Skip to content
View thetrueartist's full-sized avatar
😼
😼
1 follower · 3 following

Block or report thetrueartist

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
thetrueartist/README.md
Xander, vulnerability research and malware reverse engineering

Independent vulnerability and malware researcher. I mostly look at memory corruption in network-facing services and appliance firmware, and I reverse malware.

Writeups · Mastodon · thetrueartisto1@proton.me

Advisories

Advisory CVE Product Impact CVSS
ZDI-26-441 CVE-2026-2291 dnsmasq Heap overflow in CNAME parsing, pre-auth RCE 8.1
ZDI-26-482 CVE-2026-59689 Kemp LoadMaster Hard-coded crypto key in enablexroot, code exec as root 8.8
ZDI-26-481 CVE-2026-59690 Kemp LoadMaster Missing authz on access endpoint, privesc 8.8
ZDI-26-428 CVE-2026-8247 WatchGuard FireWare OS Stack overflow in admd, pre-auth RCE as root 7.5
PoC CVE-2024-25227 ABO.CMS Pre-auth SQL injection in login 9.8
Vendor fixes and acknowledgements

Writeups

Arechclient2 / HijackLoader, on the HijackLoader chain that hides its payload in a Doge image and unpacks Arechclient2 (SectopRAT) from it.

Lynx ransomware was reported as phishing-delivered, but the binary has no exfil code, operator CLI flags and zero obfuscation. It gets dropped at the end of a hands-on intrusion.

Vidar is an infostealer/loader teardown, covering its C2 infrastructure and anti-analysis.

Defender bypass is a simple technique that worked across several AV engines.

CVE-2024-25227, on how I found it and how the vendor handled it.

Code

HijackLoader-IDATloaderPayloadExtractor pulls payloads back out of HijackLoader/IDATLoader samples, handling the XOR decryption and ZIP extraction. Works on Arechclient2/SectopRAT and other payloads hidden in images. PowerShell.

MalWatch watches high-risk paths during malware analysis and incident response, scores new files on entropy, chi-squared, PE structure, size and extension, and preserves anything above a threshold with its metadata. Optional ML scoring on top of the rules. Python, cross-platform.

Audio-Switcher keeps a DAC at 384 kHz for music and only drops the sample rate for games that crash or go silent up there, then puts it back afterwards. Learns each game's limit. C#.

Pinned Loading

  1. spindle spindle Public

    Disk space analyser for Windows. One portable exe, no runtime, no third-party code. Treemap coloured by file kind, MFT-fast scans, folder sizes always visible in list view, cross-drive duplicate fi…

    C++

  2. Audio-Switcher Audio-Switcher Public

    Keep your DAC at 384 kHz for music — AudioSwitcher auto-lowers the sample rate only for games that crash or go silent at high rates, then restores it when you're done. Learns each game's limit.

    C#

  3. chess.comAssistant chess.comAssistant Public

    Automated Chess.com Assistant

    Python 1 1

  4. MalWatch MalWatch Public

    MalWatch is a cross-platform file system monitoring tool designed for malware analysis and incident response. It intelligently tracks, analyzes, and preserves suspicious file drops in real-time usi…

    Python

  5. ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227 ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227 Public