LLM pentest: Leveraging agent integration for RCE
Blaze Labs
May 6, 2024
This post describes a case study of a recent LLM pentest engagement that allowed to exploit the LLM agent for remote code execution.
Labs
Technical insights
from Blaze Labs
Blaze Labs is the R&D group of Blaze Information Security.
PWN DAT DOMAIN: Becoming domain admin with a little help from Veeam Backup
Blaze Labs
March 21, 2024
This post provides a walkthrough of an escalation to domain admin taking advantage of Veeam backups.
Tales of two security issues in cryptocurrency software wallets
Blaze Labs
July 20, 2023
This post discusses security concerns and two vulnerabilities in Harmony and oByte, two browser extensions that serves as a cryptocurrency software wallet.
Hacking Play-to-Earn blockchain games: the case of Manarium
Blaze Labs
April 10, 2023
This post provides an overview of hacking play-to-earn blockchain games and common security pitfalls affecting P2E. It explains in detail how several vulnerabilities were discovered in a P2E game named Manarium.
Dependency Confusion: An exploitation overview
Blaze Labs
February 26, 2023
This post provides an overview of Dependency Confusion attacks and explains how they can be exploited in the wild, with examples using NPM packages and tips to prevent these vulnerabilities from occurring.
Antivirus Evasion: Tearing AMSI Down With 3 Bytes Only
Blaze Labs
January 10, 2023
This post aims to showcase one of the many possible techniques for bypassing antivirus solutions through in-memory patching of AMSI instructions.
Attack of the clones 2: Git CLI remote code execution strikes back
Blaze Labs
January 15, 2021
Introduction This post is the second part of the story of a vulnerability that could be leveraged as a supply chain attack and used to
Attack of the clones: Git clients remote code execution
Blaze Labs
November 5, 2020
Introduction This post is a rather unusual story of a vulnerability that could be leveraged as a supply chain attack and used to attack millions
Dissecting Ragnar Locker: The Case Of EDP
Blaze Labs
July 30, 2020
Introduction On April 13th 2020, news broke out in Portuguese media [1] that Energias de Portugal (EDP), the Portuguese multinational energy giant and one of
