Karkas

I identify as a Threat

[Karkas @CDC_FI]

@TwoSevenOneT Does not work for Trellix Endpoint Security (AV, not EDR) 10.7.20.14066
Does not work for Tanium Threat Response Agent (EDR) 7.6
Does (!) work for Trendmicro Deep Security Agent (AV, latest Version)

[Karkas @CDC_FI]

@FalconFeedsio Chipsoft != cipsoft

[Karkas @CDC_FI]

@HaifeiLi a lot ppl might not know that you can disable certain API Calls with registry Keys/GPOs:
https://t.co/EEZXZnxGX0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cJavaScriptPerms tBlackList=RSS.addFeed|Util.readFileIntoStream
...and you are safe :)

[Karkas @CDC_FI]

@dcuthbert met him countless times even in the smallest Cons where he held top notch talks and always stopped for questions... true legend. Will never be forgotten

[Karkas @CDC_FI]

@rebane2001 will it run doom?

[Karkas @CDC_FI]

@5mukx Dood it´s 2026... who cares about userland hooks?

[Karkas @CDC_FI]

@eversinc33 @cyb3rops Looks like the boys (colleagues) and I are soldiers now

[Karkas @CDC_FI]

@yarden_shafir Once you reach the level "I´ve forgottn more stuff than the average Junior level Analyst knows" you enter the realm of the true masters

[Karkas @CDC_FI]

@VirtualAllocEx perfectly fine dood!

[Karkas @CDC_FI]

@techspence Let´s move everything to the cloud, they know how to do security

[Karkas @CDC_FI]

@d4rksystem @rpargman Awesome Kyle... looking forward to it!

[Karkas @CDC_FI]

@yarden_shafir It´s a Kookaburra, in germany we call it "laughing Hans" :D

They are quite intelligent birds ;)

Kookaburra - Wikipedia

[Karkas @CDC_FI]

Today I improved and rereleased a Project: https://t.co/TvBI9uUFCm
The original Code by 0xNinjaCyclone had hardcoded Injection Process Name and static plain Shellcode. I wanted to load dynamic Shellcode from files into a process of my choice. To get rid of plain msfvenom shellcode detections by several AVs I made a basic XOR Encryption of the embedded shellcode. I also made a Visual Studio 2022 Template, ready to compile and run. Did not yet find the problem why not msfvenom shellcode crashes the hosting payload process. So just use msfvenom SC for now. I successfully tested with meterpreter_reverse_tcp

[Karkas @CDC_FI]

@m4ul3r_0x00 Early Cascade Injection, nice work, thanks

[Karkas @CDC_FI]

@_RastaMouse it realy is. But learn my lesson: Don´t Update (OTC Wifi Dongle) without backing up the SD Card first

[Karkas @CDC_FI]

@C5pider @Octoberfest73 yeah sure it´s not... did not yet look into the code when writing the comment. Will steal the best ideas anyway!
btw, nice Framework @c5pider was hard to get into it, but yet fun to learn

[Karkas @CDC_FI]

@d4rksystem @jstrosch loved to see you working!

[Karkas @CDC_FI]

@kyREcon @OutflankNL yeah... exactly my thoughts man