phoenhex team @phoenhex

Fine writeups & exploits by @5aelo @_niklasb @edgarboda @bkth_ phoenhex.re your kernel Joined April 2017

Tweets

53
Followers

4K
Following

6
Likes

25

Bruno @bkth_

7 years ago

I wrote a thing about a Chakra RCE for which the JIT trigger is tweetable :) function opt(o) { o.pwn = o.a; } phoenhex.re/2019-07-10/ten…

0 103 242 0 16

View Details

Niklas B @_niklasb

7 years ago

I wrote a thing about my macOS sandbox escape & LPE from Pwn2Own phoenhex.re/2019-05-26/att…

4 218 506 0 40

View Details

Bruno @bkth_

7 years ago

New blog post written together with my friend @S0rryMybad about using the JIT to abuse a non-JIT bug in Chakra (CVE-2019-0812) phoenhex.re/2019-05-15/non…

1 108 241 0 12

View Details

I published the slides of the presentation I gave @BlueHatIL and @offensive_con about Attacking Edge through the JIT compiler. I also contains exploit code for CVE-2018-8266 github.com/bkth/Attacking…

1 152 314 0 25

View Details

offensivecon @offensive_con

8 years ago

Attacking Edge through the JavaScript Just-In-Time compiler by @bkth_ offensivecon.org/speakers/2019/…

0 13 46 0 2

View Details

offensivecon @offensive_con

8 years ago

IPC you outside the sandbox: One bug to rule the Chrome broker by @_niklasb offensivecon.org/speakers/2019/…

1 16 42 0 1

View Details

offensivecon @offensive_con

8 years ago

FuzzIL: Guided Fuzzing for JavaScript Engines by @5aelo offensivecon.org/speakers/2019/…

0 57 158 0 5

View Details

Samuel Groß @5aelo

8 years ago

My #pwn2own exploit chain from this year, essentially 3 logic bugs to go from Safari to kernel on macOS up to 10.13.3, is now open source: github.com/saelo/pwn2own2…. The README also links to a few slide decks which contain some more background information :)

8 445 898 0 53

View Details

SSD Secure Disclosure @SecuriTeam_SSD

8 years ago

#Hack2Win eXtreme @bevxcon - SSD Advisory – Firefox Remote Code Execution blogs.securiteam.com/index.php/arch…

0 56 85 0 3

View Details

offensivecon @offensive_con

8 years ago

Browser Exploitation by @5aelo offensivecon.org/trainings/2019…

0 24 64 0 3

View Details

Niklas B @_niklasb

8 years ago

Two RCE bugs in the Spidermonkey JIT fixed in Firefox 62.0.3. One was a pretty old bug in the IonMonkey register allocator.

4 45 142 0 5

View Details

phoenhex team @phoenhex

8 years ago

Today we have a short new blog post about CVE-2018-4358, an infoleak bug in Safari found by @bkth_ @5aelo and @_niklasb that got patched by Apple in their last updates: phoenhex.re/2018-09-26/saf…

0 67 132 0 3

View Details

TyphoonCon🌪️ @typhooncon

8 years ago

First #Hack2win eXtreme winners, @_niklasb @bkth_ @5aelo, 3 categories: Firefox RCE, Firefox InfoLeak and Chrome RCE, beautifully done, for a total prize of 170,000$USD. Still have 330,000$USD to give out to anyone that can show their skills - disclosure soon via @SecuriTeam_SSD

12 61 236 0 1

View Details

Samuel Groß @5aelo

8 years ago

Here are the slides from my #BlackHatUSA talk about just-in-time compilers for JavaScript and the @webkit bug I used as part of my Pwn2Own chain this year =) saelo.github.io/presentations/…

5 135 284 0 10

View Details

Niklas B @_niklasb

8 years ago

New blog post: Fuzzing the CS:GO map file loader with AFL in QEMU mode. Includes full fuzzing harness + triaging tools to reproduce. Will still find heap overflows, because Valve says these are not security issues :> So get yourself some 0days now! phoenhex.re/2018-08-26/csg…

12 264 524 0 14

View Details

Niklas B @_niklasb

8 years ago

Here's @bkth_'s, who clearly plays too much dota

1 1 13 0 0

View Details

Niklas B @_niklasb

8 years ago

I added a PKGBUILD to get a full debug build of the latest VirtualBox version for Arch Linux, with the 3D security fixes from July reverted: github.com/niklasb/3dpwn/…

0 6 10 0 1

View Details

Niklas B @_niklasb

8 years ago

I published a small Python Linux library for experimenting with HGCM and VBoxSharedCrOpenGL (3D accel) from a VirtualBox guest. Includes a full exploit for CVE-2018-30{55,85} demonstrating some useful heap exploitation techniques for the 3D component github.com/niklasb/3dpwn