Inspired Shell Obfuscatio
https://github.com/CyberSecurityN00b/shellfeck

"Can a .txt file be malicious?"

Short answer: No

Long answer: Anything is possible through the power of Windows HKEY_CLASSES_ROOT

tl;dr modify shell open command (default) to malicious payload with subsequent invocation of text editor + parameters. The .txt file won't be malicious, but the thing responsible for opening them will be

¯\_(ツ)_/¯

In the simplest terms possible, this registry hive contains the necessary information for Windows to know what to do when you ask it to do something, like to view the contents of a drive, or open a certain type of file, etc.


HKEY_CLASSES_ROOT\.avi
HKEY_CLASSES_ROOT\.bmp
HKEY_CLASSES_ROOT\.exe
HKEY_CLASSES_ROOT\.html
HKEY_CLASSES_ROOT\.pdf
HKEY_CLASSES_ROOT\AudioCD
HKEY_CLASSES_ROOT\dllfile
...


Each of these keys stores information on what Windows should do when you double-click or double-tap a file with that extension in File Explorer. It might include the list of programs found in the "Open with..." section when right-clicking/tapping a file, and the path to each application listed.

For example, when you open a file called draft.rtf, WordPad might open it. The registry data that makes that happen is stored in the HKEY_CLASSES_ROOT\.rtf key, which defines WordPad as the program that should open the RTF file.



Ref: link

#malware_dev

The HKEY_CLASSES_ROOT (HKCR) key in the Windows registry is a merged view of the HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes keys. By default, only users with administrator privileges can modify the keys and values under HKCR.

If a non-administrator user attempts to write to a key under HKCR, and the key already exists under HKEY_CURRENT_USER\Software\Classes, the system will store the information there instead of under HKEY_LOCAL_MACHINE\Software\Classes. However, writing directly to HKCR typically requires administrator access because it affects system-wide settings²³.

SyzRetrospector: A Large-Scale Retrospective Study of Syzbot

credit : Ardalan Amiri Sani , Zhiyun Qian

XSSLite Stealer

رایتاپ های سی تی اف راوین

Аналог GetProcAddress, но написан на ассемблере. Гуд...

https://github.com/WKL-Sec/FuncAddressPro

#redteam #maldev #evasion

Dark Side of VSCode
~ How Attacker Abuse VSCode as RAT ~

winsos-poc: A PoC demonstrating code execution via DLL Side-Loading in WinSxS binaries.

https://github.com/thiagopeixoto/winsos-poc.git

UNDERSTANDING A PAYLOAD’S LIFE
Featuring Meterpreter & other guests
credit : Daniel López Jiménez

videos :
https://www.youtube.com/playlist?list=PLwb6et4T42ww1YrYGuX0KN71cw3ejG5IO

slides :
👇🏻