The GreyNoise Grimoire

What is a “grimoire”?

A “grimoire” is a collection of spells, incantations, and magical formulae that can be used to achieve supernatural feats. In the context of cybersecurity, a grimoire is a compilation of exploits, scripts, and hacks that can be used to perform unauthorized actions, such as stealing data or compromising systems. Similarly, in data science and AI, a grimoire refers to a collection of algorithms, tools, and techniques that can be used to manipulate, analyze, and model large datasets. This may include methods for cleaning and preprocessing data, performing statistical analysis, or training machine learning models. However, just like in cybersecurity, a grimoire in data science and AI can be misused for unethical or malicious purposes, such as developing biased models or manipulating data to achieve desired outcomes. Therefore, while a grimoire can be a valuable resource for advancing knowledge and achieving breakthroughs, it also requires ethical considerations and responsibility in its usage.

Categories

All (28)

101 (1)

CVE-2021-44529 (1)

CVE-2023-22527 (1)

asus (1)

backdoor (2)

big-ip (2)

bluetooth (1)

c2 (1)

confluence (1)

csrf-magic (1)

cve (5)

cve-2021-22986 (1)

cve-2021-23015 (1)

cve-2021-32030 (1)

cve-2022-1388 (1)

cve-2022-1471 (1)

cve-2023-41800 (2)

cve-2024-21762 (1)

cve-2024-28995 (2)

cybersecurity (7)

data-science (1)

decryption (1)

deserialization (1)

disclosure (5)

docker (1)

enumeration (1)

f5 (2)

fortinet (2)

honeypot (5)

honeypots (1)

ics (1)

israel (1)

ivanti (1)

java (1)

null (1)

omgsnek!! (1)

owncloud (2)

path-traversal (2)

pcap (1)

pcre2 (1)

php (1)

podman (1)

ptr (2)

python (1)

r (1)

rstats (1)

rust (1)

scada (1)

scapy (1)

serv-u (2)

snakeyaml (1)

solarwinds (2)

tools (1)

vulnerabilities (17)

yaml (1)

Yer a Wizard! Tagging Hard-coded Credentials Can Lead to Finding Magic (Numbers)

As GreyNoise researcher, you always have things to write detection rules for. Some of them aren’t always exciting, but they become more interesting as you dive deeper.

Null problem! Or: the dangers of an invisible byte

A quick and silly post about a weird exploit situation

CVE-2024-8956, CVE-2024-8957: How to Steal a 0-Day RCE (With a Little Help from an LLM)

Wow. Nice weapon! Can I hold it? I promise not to break anything. Honest!

Whatchu looking for (starring SolarWinds Serv-U - CVE-2024-28995)

SolarWinds Serv-U has given us a really good dataset for which files attackers are searching for - let’s see what we can learn!

BLUUID: Firewallas, Diabetics, And… Bluetooth

Where I introduce the subject of remotely identifying bluetooth devices, propose that healthcare device oversight is lacking, and exploit a firewall for no reason other than…

Command and Control (C2) Servers 101

The purpose of this article is simple: to make it slightly easier for the complete beginners to pivot around the topic.

Perma-Vuln: D-Link DIR-859, CVE-2024-0769

CVE-2024-0769 affects D-Link DIR-859 WiFi routers. All revisions, all firmware, and the product is End-of-Life (EOL) meaning it will never recieve a patch.

SolarWinds Serv-U (CVE-2024-28995) exploitation: We see you!

Where we track a SolarWinds Serv-U vulnerability with a new honeypot, including tricking a human attacker into making mistakes

What’s Going on With CVE-2024-4577 (Critical RCE in PHP)?

CVE-2024-4577 is a critical argument-injection vulnerability in PHP that affects Windows deployments and leads to a remote code execution.

Decrypting FortiOS 7.0.x

This article steps through decrypting FortiGate FortiOS 7.0.x firmware.

Panning For Gold: Sifting Through Network Logs to Write a New Tag

How do we find vulnerabilities that aren’t making the news right now? By Sifting through the sensor logs!

Where are they now? Starring: Confluence CVE-2023-22527

Let’s look at current exploitation of CVE-2023-22527 - a Confluence template-injection vulnerability

Hunting for Fortinet CVE-2024-21762: Vulnerability Research for Detection Engineering

This article steps through the process of discovering CVE-2024-21762, a non-disclosed out-of-bounds write vulnerability in Fortinet FortiOS and FortiProxy.

RattaGATTa: Scalable Bluetooth Low-Energy Survey

Phase 1: Using a pool of collectors to scan and connect to BTLE devices, shedding light on the intricacies of hardware, radio frequency challenges, and the importance of…

Code injection or backdoor: A new look at Ivanti’s CVE-2021-44529

In 2021, Ivanti patched a vulnerability that they called “code injection”. Rumors say it was a backdoor in an open source project. Let’s find out what actually happened!

The Confusing History of F5 BIG-IP RCE Vulnerabilities

Since 2020, a bunch of different vulnerabilities have come out in F5 BIG-IP - let’s create a clean record of which one’s which, and what they mean when you see them in logs!

Panic!! At the YAML

An overview of SnakeYAML deserialization vulnerabilities (CVE-2022-1471) - how it works, why it works, and what it affects

If You’re Going to Spray My Exploit… (CVE-2022-41800)

A look at who’s trying to exploit CVE-2022-41800 in the wild - and how!

Talk-A-Blog: Apache Struts2 CVE-2023-50164, File Upload Vulnerability Analysis

A new vulnerability in Apache Struts has emerged! Follow us as we take a new twist on reviewing a vulnerability writeup.

Don’t Leave Me on Read: The Efficacy of Dynamic Honeypots for Novel Exploitation Discovery

This article recounts GreyNoise’s usage of dynamic and responsive honeypot personas to catch recently developed exploits.

The Forgotten ownCloud vulnerability (CVE-2023-49105)

Another deep-dive - this time, we’ll look at CVE-2023-49105, a critical vulnerability in ownCloud’s signature-validation code permits an attacker to impersonate any user.

Details and Caveats for ownCloud information disclosure (CVE-2023-49103)

Explore our deep-dive into CVE-2023-49103, a critical vulnerability in ownCloud’s Graph API. We discuss the exploit, its impact on Docker installations, and our…

Quickly Triaging HTTP Traffic From GreyNoise’s New Hosted Sensors

Using R and Python to build a custom HTTP triage workflow for PCAPs generateed by GreyNoise’s new hosted sensor fleet.

Uncovering regionally targeted ICS/SCADA scanning and enumeration

Analyzing ICS/SCADA packets specifically targeting GreyNoise sensors in Israel.

Honeypot Location Diversity and Data Quality

GreyNoise shows how they go about provisioning honeypot sensors to achieve a view of global internet traffic.

⭕ Emulating and Exploiting Oracle WebLogic Server for PCap Analysis (CVE-2023-21839)

The purpose of this is not to explain how CVE-2023-21839 works, but rather how to identify it via web packet. This was a case where I, personally, found testing the PoC…

So Many Tags! So MANY Weaknesses!

You’d think being ‘limited’ to internet-exploitable vulnerabilities would reduce the set of weaknesses attackers take adavantage. And, you’d be wrong.

EdgeLord: Schrödinger’s 0-Day

At GreyNoise we work with network protocols. When a new vulnerability is published we are quick to jump into investigation mode and gather any and all resources we can find…