leonjza

Title: Local Privilege Escalation Vulnerability in Razer Synapse 4
CVE-ID: CVE-2025-27811
Reported Date: 22 February 2025
Reported By: Leon Jacobs, Orange Cyberdefense's SensePost Team

Vendor: Razer Inc.
Product: Razer Synapse 4
Affected Version: v4.0.86.2502180127 (and potentially earlier)
Affected Component: razer_elevation_service.exe
Component Version (Affected): v1.1.0.5

leonjza

chromedp vs go-rod

An experiment comparing chromedb and go-rod when taking screenshots.

https://github.com/chromedp/chromedp vs https://github.com/go-rod/rod, using https://tranco-list.eu/

For the results below, false means there was no error taking the screenshot.

chromedp

leonjza

1Password 8 .1pux Vault Extrator

Looks like 1Password 8 only allows you to export whole organsations with all the vaults you have access to. Exporting to .1pux format means you can use this script to separate vaults into their own exports.

use

./separate.sh 1password_export.1pux

leonjza

gream

I was curious about how hard it would be to implement something like pypipe[1] in go. Turns out, not that hard.

[1] https://github.com/bugen/pypipe

example

$ echo "foo bar" | go run main.go 4

leonjza

1. The door order that must be achieved to successfully allow the team to infiltrate the building is: [door_3, door_0, door_4, door_1, door_2] and must be sequential.

2. The coils for the doors have restricted access on the Modbus network and can not be written.

3. The sensors are hardwired to coils, thus driving the coil will result in the sensor signal being altered.

4. SYSTEM REST: Upon mission completion, the system will reset after approximately two minutes.

5. FLAG: the flag will be available on the holding registers starting at address 4 upon completion of the mission.

leonjza

SenseCon '23 Announcement Challenge

The image in this tweet is needed to solve this challenge: https://twitter.com/leonjza/status/1678419863436443648

leonjza

Tailscale Webhook to Telegram

These files are an example setup to have Tailscale webhooks deliver to a Telegram channel with https://github.com/adnanh/webhook fronted with Traefik, protected with an HTTP basic authentication setup.

Setup

Get a set of credentials to populate in the in the traefik.http.middlewares.basic-auth.basicauth.users label with htpasswd -Bn user. Remember to double escape the $ sign.

Then, in the Tailscale administrator console, add a new webhook endpoint that would point to something like https://user:[email protected]/hooks/tailscale after configuring your docker-compose.yml file appropriately.

leonjza

# search h1 bounty programs
#
# 2023 @leonjza
#
# you need to grab a cookie and x-csrf-token value.
# one way to do that is (without auth):
#
# 1. browse to https://hackerone.com/directory/programs
# 2. open the console
# 3. search something

leonjza

diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 78571d9..765b13f 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -1,55 +1,28 @@
 #!/bin/sh

+# Modified version of
+# https://github.com/xjasonlyu/tun2socks/blob/main/docker/entrypoint.sh
+

leonjza

#!/usr/bin/env python3
#
# original: https://gist.github.com/joswr1ght/595d49d5a7914cf7305b73512f37186a

import sys

def countips(netblock):
    v = netblock.split('/')

    # nothing?