tag: Exploit

ARM TrustZone: pivoting to the secure world

  1. Discovery of two vulnerabilities in secure world components
  2. Exploitation to get code execution in a trusted driver, while not having a debugger for this obscure environment
  3. Leverage of aarch32 T32 instruction set to find nice stack pivots
  4. Turning an arbitrary write into an arbitrary code execution

Remote Deserialization Bug in Microsoft's RDP Client through Smart Card Extension (CVE-2021-38666)

10 Dec, 2021 by Valentino Ricotta

This is the third installment in my three-part series of articles on fuzzing Microsoft’s RDP client, where I explain a bug I found by fuzzing the smart card extension.

Remote ASLR Leak in Microsoft's RDP Client through Printer Cache Registry (CVE-2021-38665)

10 Dec, 2021 by Valentino Ricotta

This is the second installment in my three-part series of articles on fuzzing Microsoft’s RDP client. I will explain a bug I found by fuzzing the printer sub-protocol, and how I exploited it.