This media is not supported in your browser
VIEW IN TELEGRAM
π [ konrad @konradgajdus ]
I made a donut using the C standard library:
π https://github.com/konrad-gajdus/donut
π₯ [ tweet ]
I made a donut using the C standard library:
π https://github.com/konrad-gajdus/donut
π₯ [ tweet ]
ΠΊΡΠ°ΡΠΈΠ²ΠΎΠ΅π15π₯±6π4π€―2π₯1
This media is not supported in your browser
VIEW IN TELEGRAM
π [ JiΕΓ Vinopal @vinopaljiri ]
Inspired by @0gtweet, I created PoC: EXE-or-DLL-or-ShellCode that can be:
Executed as a normal #exe
Loaded as #dll + export function can be invoked
Run via "rundll32.exe"
Executed as #shellcode right from the DOS (MZ) header that works as polyglot stub
π https://github.com/Dump-GUY/EXE-or-DLL-or-ShellCode
π₯ [ tweet ]
Inspired by @0gtweet, I created PoC: EXE-or-DLL-or-ShellCode that can be:
Executed as a normal #exe
Loaded as #dll + export function can be invoked
Run via "rundll32.exe"
Executed as #shellcode right from the DOS (MZ) header that works as polyglot stub
π https://github.com/Dump-GUY/EXE-or-DLL-or-ShellCode
π₯ [ tweet ]
π5π€1
π [ Sam βοΈπͺ΅ @Sam0x90 ]
Interesting ZIP trick with
zip > docx LNK > ftp.exe > disguised pythonw.exe > CS shellcode
π https://www.ctfiot.com/203334.html
π₯ [ tweet ]
Interesting ZIP trick with
__Macosx__ folder and LNK executing ftp script to execute embedded pythonw.exe zip > docx LNK > ftp.exe > disguised pythonw.exe > CS shellcode
π https://www.ctfiot.com/203334.html
π₯ [ tweet ]
π10
π [ Het Mehta @hetmehtaa ]
Reversing a VPN client to hijack sessions
π https://rotarydrone.medium.com/decrypting-and-replaying-vpn-cookies-4a1d8fc7773e
π₯ [ tweet ]
Reversing a VPN client to hijack sessions
π https://rotarydrone.medium.com/decrypting-and-replaying-vpn-cookies-4a1d8fc7773e
π₯ [ tweet ]
π₯9
This media is not supported in your browser
VIEW IN TELEGRAM
π [ John Hammond @_JohnHammond ]
Well, this was a stupid insomnia project, but... π
Playground code is here:
π https://github.com/JohnHammond/recaptcha-phish
π₯ [ tweet ][ quote ]
Well, this was a stupid insomnia project, but... π
Playground code is here:
π https://github.com/JohnHammond/recaptcha-phish
π₯ [ tweet ][ quote ]
Π·Π°Π²ΠΈΡΡΡΠΈΠ»ΠΎΡΡ, ΠΏΡΠΈΠΊΠΎΠ»ΡΠ½ΠΎπ18π1π₯±1
Offensive Xwitter
π [ JiΕΓ Vinopal @vinopaljiri ] Inspired by @0gtweet, I created PoC: EXE-or-DLL-or-ShellCode that can be: Executed as a normal #exe Loaded as #dll + export function can be invoked Run via "rundll32.exe" Executed as #shellcode right from the DOS (MZ) headerβ¦
π [ Kurosh Dabbagh @_Kudaes_ ]
Somebody asked if you can run a dll directly without rundll32 as you would do with an exe. You just need to remove the IMAGE_FILE_DLL flag from IMAGE_FILE_HEADER->Characteristics, which can be done with the option -e. Don't see much use for it tho ^^
π https://github.com/Kudaes/CustomEntryPoint
π₯ [ tweet ]
Somebody asked if you can run a dll directly without rundll32 as you would do with an exe. You just need to remove the IMAGE_FILE_DLL flag from IMAGE_FILE_HEADER->Characteristics, which can be done with the option -e. Don't see much use for it tho ^^
π https://github.com/Kudaes/CustomEntryPoint
π₯ [ tweet ]
π18
π [ Usman Sikander @UsmanSikander13 ]
Basics to advanced process injection. Covering 25 techniques:
π https://github.com/Offensive-Panda/ProcessInjectionTechniques
π₯ [ tweet ]
Basics to advanced process injection. Covering 25 techniques:
π https://github.com/Offensive-Panda/ProcessInjectionTechniques
π₯ [ tweet ]
π14
π [ Aleem Ladha @LadhaAleem ]
I've fully automated the lab used for @_leHACK_ Active Directory 2024 workshop done by @mpgn_x64 and it's available for everyone ! π₯
Also big kudos to @M4yFly for the playbooks and NetExec dev teams for this awesome tool !
Hope you enjoy, more to come
π https://github.com/Pennyw0rth/NetExec-Lab
π₯ [ tweet ]
I've fully automated the lab used for @_leHACK_ Active Directory 2024 workshop done by @mpgn_x64 and it's available for everyone ! π₯
Also big kudos to @M4yFly for the playbooks and NetExec dev teams for this awesome tool !
Hope you enjoy, more to come
π https://github.com/Pennyw0rth/NetExec-Lab
π₯ [ tweet ]
π9π₯7π€2π€―2
π [ Koen Van Impe β @cudeso ]
Interesting approach shared by @Wietze on manipulating
π https://www.wietzebeukema.nl/blog/why-bother-with-argv0
π₯ [ tweet ]
Interesting approach shared by @Wietze on manipulating
argv[0] to mislead security tools and analysts. A clever tactic for obfuscation!π https://www.wietzebeukema.nl/blog/why-bother-with-argv0
π₯ [ tweet ]
π12π₯1π€―1
π [ Nikhil Hegde @ka1do9 ]
In this one, I go into great detail about how malware walks the Process Environment Block (PEB) to find particular DLLs and parses their export table to find address of functions.
π https://nikhilh-20.github.io/blog/peb_phobos_ransomware/
π₯ [ tweet ]
In this one, I go into great detail about how malware walks the Process Environment Block (PEB) to find particular DLLs and parses their export table to find address of functions.
π https://nikhilh-20.github.io/blog/peb_phobos_ransomware/
π₯ [ tweet ]
π9π₯6
π [ Justin Elze @HackingLZ ]
Pwning C2 frameworks
π https://blog.includesecurity.com/2024/09/vulnerabilities-in-open-source-c2-frameworks/
π₯ [ tweet ]
Pwning C2 frameworks
π https://blog.includesecurity.com/2024/09/vulnerabilities-in-open-source-c2-frameworks/
π₯ [ tweet ]
π6π₯3
π [ konrad @konradgajdus ]
From Theory to Code: Implementing a Neural Network in 200 Lines of C
π http://x.com/i/article/1837064930832404482
π₯ [ tweet ]
From Theory to Code: Implementing a Neural Network in 200 Lines of C
π http://x.com/i/article/1837064930832404482
π₯ [ tweet ]
π€―3
π [ Orange Cyberdefense Switzerland @orangecyberch ]
π»π‘οΈ In this series of blog posts, ClΓ©ment Labro (itm4n) one of our ethical hacker, explores yet another avenue for bypassing LSA Protection in Userland.
Blog series:
π https://itm4n.github.io/ghost-in-the-ppl-part-1/
π https://itm4n.github.io/ghost-in-the-ppl-part-2/
π https://itm4n.github.io/ghost-in-the-ppl-part-3/
Code:
π https://github.com/itm4n/PPLrevenant
π https://github.com/itm4n/Pentest-Windows/tree/main/NdrServerCallAll
π₯ [ tweet ]
π»π‘οΈ In this series of blog posts, ClΓ©ment Labro (itm4n) one of our ethical hacker, explores yet another avenue for bypassing LSA Protection in Userland.
Blog series:
π https://itm4n.github.io/ghost-in-the-ppl-part-1/
π https://itm4n.github.io/ghost-in-the-ppl-part-2/
π https://itm4n.github.io/ghost-in-the-ppl-part-3/
Code:
π https://github.com/itm4n/PPLrevenant
π https://github.com/itm4n/Pentest-Windows/tree/main/NdrServerCallAll
π₯ [ tweet ]
π10π₯3
π [ Remko Weijnen @RemkoWeijnen ]
Proof of Concept to leverage Windows App to create an LSASS dump
π https://github.com/rweijnen/createdump
π₯ [ tweet ]
Proof of Concept to leverage Windows App to create an LSASS dump
π https://github.com/rweijnen/createdump
π₯ [ tweet ]
π₯±5π₯4π1
π [ DSAS by INJECT @DevSecAS ]
Recursive Loader
Explanation of code: The following code is inspired by APT Linux/Kobalos. Kobalos was malware, suspected to be tied to the Chinese government, which was fully recursive. It was novel malware.
π https://github.com/Evi1Grey5/Recursive-Loader
π₯ [ tweet ]
Recursive Loader
Explanation of code: The following code is inspired by APT Linux/Kobalos. Kobalos was malware, suspected to be tied to the Chinese government, which was fully recursive. It was novel malware.
π https://github.com/Evi1Grey5/Recursive-Loader
π₯ [ tweet ]
π11
π [ Will @BushidoToken ]
I am happy to share another new resource I recently made called The Russian APT Tool Matrix π·πΊ
π https://blog.bushidotoken.net/2024/09/the-russian-apt-tool-matrix.html
π https://github.com/BushidoUK/Russian-APT-Tool-Matrix
π₯ [ tweet ]
I am happy to share another new resource I recently made called The Russian APT Tool Matrix π·πΊ
π https://blog.bushidotoken.net/2024/09/the-russian-apt-tool-matrix.html
π https://github.com/BushidoUK/Russian-APT-Tool-Matrix
π₯ [ tweet ]
ΠΈΡΠ΅ΠΌ ΡΠ΅Π±Ρ, ΠΏΠ°ΡΠ°Π½Ρπ8π₯±6π3π3π’1
π [ Check Point Research @_CPResearch_ ]
10 years of DLL hijacking - featuring abused executables that shouldn't have existed, exported and malicious DLLs with discount bin "packing." Includes a PoC for app developers to pre-emptively stop hijacking without dealing with a certificate authority.
π https://research.checkpoint.com/2024/10-years-of-dll-hijacking-and-what-we-can-do-to-prevent-10-more/
π₯ [ tweet ]
10 years of DLL hijacking - featuring abused executables that shouldn't have existed, exported and malicious DLLs with discount bin "packing." Includes a PoC for app developers to pre-emptively stop hijacking without dealing with a certificate authority.
π https://research.checkpoint.com/2024/10-years-of-dll-hijacking-and-what-we-can-do-to-prevent-10-more/
π₯ [ tweet ]
π6
π [ Fox-IT @foxit ]
Check out our latest blog from our Red Team about EDR evasion through malware virtualisation:
π https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/
π₯ [ tweet ]
Check out our latest blog from our Red Team about EDR evasion through malware virtualisation:
π https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/
π₯ [ tweet ]
π₯2