"Vulnerabilities from a grave. Forever dead or maybe alive..."
summary
Live demos show Logitech R400 keystroke injection using CrazyRadio plus an external amp and a simple Python script to send arbitrary keys (worked locally and through a wall, claimed 1 km hardware range). Web tricks include HTTP/0.9 + pipelining WAF bypass, folded headers and IBM037 charset evasion via Burp. Exploits include LD_PRELOAD CGI RCE via /proc/self/fd/0 against GoAhead (netcat reverse shell), PHP phar deserialization via uploaded JPEG + XXE, NTLM hashes cracked at 100+ GH/s with hashcat, and zip crypto attacks (≈18 GH/s brute force; known‑plaintext GPU attack reduces long passwords to hours).
AI-written summary · about
chapters (15)
- 0:00Introduction to old vulnerabilities
- 1:11Logitech clicker backdoor demo
- 5:16Strange HTTP request bypasses
- 9:03HTTP 0.9 and pipelining tricks
- 11:47IBM encoding bypassing WAFs
- 12:29Folded header HTTP server crash
- 14:01LD_PRELOAD privilege escalation
- 17:16GoAhead HTTP server exploit
- 22:24PHP phar remote code execution
- 29:43NTLM hash cracking speed
- 32:16Zip crypto and AES cracking
- 34:28Zip bomb and symlink attacks
- 38:24OS X symlink exploit demo
- 38:44Nuke SI2 remote code execution
- 41:43Conclusion and Q&A
