a great series for learning Linux kernel exploitation
CVE-2017-11176 (UaF in mq_notify function)
Credit: @LexfoSecurite

[ 1 ] blog.lexfo.fr/cve-2017-11176…
[ 2 ] blog.lexfo.fr/cve-2017-11176…
[ 3 ] blog.lexfo.fr/cve-2017-11176…
[ 4 ] blog.lexfo.fr/cve-2017-11176…



#CVE , #analysis , #old_but_gold
——-
@islemolecule_source

Loading DLLs without LoadLibraryA. Instead we'll leverage the VEH (Vectored Exception Handler) to modify the context, especially RIP and RCX to hold the LoadLibraryA address and it's argument.

Link

#malware_dev
———
@islemolecule_source

LOLBAS
Living Off The Land techniques.
GitHub
Doc

#windows
#redteam
#lolbin
———
@islemolecule_source

LoLBins in attacks
Link

#windows
#redteam
#lolbin
———
@islemolecule_source

LOLBin: fhmanagew.exe
Link


#windows
#redteam
#lolbin
———
@islemolecule_source

LOLBin for Downloading Arbitrary Files

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe <URL>

Find the downloaded file in

%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>

#windows
#redteam
#lolbin
———
@islemolecule_source

"GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems."

Link

#linux
#redteam
#lolbin
———
@islemolecule_source

What the Vuln: EDR Bypass with LoLBins
Link

#windows
#redteam
#lolbin
———
@islemolecule_source

"PowerShell Automation and Scripting for Cybersecurity: Hacking and defense for red and blue teamers", 2023.

#powershell
———
@islemolecule_source

Simple password/cookies/history/bookmarks stealer/dumper for chrome all version
Link

#malware_dev
———
@islemolecule_source

Download Reverse engineering, windows programming, internals,etc..
Link

#windows #reverse #programming #internals
———
@islemolecule_source

#packer
#reverse
———
@islemolecule_source

meanwhile him🫤

allows any user to crash the Windows Event Log service of any other Windows 10/Windows Server 2022 machine on the same domain
Link

#windows
#malware_dev
———
@islemolecule_source

Secure Programming Cookbook for C and C++

this book covers unix base OS and windows 👍🏻

ec council - secure programming with c++

Chapter 1: Introduction to C++ Programming
Chapter 2: Battling Integer Vulnerabilities in C++
Chapter 3: Memory Management in C++
Chapter 4: Pointer Subterfuge and Object Misuse in C++
Chapter 5: Code Injection Attacks and Run-time Countermeasures
Chapter 6: Eliminate Common Issues with Multithreaded Programming: Concurrency and Parallelism
Chapter 7: Exceptions and Error Handling in C++
Chapter 8: Industry Resources and Best Practices for C++ Development


LINK
file password : https://news.1rj.ru/str/islemolecule_source


course website link

Pwn college
Link

#reverse
#pwn
———
@islemolecule_source

post get updated :

+ Detecting In-Memory Threats with Kernel ETW Call Stacks
+ Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers
+ A Begginers All Inclusive Guide to ETW
+ ETW References
+ Give Me an E, Give Me a T, Give Me a W. What Do You Get? RPC! (pars events from the RPC ETW)
+ Attacks on ETW Blind EDR Sensors ( black hat con )

Windows - Data Protection API (DPAPI)



https://tierzerosecurity.co.nz/2024/01/22/data-protection-windows-api.html


#windows , #internals
———
@islemolecule_source