PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A gentle introduction to Microsoft OMI and how to crash it

blog.quarkslab.com | research | #cloud | #fuzzing | #microsoft | #vulnerability | #azure | #omi
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A gentle introduction to Microsoft OMI, the WBEM/CIM management stack widely used under Azure, plus two vulnerabilities the Quarkslab cloud team found by fuzzing its WSMan/XML interface.
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2021-38647] OMIGOD – RCE Vulnerability in Multiple Azure Linux Deployments
# OMIGOD – RCE Vulnerability in Multiple Azure Linux Deployments Zach Hanley September 16, 2021 Attack Blogs Overview On September 14, multiple vulnerabilities were discovered by researchers at...
blog · specterops.io
Head in the Clouds: Microsoft Azure
# Head in the Clouds: Microsoft Azure Author Christopher Maddalena Read Time 8 mins Published Sep 16, 2018 ##### Share * Introduction * Head in the Clouds – Christopher Maddalena – Medium * In the...
blog · projectzero.google
Notes on Windows Uniscribe Fuzzing
A Project Zero post on fuzzing Windows' Uniscribe font library, which yielded 29 CVEs fixed in March 2017, covering the library's history and the fuzzing approach.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back