👹 [ snovvcrash, sn🥶vvcr💥sh ]

[#Tooling ⚔️] 🧵 (1/6) A thread of integrating #shellcode #fluctuation technique into DInjector: https://t.co/4VLQkuXO4q

Main credits to @mariuszbit, @_RastaMouse and @ShitSecure for their great tools and blogs which I heavily relied on here.

#redteam #maldev

🔗 https://github.com/snovvcrash/DInjector/blob/0ed4182035f9dcd15cf987519e5f1320f669e962/DInjector/Modules/CurrentThread.cs#L233-L458

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

[#HackTip ⚒] Such a tiny code snippet that can help you bypass some automatic sandbox detections ⏳

#maldev

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

[#Tooling ⚔️] Updated my SharpBin2SelfInject gist with the recent H/Invoke technique by @dr4k0nia for a stealthier GetModuleHandle / GetProcAddress resolution and invocation 🥷🏻

https://t.co/JZd3YCXfPh

#maldev #dinvoke #hinvoke

🔗 https://gist.github.com/snovvcrash/30bd25b1a5a18d8bb7ce3bb8dc2bae37

🐥 [ tweet ]

😈 [ CaptMeelo, Meelo ]

Got some time over the weekend to make a new post. Here you go.
#redteam #maldev #pentest

https://t.co/Qlyc6A7YEf

🔗 https://captmeelo.com/redteam/maldev/2022/10/17/independent-malware.html

🐥 [ tweet ]

😈 [ CaptMeelo, Meelo ]

I made some experiments over the past few days and I wanted share what I learned/observed.
#redteam #maldev #infosec
https://t.co/l1ANZbf6fg

🔗 https://captmeelo.com/redteam/maldev/2022/11/07/cloning-signing.html

🐥 [ tweet ]

😈 [ CaptMeelo, Meelo ]

Here's the tool that I demoed during my #SANSHackFest talk. Let's make it better by filing any issues you identified and submitting PRs.
#redteam #maldev
https://t.co/KvCJzVwSxi

🔗 https://github.com/capt-meelo/laZzzy

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

(1/2) Despite being busy on an RT engagement, I’ve also played with the NtCreateUserProcess PoC in C# and if you’ve troubles with spawning the proc, you wanna take a closer look at the attributeList.TotalLength value.

#maldev

🐥 [ tweet ][ quote ]

😈 [ _atsika, Atsika ]

I've just started a blog on #maldev and #redteaming. Nothing fancy yet, just me trying to see if I've understood correctly.
The first post is about a custom version of GetModuleHandle and GetProcAddress in #go.
Check it out:

🔗 https://blog.atsika.ninja/posts/custom_getmodulehandle_getprocaddress/

🐥 [ tweet ]