Forrest Orr
@_ForrestOrr
Followers
4K
Following
261
Media
3
Statuses
179
Red Teamer, low level coding extremist and malware researcher. Windows exploit writer and bug hunter
Joined September 2017
I'm proud to release my first Google Chrome RCE derived from the most fascinating and mind bending exploit I have yet analyzed: CVE-2019-13720 Wizard Opium. This is a beautiful bug which I have crafted into an exploit bypassing ASLR, CFG and CET on Win10
6
154
574
Does anyone know what mechanisms can be used to detect suspended (non-UWP) and frozen UWP app processes, and how to programmatically wake them up in a safe and persistent way where they don't just immediately freeze again?.
3
0
2
Is the ability of a non admin user to obtain a full query handle to a System integrity process and unravel its ASLR considered a security boundary? I know a PROCESS_QUERY_INFORMATION handle on a PPL is considered a breach of a security boundary even if the owner is local admin.
1
0
8
I’m surprised to have recently learned that there does not seem to be a trivial way to receive notifications of suspended process launches in Windows via kernel proc notif callback, kernel ETW or EtwTi. Any ideas on how to do this? @zodiacon.
2
1
1
An example of a feature I considered including was a Chromium PartitionAlloc heap walker, as I had to code this tool separately to heap groom the Chrome UAF I wrote a few years ago. It seemed too niche of a feature to be worth implementing.
0
0
4
Over the years I’ve been flattered to see that my tool Moneta has picked up a following in the Infosec world and I am considering reviving the project. If you are a user of Moneta, what would you improve? Which features would you add?
5
23
88
Great patch, thanks for making the pull request.
Now it no longer works against Moneta😀
0
0
1
Very well put together research that expands on some of the memory forensics articles I wrote several years ago, it’s excellent to see improvements are still being made to malware tradecraft in this niche.
My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it to blend-in within its own logic go check it out. Hope you'll enjoy the read.
0
1
5
RT @ipSlav: My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it….
0
72
0
RT @brandon_shi: CVE-2021-38001: A Brief Introduction to V8 Inline Cache and Exploitating Type Confusion
0
57
0
RT @33y0re: Today I am releasing a blog about kernel exploitation in the age of HVCI. This post addresses calling arbitrary kernel-mode API….
0
222
0
Last summer I attended the Advanced Windows Heap Exploitation class given by @corelanc0d3r and cannot speak highly enough of his skill, dedication and enthusiasm for the topic. This is the training I recommend for learning memory corruption exploits. Truly one of a kind.
2
6
51
Excellent work, I think you’ve found (what is at present) the most optimal fusion of stealth techniques for evasion in memory. It doesn’t get any more cutting edge than this when it comes to the memory dimension of malware design these days.
Here's my post on my YouMayPasser POC I released, as promised. Thanks to both @_ForrestOrr and @hasherezade for making such great tools, you both rule. I say "easiest way" but it was anything but easy I assure you.
1
1
19
Excellent work on this. Well done!.
Today I am releasing part 2 of a 3 part series on “modern” browser exploitation targeting Windows. Part 2 addresses going from crash to achieving a read/write primitive, as well as gaining code execution while dealing with ASLR, DEP, & CFG in ChakraCore!.
0
1
2
RT @maxpl0it: Going to Blackhat USA this year? I’ll be teaching a 2-day training:.Day 1 - Browser internals (Firefox and Chrome).Day 2 - Vi….
0
14
0
RT @waldoirc: Already released way earlier but I'm sharing on Twitter too just because. Blog post + poc on detecting malware through retur….
0
80
0
Thanks for bringing this to my attention Andrew, this would be a much more elegant way of filtering CLR JIT memory in Moneta.
- @_ForrestOrr I was reading this:. In case you aren't aware, the DAC code was included in the shared code from MS:. You can also find the latest here as .NET 5+ is fully open source:.
0
0
3
My personalized Windows 10 re-creation of the HYDSEVEN exploit chain used to target Coinbase. This chain involves the use of a Firefox RCE (CVE-2019-11707) and Firefox sandbox escape (CVE-2019-11708) for shellcode execution as Medium Integrity
0
68
173
RT @waldoirc: Full moneta bypass with 0FPs! A few more tweaks and I’m hoping peseive is next! @_ForrestOrr
0
21
0