@haqueers.com avatar

minds.com

which now supports activitypub.

according to wikipedia "Minds describes itself as focused on free speech, and minimally moderates the content on its platform."

also mentions them having first-class cryptocurrency support and being a home for "far-right users" as you'd expect from a website with "minimal moderation"

some evidence of them federating:

dansup@mastodon.social observing them federating : https://mastodon.social/@dansup/110977645214228621

ariadne@treehouse.systems confirming that they do indeed speak activitypub: https://social.treehouse.systems/@ariadne/110977665213159568

Rairii, to random
@Rairii@haqueers.com avatar

edited the previous post to mention it, but might as well say in its own post:

a dump of the full NTDS CD has been located and mirrored to the Internet Archive thanks to @winload_exe : https://archive.org/details/MSDN-BackOfficeTP_DistributedServicesTP-NT4.0_MultiArch

the full CD additionally contains non-x86 components, including the only known PowerPC build of Active Directory.

It also includes IE 3.01 beta 1 for MIPS, PowerPC and Alpha AXP.

Rairii, (edited ) to random
@Rairii@haqueers.com avatar

how many rounds of revocation will be required for windows boot applications to revoke everything vuln to baton drop (or other vulns that were already fixed)?

Rairii, to random
@Rairii@haqueers.com avatar

about BGAUpsell.exe (the Microsoft Edge/Bing advertising thing that still nobody knows what drops it):

https://www.virustotal.com/gui/file/f4918583f0b669fc13cffc92ccf647f0160870c48b4dbc2b397239841be9e73c/community

this appears to be the latest sample, it was signed roughly two weeks ago (2023-08-16). if anyone wants it, here's the sample: https://pixeldrain.com/u/JBoJFn1c

if you have a virustotal account, please downvote it (someone who has links with MS according to their own profile on VT and a lot of score decided to upvote it as "false positive").

Rairii, to random
@Rairii@haqueers.com avatar

USETUP RUNS

I REPEAT: USETUP RUNS

this is STATUS_OBJECT_NAME_NOT_FOUND trying to open \Device\Video0

Rairii, to random
@Rairii@haqueers.com avatar

Hisssssssssssssssss, Viper Lives

Rairii, to random
@Rairii@haqueers.com avatar

I just realised something

ActivityPub asymmetric keypairs are stored in the db for mastodon

When did kolektiva run tootctl accounts rotate --all last?

For how long was a nation state actor (the FBI) able to impersonate any user of kolektiva to any remote instance?

@admin

Rairii, to random
@Rairii@haqueers.com avatar

no, that's German for "the Meta, the"

Rairii, to random
@Rairii@haqueers.com avatar

HOLY FUCKING SHIT

WHISTLER BUILD 2210.MAIN (CHK) FOR AXP64

https://virtuallyfun.com/2023/05/15/windows-2000-64-bit-for-alpha-axp/

foone, to random
@foone@digipres.club avatar

GOD DAMN YOU EXPORT ADMINISTRATION REGULATIONS!

Rairii,
@Rairii@haqueers.com avatar

@foone the 90s crypto wars are over but at least one ebay seller refuses to ship MS software from the period with the non-nerfed crypto outside the US

Rairii, to random
@Rairii@haqueers.com avatar

i bought this from yahoo auctions in 2017

i still don't have a 5.25" floppy drive to dump the floppies lol

(it came with two extra disks: one labeled mscdex, another labeled "visual basic [some kana and kanji] with windows 3.0 applications", probably referring to a vb runtime dll?)

Rairii, to random
@Rairii@haqueers.com avatar

due to the admin of this server being out of contact for a few months, and the various mastodon security issues, i'm about to move servers.

see you on the akkoma side :)

Rairii, to random
@Rairii@haqueers.com avatar

if the flipper zero is so good where's the flipper one

Rairii, to random
@Rairii@haqueers.com avatar

eugen made sure nobody would ever want to hard fork mastodon when he chose to use ruby on rails

ipg, to random
@ipg@wetdry.world avatar

constantly capturing all the network traffic happening on my Windows 11 PC with a bunch of game launchers and anticheats installed is so boring. from the way you people talk it sounds like i have every single website i visit logged on 80 company datacenters but nah its just. "Hallo michaelsoft. Ur driver install worked"

Rairii,
@Rairii@haqueers.com avatar

@winload_exe @ipg @DenJohn i'm not surprised.

since th2 or so, windows is only meant to load drivers signed by MS if they were signed after a certain point. but if there's no timestamp on the cert the old certs all still work (they've all expired by now but that doesn't matter, some of them had their private keys leaked and there's various signtool hooks to patch the expiry time checks out). so for anyone using their own legit code signing cert and privkey the ONLY option for signing drivers is to go through MS.

MS signs anything you give them (as long as you have access to sign drivers, which basically just requires a shell company and an EV code signing cert, people on unknowncheats can afford this) and basically rely on their terms and conditions to say "if you sign something with vulns we will revoke, if you sign malware we will ban". their terms and conditions also specify that they can require a code audit of your drivers at any time.

MS driver signing puts the name of the entity they signed it for in the opus info, that can be seen in the advanced tab (can't remember the asn1 object id right now), they do the same for UEFI bootloaders signed by the UEFI third party certificate

it would be nice if they could have proper certificate transparency-like processes for driver signing and provide any and all drivers/uefi bootloaders for download such that anyone can analyse them. i report third party uefi bootloader vulns to MSRC because MS signed them for someone and they can easily get in contact with the responsible vendor, and get taken more seriously than just some random researcher. maybe I should do the same with vulnerable drivers and see what happens.

i also think MS should clamp down on code obfuscation in drivers. whether that's disallowing it, only allowing it when the obfuscated code is cleanly sandboxed (wasm?) with clean interfaces specified to not allow anything dangerous to be called by obfuscated code, only allowing it by signing using a different chain that would be not be trusted by default and require a BS|NV variable (and physical-presence seperate boot application) to allow (because your typical corporate system shouldn't ever be loading, for example, genshin impact's anti-cheat driver, right?)...

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • anitta
  • thenastyranch
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • ngwrru68w68
  • megavids
  • magazineikmin
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • provamag3
  • tester
  • Leos
  • JUstTest
  • All magazines
    •