The HKEY_CLASSES_ROOT (HKCR) key in the Windows registry is a merged view of the HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes keys. By default, only users with administrator privileges can modify the keys and values under HKCR.

If a non-administrator user attempts to write to a key under HKCR, and the key already exists under HKEY_CURRENT_USER\Software\Classes, the system will store the information there instead of under HKEY_LOCAL_MACHINE\Software\Classes. However, writing directly to HKCR typically requires administrator access because it affects system-wide settings²³.

SyzRetrospector: A Large-Scale Retrospective Study of Syzbot

credit : Ardalan Amiri Sani , Zhiyun Qian

XSSLite Stealer

رایتاپ های سی تی اف راوین

Аналог GetProcAddress, но написан на ассемблере. Гуд...

https://github.com/WKL-Sec/FuncAddressPro

#redteam #maldev #evasion

Dark Side of VSCode
~ How Attacker Abuse VSCode as RAT ~

winsos-poc: A PoC demonstrating code execution via DLL Side-Loading in WinSxS binaries.

https://github.com/thiagopeixoto/winsos-poc.git

UNDERSTANDING A PAYLOAD’S LIFE
Featuring Meterpreter & other guests
credit : Daniel López Jiménez

videos :
https://www.youtube.com/playlist?list=PLwb6et4T42ww1YrYGuX0KN71cw3ejG5IO

slides :
👇🏻

Donex a new ransomware gang malware technical analysis
https://www.shadowstackre.com/analysis/donex


#malware_analysis

Program in C

Anatomy of Offensive Tool Development
credit : Alex Reid

https://redsiege.com/blog/2024/01/graphstrike-developer/

Advanced Software Exploitation by Ptrace Security, 2019

In the first half of the course, attendees will use fuzzing, reverse engineering, and source code auditing, to attack a wide variety of applications (e.g. iTunes, Firefox, Vulnserver, etc.) and then use proven exploitation techniques to develop an exploit for one of the VMs (Windows 7, Windows 8.1 and Windows 10).

Then, in the second half of the course, the focus will shift from classic vulnerabilities to more advanced ones. In this section, students will learn how to escape Java sandbox using a type confusion vulnerability, how to circumvent the ASLR without pointer leaks, and how to use precise heap spraying, just to name a few.

By the end of this course, students will know how to find software vulnerabilities using fuzzing, reverse engineering, and source code auditing, and then how to write their own exploits in Python, JavaScript, or Java.

GitHub
About the course
Official page

#education #reverse #coding #python

Advanced Software Exploitation by Ptrace Security, 2019

Rhadamanthys –deep dive into the stealer’s components
https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/