NEW BOT Телеграм, страница

rule Synapse_Ransomware_1_0_0
{
meta:
denoscription = "Synapse Ransomware 1.0.0 Stable Version Release - Detection Rule"
author = "CRT"
date = "2024-05-22"
version = "1.0"
malware_type = "ransomware"
strings:
$str1 = "Global\\FSWiper" ascii wide nocase
$str2 = "ZLWP.tmp" ascii wide nocase
$str3 = "Microsoft Primitive Provider" ascii wide nocase
$str4 = "RNG" ascii wide nocase
$str5 = "Synapse" ascii wide nocase
$clsid1 = {11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24}
$clsid2 = {98 66 4B 67 92 EE D0 11 AD 71 00 C0 4F D8 FD FF}
$clsid3 = {87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24}
$clsid4 = {74 A6 AC 44 FC E8 D0 11 A0 7C 00 C0 4F B6 88 20}
condition:
all of them
}

#malware_analysis

8👍2

1.22K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, edited 13:46

Source Byte

https://blog.0daylabs.com/2024/05/27/jetbrains-teamcity-auth-bypass/

Diving deep into Jetbrains TeamCity Part 1 - Analysing CVE-2024-23917 leading to Authentication Bypass

0Daylabs

Diving deep into Jetbrains TeamCity Part 1 - Analysing CVE-2024-23917 leading to Authentication Bypass

This article aims to explore the details of CVE-2024-23917 and explain the process of constructing an exploit leading to Authentication Bypass. This article is only intended for educational purposes for understanding how vulnerabilities occur in real world.

🔥6👍4

1.22K viewst a h a, 15:13

Source Byte

Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals

Chrome Browser Exploitation, Part 2: Introduction to Ignition, Sparkplug and JIT Compilation via TurboFan

Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463

#cve #Exp #browser

4🔥2

1.21K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, edited 13:00

Source Byte

Getting RCE in Chrome with incorrect side effect in the JIT compiler

In this post, I'll exploit CVE-2023-3420, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.

https://github.blog/2023-09-26-getting-rce-in-chrome-with-incorrect-side-effect-in-the-jit-compiler/

#cve #Exp #browser

3👍2

1.16K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, edited 13:07

Source Byte

Getting RCE in Chrome with incomplete object initialization in the Maglev compiler

In this post, I'll exploit CVE-2023-4069, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.

https://github.blog/2023-10-17-getting-rce-in-chrome-with-incomplete-object-initialization-in-the-maglev-compiler/

#cve #Exp #browser

👍33

1.2K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 13:09

Source Byte

Google Chrome Use After Free vulnerability reported by S4E Team
https://github.com/s4e-lab/CVE-2021-30573-PoC-Google-Chrome

#cve #Exp #browser

5👍1

1.18K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 13:12

Source Byte

Abusing the SeRelabelPrivilege

that a specific Group Poilcy granted via “User Right Assignments” the SeRelabelPrivilege to the built-in Users group and was applied on several computer accounts.

https://decoder.cloud/2024/05/30/abusing-the-serelabelprivilege

#malware_dev

1.09K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 15:24

Source Byte

Forwarded from 1N73LL1G3NC3

CookieKatz

Dump cookies directly from Chrome, Edge, or Msedgewebview2 process memory. Chromium-based browsers load all their cookies from the on-disk cookie database on startup.

The benefits of this approach are:

  • Support dumping cookies from Chrome’s Incogntio and Edge’s In-Private processes
  • Access cookies of other user’s browsers when running elevated
  • Dump cookies from webview processes
  • No need to touch on-disk database file
  • DPAPI keys not needed to decrypt the cookies
  • Parse cookies offline from a minidump file

This solution consists of three projects:

   • CookieKatz - PE executable
   • CookieKatz-BOF - Beacon Object File version
   • CookieKatzMinidump - minidump parser.

5👍1🔥1

880 views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 11:40

Source Byte

Forwarded from 1N73LL1G3NC3

SWAPPALA: Why Change When You Can Hide?

Advanced Module Stomping technique

Github

oldboy21.github.io

SWAPPALA: Why Change When You Can Hide?

Hello everyone! It’s been a while, many things happening and not much time for coding. Hard times. Nonetheless I had little time frames for playing with some stuff I would define cool enough to write some lines about it. Last time we talked about Indirect…

5✍1👍1🐳1

892 views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 11:40

Source Byte

Forwarded from کانال بایت امن

0:51

This media is not supported in your browser

VIEW IN TELEGRAM

#ShortVideo

How to Deal With Password Protect Video Master (PPVM) Integrity Check

🦅 کانال بایت امن | گروه بایت امن
_

Please open Telegram to view this post

VIEW IN TELEGRAM

❤8

927 views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 14:59

Source Byte

سری مقالات رمزنگاری مقدماتی به زبان ساده از محمد حسن پزشکیان
دید خوبی در این زمینه بهتون خواهد داد
امیدواریم از این سری مقالات در زبان فارسی بیشتر ببینیم
https://virgool.io/b-crypto

🔸 1 بررسی مفاهیم اولیه رمزنگاری

🔸 2 بررسی Encoding and Encryption

🔸 3 بررسی Hash & HMAC

🔸 4 بررسی Password Storage, Salt & Pepper

🔸 5 رمزنگاری متقارن یا Symmetric Encryption

🔸6 رمزنگاری نامتقارن یا Asymmetric Encryption

🔸7 امضا و گواهینامه دیجیتال

🔸8 رمزنگاری سخت افزاری و خطرات دولت ها

🔸9 ریاضیات و شرح کارکرد الگریتم های نامتقارن

🔸10 رمزنگاری منحنی بیضوی یا Elliptic-Curve

🔸11 بررسی امنیت پروتوکول های شبکه

🔸12 بررسی حملات رمزنگاری

🔸13 مرور و جمع بندی

#crypto

❤62👍1🥰1

1.4K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, edited 15:36

Source Byte

🦀 | RustRedOps is a repository dedicated to gathering and sharing advanced techniques and offensive malware for Red Team, with a specific focus on the Rust programming language. https://github.com/joaoviictorti/RustRedOps.git @source_byte #malware_dev #rust

OffensiveGolang is a collection of offensive Go packs inspired by different repositories. Ideas have been taken from OffensiveGoLang and Ben Kurtz's DEFCON 29 talk.

https://github.com/MrTuxx/OffensiveGolang.git

#malware_dev #go

6🔥1

1.54K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, edited 10:25

Source Byte

weaponizing Nim for implant development and general offensive operations
https://github.com/byt3bl33d3r/OffensiveNim.git

Interesting Nim libraries

https://github.com/dom96/jester
https://github.com/pragmagic/karax
https://github.com/Niminem/Neel
https://github.com/status-im/nim-libp2p
https://github.com/PMunch/libkeepass
https://github.com/def-/nim-syscall
https://github.com/tulayang/asyncdocker
https://github.com/treeform/ws
https://github.com/guzba/zippy
https://github.com/rockcavera/nim-iputils
https://github.com/FedericoCeratto/nim-socks5
https://github.com/CORDEA/backoff
https://github.com/treeform/steganography
https://github.com/miere43/nim-registry
https://github.com/status-im/nim-daemon

#malware_dev #nim

1.7K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, edited 10:40

Source Byte

#meme

😁122

1.69K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 05:32

Source Byte

gargoyle is a technique for hiding all of a program’s executable code in non-executable memory
GitHub
Link
Blog

#malware_dev

❤54🥱2👍1

1.13K views‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌$ᴘ3ᴅʏʟ1👾, 05:53

About

Blog

Apps

Platform