PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Defeating NotPetya from your iLO

blog.quarkslab.com | research | #malware | #ransomware | #reverse-engineering | #whitepaper | #notpetya | #ilo
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Joint work by Synacktiv, Airbus, Medallia and Quarkslab showing how NotPetya's bootloader encryption can be decrypted using previously found iLO 4 vulnerabilities; whitepaper linked.
Published
Collected

Related coverage

research · volexity.com
GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
# GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically April 1, 2025 Killian Raimbaud and Paul Rascagneres In the course of its investigations, Volexity...
vulnerability · volexity.com
[CVE-2022-0847] DISGOMOJI Malware Used to Target Indian Government
# DISGOMOJI Malware Used to Target Indian Government June 13, 2024 Volexity Threat Research > _Note: Volexity has reported the activity described in this blog and details of the impacted systems...
incident · netspi.com
Ransomware Prevention, Detection, and Simulation
An overview of ransomware as a criminal business model, tracing its economic lifecycle from ransom payments to RaaS toolkits, with guidance on prevention, detection, and attack simulation readiness.
research · aikido.dev
Novel supplychain.local Go worm appears
On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back