議程
09:00
報到時間
10:00
Opening 開幕
10:10
English
Red
Exploit Development
Fuzzing
Advancements in JavaScript Engine Fuzzing
Carl Smith
11:00
Break
11:20
Mandarin
🍊
Red
Exploit Development
A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learned
Orange Tsai
English
Red
Communication
How to hijack a VoLTE network
Pavel Novikov
Mandarin
Blue
Crypto
打造公平的遊戲轉蛋:在不洩漏原始碼的前提下驗證虛擬轉蛋的機率
Jing Jie Wang、李安傑
12:00
Lunch
13:00
English
Red
Exploit Development
Ghosts of the Past: Classic PHP RCE Bugs in Trend Micro Enterprise Offerings.
Poh Jia Hao
Mandarin
Red
Communication
Reverse Engineering
從硬體攻擊手段來解開機殼下的美麗祕密:網路通訊設備安全分析
Ta-Lun Yen
Mandarin
Red
Exploit Development
BYOVD
直搗核心:探索 AMD 驅動程式中的資安漏洞
Zeze
13:40
Break
14:00
Mandarin
Red
Exploit Development
Endpoint Security or End of Security? Exploiting Trend Micro Apex One
Lays、Lynn
English
Red
Electron
ELECTRONizing macOS privacy - a new weapon in your red teaming armory
Wojciech Reguła
Mandarin
Red
Exploit Development
Fuzzing
搭配模糊測試對Linux核心遠端檔案系統進行漏洞挖掘
Pumpkin
麋鹿在芝麻街 - ELK x BERT 資安分析實戰
Sheng-Shan Chen、Yuki Hung
14:40
Tea Time
15:10
Mandarin
Red
BYOVD
LPE
現代內核漏洞戰爭 - 越過所有核心防線的系統/晶片虛實混合戰法
馬聖豪
English
Red
Exploit Development
Electron
Virtual
What You See IS NOT What You Get: Pwning Electron-based Markdown Note-taking Apps
Li Jiantao
協會時間
Allen Own、CK
15:50
Break
16:00
Lightning Talk
freetsubasa & Hazel、沒有人
16:30
Closing
17:20
收場
English
Red
Exploit Development
Ghosts of the Past: Classic PHP RCE Bugs in Trend Micro Enterprise Offerings.
R0
地點
13:00 ~ 13:40
8月19日 週六
一般議程
類型

In this presentation, I will talk about my experience after researching on various enterprise offerings by Trend Micro. I will also share details about the (approximately 10) different vulnerabilities that I found and how they can be combined into different exploit chains to achieve Remote Code Execution (RCE) on these applications, namely: "Trend Micro Apex Central" and "Trend Micro Mobile Security (Enterprise)", which are used internally by big companies. The root-cause and indicators of compromise of these vulnerabilities will then be examined, as well as the official patches by Trend Micro. Some highlights of the talk include: perfect golfing to achieve RCE, classic 3-bug chain pre-authentication RCE (with CVSS 3.1 score of 9.8), as well as combining limited primitives to achieve RCE. Finally, I will also share about how to look out for such vulnerabilities in other similar programs.

Poh Jia Hao

Poh Jia Hao is a Security Researcher at STAR Labs SG Pte. Ltd. for the past 2 years, whose focus is mainly on web application security. Jia Hao has multiple CVEs in various applications under his name over the past years. He is always interested in staying up to date about the latest hacking techniques used to challenge the assumptions. Besides performing vulnerability research, Jia Hao also has experience in penetration testing, as well as being Offensive Security-certified OSCP, OSWP and OSWE.

© 2023 HITCON, All Rights Reserved.