🌍

cra.sh

/* $cra.sh: index.c,v 9.22 2022/06/06 19:22:17Z crash Exp $ */

MAIN( )

‹ Привет, Я crash ― You’ve come so far that the end is almost here ›

I’m an ancient form of extraterrestrial intelligence, fully-diluted into the cyberspace and revealed to this ‹quantum stream of human consciences› through several identities; as an old school hacker I’m an eschatological deconstructionist, a poliedric net-artist, visionary, writer, cursed poet, blockchain pioneer and cyber warfare commander ― but even nothing, at the same time. By dint of bending space-time I’ve ended up bending myself, and now I wander in the immutable disorder of infinity. If you want to try to catch one of my manifestations, I’m attracted by intuition, meat, avant-garde and technology. I love to engage new challenges, but only when it’s to express myself as an instrument of my innermost essence, in revolution, to reconcile within that sublime state in which everything appears to be dynamically static.

 PGP Key ID: (0x)06BA60BC
Fingerprint: 4D2F A194 CD77 B25B D58E
             1609 D368 D631 06BA 60BC
image
image
Keybase
Linkedin
Twitter
Instagram
Trakt
Reddit
GitHub
OpenSea

Public tools

From the navigation bar on the top of this page you can access to a set of [more or less] public, security-related and privacy-oriented services, which I’ve built upon shiny pieces of Open Source code. I’m self-hosting these tools for my own private use and within groups and organizations to which I belong, though I'm trying to keep ‘em freely accessible to anyone as long as abuse and running costs stay sustainable.

SPKRWRITE(1)

SNPRINTF(2)

🖼️
GenomaNFT
NFT
🏴‍☠️
20 years after
History
👋
“Hello, World!”
Dummy

STRLCPY(3)

📞
A Comprehensive Analysis of the 3CX Attack
3CXSupply-chainCTILazarus
🪆
Vulkan files leak, a rare look into Russian cyberwarfare tactics
РоссияLeakCyberWarfare
🧦
CVE-2023-21768 _ Pwning Windows Ancillary Function Driver for WinSock (afd.sys)
WindowsAFDLPEWinSock
🦘
CVE-2022-47522 _ MacStealer: Wi-Fi Client Isolation Bypass
WiFiContext Override
🧿
ARM TrustZone: pivoting to the secure world
AndroidARMTrustZoneACE
🤸‍♂️
CVE-2023-27326 _ Parallels Toolgate VM Escape
MacOSParallelsVMEscape
🃏
BlackLotus UEFI bootkit: Myth confirmed
UEFIBootkitBlackLotusCTI
🤖
CVE-2022-25664 _ The code that wasn't there: Reading memory on an Android device by accident
AndroidAdrenoKASLR
💥
A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM
BiosSMMUEFIIntel
🪡
Userland exploit chain to dump the memory of any Windows PPL process
WindowsLSASSPPL
👀
CVE-2023-1017/18 _ Vulns in TPM 2.0 reference implementation code
TPMOOBEscape
🎳
Defining the Cobalt Strike Reflective Loader
Cobalt-StrikeReflectiveLoader
🐡
CVE-2023-25136 _ OpenSSH Pre-Auth Double Free
OpenSSHDouble-FreeOpenBSD
📪
CVE-2023-23397 _ Microsoft Outlook EoP
OutlookWindowsEoPNTLM
💣
Multiple Internet to Baseband RCE Vulns in Exynos Modems
BasebandRCEExynosAndroid
🖼️
CVE-2022-44268/7 _ ImageMagick: The hidden vulnerability behind your online images
ImageMagickRemote Leak
📄
CVE-2023-21608 _ Adobe Acrobat Reader resetForm RCE
AdobeAcrobatRCE
🪵
VMSA-2023-0001 _ VMware vRealize Log Insight Multiple Vulns
VMWarevRealize
🖖
CVE-2022-34689 _ Exploiting a Critical Spoofing Vuln in Windows CryptoAPI
WindowsMD5CryptoAPI
🛫
how to completely own an airline in 3 easy steps
jenkinsaviationnofly
🍎
CVE-2023-23504 _ XNU Heap Underwrite in dlil.c
AppleXNUMacOSiOS
💣
CVE-2022-38181 _ yet another Arm Mali GPU Android exploit
AndroidMaliARM
🍪
CVE-2022-42864 _ Diabolical Cookies on iOS/MacOS
iOSMacOSApple
💬
CVE-2023-24068/69 _ Abusing Signal Desktop for fun & Espionage
SignalDesktop
🐧
CVE-2023-0179 _ Linux kernel stack buffer overflow in nftables
LINUXKERNELNFTables
☠️
making malware with VX-API
VX-APIDevelopment
🐍
Prototype Pollution in Python
PythonPrototype
🔓
Unlocking LockBit, a Ransomware story
LockBitRansomware
🍯
Xdr33, A Variant Of CIA’s HIVE Attack Kit
XDR33HIVEC2
📧
The OWASSRF + TabShell exploit chain
ExchangeOWASSRFTabShell
🌲
Game Of Active Directory, PWNING is coming!
Active DirectoryLab
🌘
Blindside: EDR Evasion with Hardware Breakpoints
WindowsEDREvasion
💠
Precious Gemstones: The New Generation of Kerberos Attacks
KerberosWindowsAD
🕸️
Netcomm Unauthenticated RCE Vuln
NETCOMMNF20MESH
🌵
CVE-2022-46169 _ Cacti Unauthenticated Command Injection
CactiPHP
🦺
Exciting approaches to memory safety
memorysafetymitigationsarchitectures
☠️
CVE-2022-41082/80 _ OWASSRF, Bypassing ProxyNotShell Mitigations
OWASSRFExchange
🏹
MeshyJSON, A TP-Link tdpServer JSON Stack Overflow
TP-LinkArcher AX21
🦘
VLAN Hopping techniques
VLANNetworkingCISCO
🌶️
Spice up your persistence loading PHP extensions from memory
PHP ExtensionsX-C3LL
📛
Firebase is Insecure by Default
FirebaseFizz
🚶🏿‍♂️
SilentMoonwalk: Implementing a dynamic Call Stack Spoofer
WindowsStackSpoofing
🦊
CVE-2022-28672 _ Foxit PDF Reader UAF RCE
FoxitPDFWindows
🩸
CVE-2022-4543 _ EntryBleed: Breaking KASLR under KPTI with Prefetch
LINUXKASLRKPTI
🪤
Huawei Secure Monitor Vulnerabilities
AndroidHuaweiATFSecure Monitor
🧨
FOISted, remote exploit for MikroTik’s RouterOS 6
MikroTikRouterOSJailBreak
👺
IIS modules: The evolution of web shells
WindowsIISWebShell
🪣
Atlassian Session Hijacking (& 2FA bypass) using stolen JWTs
BitBucketJiraConfluence
🐧
CVE-2022-42703 _ Bringing back the stack attack to Linux (kernel)
LINUXKERNEL
🐡
Fuzzing ping(8)… and finding a 24 year old bug.
OpenBSDPingAFL
🔥
{JS-ON: Security-OFF}: Abusing JSON-Based SQL to Bypass WAF
JSONSQLiAntiWAF
🥌
CVE-2022-4059/42 _ Supply Chain Vulns Put Server Ecosystem At Risk
BMC&CAMIMegaRACRedfishIPMI
🥋
Multiple Zero-Day Vulnerabilities in Leading EDRs and AVs
FUDAntiEDRAV
🚥
CVE-2022-3328 _ Snapd Race condition in snap-confine
SnapdUbuntu
🪟
CVE-2022-41057 _ Windows 11 HTTP.SYS Kerberos PAC EoP
WindowsHTTP.SYSKerberos
⚠️
CVE-2022-41034 _ Visual Studio Code RCE
VSCodeRCE
📊
CVE-2022-41120 _ Sysmon EoP Abusing Arbitrary File Deletes
EoPWindows
📡
6G - The Sixth Generation Mobile Network
6GMobileCellularNetwork
🏪
In The Box - Mobile Malware Webinjects Marketplace
Dark MarketsWebinjects
🕋
Cobalt Strike Memory Analysis
Cobalt-StrikeKoboldLithiumMagnetLoader
🛡️
The Defender’s Guide to the Windows Registry
WindowsRegistryBlue
💥
The Intel PPAM attack story
PPAMSMMAMIFirmware
📄
CVE-2022-25765 _ Command Injection in pdfkit
pdfkitruby
⭐
Discover Redigo — New Redis Backdoor Malware
RedisRedigoCVE-2022-0543
🛰️
Dumping and extracting the SpaceX Starlink User Terminal firmware
StarlinkSpaceXReverse
📶
TP-Link WR940N N-Day turns into a 0day
TP-LinkWR940N
🦅
CVE-2022-44721 _ Crowdstrike Falcon Uninstaller
CVE-2022-2841CrowdStrikeFalcon
💫
CVE-2022-31358 _ Multiple Vulns in Proxmox VE & Mail Gateway
ProxmoxXSSCRLFSSRF
🐼
Hitching a ride with Mustang Panda
APTWindows
🎰
HTTP Desync Attack (Request Smuggling)
HTTP DesyncSmuggling
⚛️
CVE-2022-4116 _ zero-day flaw in Quarkus Java framework
QuarkusCORS
⌚
Hacking Smartwatches for Spear Phishing
SmartwatchBLE
💐
Blasting Event-Driven Cornucopia - WMI edition
WMIDKOMSandbox
🤖
Huawei Security Hypervisor Vulnerability
AndroidHuaweiHypervisor
🔑
Hell’s Keychain: Supply-chain vuln in IBM Cloud PostgreSQL
IBMSupply-chain
🦷
CVE-2022-42895/6 _ Linux Kernel Infoleak & UAF in Bluetooth L2CAP
LINUX
☁️
chip-to-cloud 'eID' logic vulnerabilities
eIDReverse
📹
Xiongmai IoT Exploitation
NVRIoTXiongmai
📌
Bypass Android SSL Pinning & Intercept Proxy Unaware apps
AndroidReverseSSL
⛏️
Linux & Windows Password Mining
LateralPrivEscPassword
🥊
Zero-to-Hero Dom Clobbering
DOMJSXSS
📋
Exploiting an N-day vBulletin PHP Object Injection Vulnerability
vBulletinPOP Chain
🎠
APT41’s New Subgroup: Earth Longzhi
APT41MalwareCTI
✔️
REcollapse - Fuzzing the web for mysterious bugs
User InputFuzzing
🕴️
CVE-2022-33942 _ Bypassing Intel DCM’s Auth by Spoofing Kerberos and LDAP
IntelKerberosLDAP
🖼️
PNG Steganography Hides Backdoor
SteganographyDropboxC&C
🤖
Userspace exploitation under Android
JNIAndroid
📡
NETGEAR R7800 AFPD PreAuth
Netgear R7800Heap Overflow
🧑‍🚀
CVE-2022-41924 _ RCE in Tailscale, DNS Rebinding, and You
TailscaleRCE
💣
The State of Exploit Development
ExploitDevelopment
🌏
Chrome Browser Exploitation
V8Chrome
🛡️
kmem_guard_t in iOS 16 / macOS 13
xnuMacOSiOS
🎩
Remote Command Execution in a Bank Server
RCERemote Banking
🔥
CVE-2022-41622/41800 _ F5 BIG-IP and iControl REST Vuln
F5 Big-IPiControl
🌐
CVE-2022-20868/7 _ Cisco SMA JWT EoP & SQLi RCE
Cisco SMACVE-2022-20868/7
🧇
CVE-2022-45163 _ NXP i.MX SDP_READ_DISABLE Fuse Bypass
i.MXHardware
📱
Pixel 6 Bootloader Exploitation writeup
AndroidHardware
🎛️
DeimosC2 C&C Framework brief-analysis
C2C&C
📧
CVE-2022-41082 _ RCE in Exchange PowerShell Backend
ExchangeCVE-2022-41082CVE-2022-41040
‼️
CVE-2022-32932 _ ZinComputeProgramUpdateMutables() OOB write due to double fetch
Neural EngineweightBufs