Pentester's Windows NTFS tricks collection

In 2018 I found a Microsoft Windows Elevation of Privileges vulnerability (CVE-2018-1036). Later I published a blog post on it and described some other NTFS tricks.

You can find the blogpost here: Pentester's Windows NTFS tricks collection

Finding security vulnerabilities with modern fuzzing techniques

I presented a talk on the topic of fuzzing at RuhrSec 2018. It describes the basics of fuzzing with AFL and WinAFL.

You can find the Video here: Video

At minute 42:16 you can see a short demo of a fuzzer which I developed at SEC Consult. Since I quit my job at SEC Consult the fuzzer was unfortunately never released to the public.

Cyber Security Challenge Austria CTF Tips & Tricks

The Cyber Security Challenge Austria is a competition where students and interested people can solve challenges to compete with each other. It's a great possibility to learn something new and meet people with similar interests. In 2018 I wrote a short CTF (Capture-the-Flag) guide how to get started for beginners.

You can find it here: Cyber Security Challenge Austria CTF Tips & Tricks

The Art of Fuzzing Workshop & Demos

In 2017 and 2018 I presented workshops on the topic of Fuzzing.

You can find the slides here: Slides

I also recorded some demos before the workshop (this are not the demos from the workshop itself). You can find the demos here: Demos

Please note: The workshop also contains lots of demos which are available on the virtual machine. If you are interested in the virtual machine just drop me a message on twitter.

Hack the Hacker - Fuzzing Mimikatz on Windows with WinAFL & HeatMaps

Since I presented various fuzzing workshops in 2017 I wanted to find a nice example to demonstrate fuzzing with WinAFL if source code is available. So I needed a target where I have access to source code, which would be interesting to study for students and which still have simple bugs to find. That's how I came up with the idea to fuzz mimiaktz.

You can find the the original blogpost here: Link

Bypass application whitelisting with Nvidia's node.js

On my gaming PC I noticed something interesting - Nvidia installed a NodeJS server on my system. Since I did some application whitelisting research some time ago I used it to bypass application whitelisting. Please note: From a technical perspective I could not find a more critical vulnerability in it. However, from end-user perspective I think nobody wants to have a local NodeJS server running just because Nvidia programmers wanted to code in JavaScript. When I reported this to Nvidia they immediatly fixed it.

You can find the the original blogpost here: Link

Controlling Kerio Control - When your firewall turns against you

Kerio Control is a firewall solution for small businesses. In 2016 an ex-college (Raschin Tavakoli) told me he found some interesting behavior in it and we started to dig deeper into it on the weekend. We found all kind of vulnerabilities and ultimately a really cool exploit chain. It allows to get full code execution on the firewall over the internet via a memory corruption and a CSRF bypass if one of the end-users visits a malicious website.

You can find the the original blogpost here: Link