https://ringzer0.training/advanced-browser-exploitation/

( just slides )👀

A Syscall Journey in the Windows Kernel

What's happening after a syscall

Credit: Alice
https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel

#internals #windows

File Tunnel
Tunnel TCP connections through a file
https://github.com/fiddyschmitt/File-Tunnel.git

QiAnXin Cyber Threat Report H1 2024 is released

https://ti.qianxin.com/uploads/2024/08/19/2274f632f6a1d8acd2f1801c24887edb.pdf

here is auto translated version , not bad

👇🏻

Just a piece of advice for anyone trying to learn something new:

We all start very enthusiastically, dedicating time and effort. But as complexity increases, we might avoid challenges by shifting to easier tasks. While taking breaks to refresh your mind is beneficial, beware of getting stuck in a cycle of mediocrity.

For example, imagine learning about database internals or how DRAM works. Initially, it's easy to grasp, but you'll inevitably hit a wall. When this happens, explore related concepts, read articles and whitepapers, and connect the dots.

I avoid strict roadmaps and timelines for personal learning because they limit exploration. Trust me, there is no scarcity of knowledge out there, and you'll be amazed by what you discover. (Of course, this advice doesn't apply to professional deadlines; this is specifically for personal upskilling).

Remember, there's no single right way to learn

. Choose a method that you enjoy and that keeps you motivated. Just don't forget the reason you started this journey in the first place.


credit :
Mohit Mishra

Exploring Android Exploitation: A Journey into Stack Overflow Vulnerability
Credit: @INVOXES
https://kousha1999.github.io/posts/2024/Android-Stack-Overflow-Exploitation-with-Frida

themida-unmutate
A Python 3 tool to statically deobfuscate functions protected by Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.
The tool has been tested on Themida up to version 3.1.9. It's expected to work on WinLicense and Code Virtualizer as well.


https://github.com/ergrelet/themida-unmutate

A Binary Ninja plugin is also available here.

#unpacking #packer

SCCMSecrets.py

A python utility that builds upon existing SCCM research. It goes beyond NAA credentials extraction, and aims to provide a comprehensive approach regarding SCCM policies exploitation. The tool can be executed from various levels of privileges, and will attempt to uncover potential misconfigurations related to policies distribution. It will dump the content of all secret policies encountered as well as collection variables, in addition to package noscripts hosted on the distribution points. Finally, it can be used throughout the intrusion process by configuring it to impersonate legitimate SCCM clients, in order to pivot across device collections.

For more details regarding the tool and its usage, see the associated article at: https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial

P.S. Another tool allowing to dump SCCM distribution point resources via HTTP: https://github.com/badsectorlabs/sccm-http-looter

Cobalt Strike

CDN & Reverse Proxy Setup.

Reverse proxy

#redteam #infra

Antimalware Scan Interface (AMSI) — A Red Team Analysis on Evasion

In this post, we will analyze how AMSI works and recap existing known bypasses.

https://iwantmore.pizza/posts/amsi.html

+ Omer Yair’s talk
+ DerbyCon talk
+ Daniel Bohannon’s Hacktivity talk.

#amsi #windows #vb #winsec

Abuse SVCHost Methods
Credit: Reza Rashidi
https://redteamrecipe.com/abuse-svchost-methodsrtc0017

Cryptojacking via CVE-2023-22527: Dissecting a Full-Scale Cryptomining Ecosystem

A technical analysis on how CVE-2023-22527 can be exploited by malicious actors for cryptojacking attacks that can spread across the victim’s system.

https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html