Evidence of potential zero day exploit targeting Minecraft Forge 1.12.2
Yoyoyopo5 Yoyoyopo5
256 subscribers
2,055 views
0

 Published On Aug 2, 2023

Live VOD recorded from Twitch on July 1, 2023
Discord @Yoyoyopo5

EVENT LIST
0:00:18 devmods gets server ip
0:24:00 malicious user first joins server
0:34:10 raided by Rusenon (accomplice)
0:52:10 malicious user gets beacon achievement through exploited items (note here: nothing abnormal shows up in log files, such as /give commands or /gamemode)
0:54:58 hacked item base discovered
0:56:57 malicious user opped by server
1:01:53 PrimalCat (accomplice) mentions that Forge is compromised in Twitch chat
1:02:51 First user's discord login info leaked (this was the first indication of RCE on client PCs)
1:06:50 devmods indicates exploit is zero-day in Twitch chat
1:08:18 Second user's info is leaked in Twitch chat (indiciation that RCE was available on all connected clients)
1:09:22 devmods gives filesystem location of a node executable that was run remotely on everyone's PC
1:09:25 PrimalCat (who I'm assuming knows how the exploit works) says he is unable to patch it yet
1:11:20 PrimalCat and devmods indicate again that the exploit is zero-day (unknown)

show more

Share/Embed