Lateral Movement on 思安录 | Thinking's Security Notes

CVE-2025-52287 WSUS Deserialization to RCE: Four-Stage Exploitation via SimpleAuth Cookie Chain

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

WSUS treats the SimpleAuth plugin’s authentication Cookie as “verified trust”, but the chain that generates the Cookie has no strict deserialization protection — attackers use a 4-stage attack (obtain session ID, get auth Cookie, use Cookie to trigger SimpleAuth, inject malicious .NET deserialization payload) to gain RCE on the patch distribution center.

Lazarus Group APT Attack on Cryptocurrency Exchanges: IOC & TTP Disclosure

Thinking — Sun, 23 Feb 2025 00:00:00 +0000

Cybersecurity is a war of endurance. This article is co-authored by me (Thinking) and 23pds.

CVE-2022-41082 Microsoft Exchange RCE: The SSRF Pre-Stage of ProxyNotShell

Thinking — Tue, 04 Oct 2022 00:00:00 +0000

The SSRF pre-stage of the ProxyNotShell attack chain — when CVE-2022-41082 exists alone, it only lets the attacker hit Exchange’s internal PowerShell Remoting, but combined with CVE-2022-41040 it becomes full-network RCE.

CVE-2020-10770 Keycloak SSRF: One OIDC Parameter Exposes Internal Servers

Thinking — Wed, 18 Nov 2020 00:00:00 +0000

A single OIDC parameter — request_uri — is enough to turn Keycloak into a proxy. With no proper validation, any URL the attacker controls becomes a request Keycloak will fire for them.

CVE-2016-3053 IBM AIX Privilege Escalation: A Missing Trust Check in libc System Calls

Thinking — Tue, 15 Nov 2016 00:00:00 +0000

A missing identity check on a libc system call in IBM AIX gives any local unprivileged account a direct path to a root shell.