Tim @timwr

@KeyZ3r0 @Iron_Uniranger @alexjplaskett Fyi I couldn't get this to work in the chrome sandbox or low integrity. NtUpdateWnfStateData always returns 0xC0000022 (STATUS_ACCESS_DENIED)

0 0 0 0 0

View Details

Tim @timwr

4 years ago

@mistymntncop Interesting thanks!

1 0 0 0 0

View Details

Tim @timwr

4 years ago

@KeyZ3r0 @KunlunLab @Iron_Uniranger

@alexjplaskett Hi Alex Plaskett! I am curious about how WNF stuffs can be used to escape the Chrome sandbox because when at Low\Untrusted Integrity,the NtUpdateWnfStateData will fail with ACCESS_DENIED. And the sd setting of Part 1 doesn't work at Low\Untrusted Integrity. Did you run into this?

1 0 0 0 0

1 0 1 0 0

View Details

Tim @timwr

4 years ago

@_ForrestOrr I thought CVE-2021-31956 might be a good Windows 10 chrome sandbox escape but I got stuck here: x.com/Iron_Uniranger…

Uniranger @Iron_Uniranger

5 years ago

1 0 0 0 0

0 0 1 0 0

View Details

Tim @timwr

4 years ago

@davegardnerisme @jameslnicholson

0 0 2 0 0

View Details

Tim @timwr

4 years ago

@DaveManouchehri @ScottyBauer1 @Fire30_ @timstrazz But how do you go from file overwrite to kernel r/w. Overwriting the vdso region like VIKIROOT?

2 0 0 0 0

View Details

Tim @timwr

4 years ago

@catc0n I put that I have 15 years of Blockchain experience on my LinkedIn profile, it's amazing how many recruiters ask me about it.

1 0 1 0 0

View Details

Tim @timwr

4 years ago

@cutesmilee__ What device(s) did you test this on @cutesmilee__ ? Nice work!

1 0 0 0 0

View Details

Tim @timwr

4 years ago

@kmkz_security Interesting thanks. I'll ping you if I get around to testing this. Confusingly it looks like Safari 14.1 was released with iOS 14.5? en.wikipedia.org/wiki/Safari_ve… Nice work btw!

1 0 2 0 0

View Details

Jack Rhysider 🏴‍☠️ @JackRhysider

5 years ago

Want to learn Metasploit? I highly recommend downloading this guide and having it handy while learning. tunnelsup.com/metasploit-che…

12 326 2K 0 590

View Details

Tim @timwr

5 years ago

@wifi_py @samirestefan @avantgame How do you pull private app data over adb via recovery? Surely it's encrypted with the pin?

1 0 0 0 0

View Details

Tim @timwr

5 years ago

@wifi_py @samirestefan @avantgame What if you need the data on it?

1 0 0 0 0

View Details

Tim @timwr

5 years ago

@wifi_py @samirestefan @avantgame Most unoffical (Android) repair shops I've been to previously will demand the PIN/Passcode before doing any repairs, in order to test the functionality. Surely there should be a way to test the microphone, front/back camera, etc in recovery? What if you actually need the data?