lck0

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

lck0

エンジニア向け研修

• AI Shift
  • 社内SQL研修のために作った資料を公開します - (2021/06/21)
• CARTA HOLDINGS（旧VOYAGE GROUP）
  • 技術広報が新卒研修<Open AIハッカソン>をスパイしてみた - (2023/04/11)
  • @t_wadaに学ぶテスト駆動開発【CARTA 23新卒研修】 - (2023/04/19)
  • 【新卒研修】監修者@t_wadaと読む！プログラマが知るべき97のこと読書会 - (2024/04/09)
• Classi
  • 当たり前にリリースしていく ~ 新卒研修編 - (2021/05/20)
• リモートワークのための質問力向上研修を実施しました - (2021/12/07)

lck0

#!/usr/bin/env python
# vim:fileencoding=UTF-8:ts=4:sw=4:sta:et:sts=4:ai

import sys

import os, getopt, struct
import imghdr

def get_image_type(imgname, imgdata=None):
    imgtype = imghdr.what(imgname, imgdata)

lck0

Certifried combined with KrbRelayUp

Certifried (CVE-2022-26923) gives Domain Admin from non-privileged user with the requirement adding computer accounts or owning a computer account. Kerberos Relay targeting LDAP and Shadow Credentials gives a non-privileged domain user on a domain-joined machine local admin access on (aka owning) the machine. Combination of these two: non-privileged domain user escalating to Domain Admin without the requirement adding/owning computer accounts.

The attack below uses only Windows (no Linux tools interacting with the Domain), simulating a real-world attack scenario.

Prerequisites: