Print3M

Red Team & security research & programming.

[Print3M @Print3M_]

Releasing EPIC [Extensible Position Independent Code] – toolkit for C/C++ shellcode building 🔥

https://t.co/dnUg6PoEBa

- Modularity (!)
- Dead-code & payload size optimization
- Global context
- Minimal PIC-friendly libc & win32 included
- More...

#redteam #malware #security

[Print3M @Print3M_]

@niebezpiecznik Dopiero 12 raz dzisiaj widzę posta typu "BREAKING!!!1! Someone just open-sourced". Claude coś dzisiaj zamulał, pewnie dlatego taki słaby wynik.

[Print3M @Print3M_]

@SEKTOR7net Wow, thank you friends! :)

[Peter Holderith @_baldtires]

i don't want TO CREATE A FUCKING MICROSOFT ACCOUNT TO SETUP WINDOWS!!!!!!!!

[Print3M @Print3M_]

@ale_sp_brazil @MacmodSec I was using Godap on my engagement! Very nice looking and convenient tool. I like the feeling and detailed info about objects.

Didn't know about FlashIngestor! Thanks :)

[Print3M @Print3M_]

@domchell Don't forget to check out the free ebook pdf I prepared for you in the pinned post on my profile. Cheers.

[Print3M @Print3M_]

@techspence @PyroTek3 Looks cools, thanks! :)

[Print3M @Print3M_]

Awesome real-life RedTeam infrastructure overview by @0XDbgMan 🔥🔥🔥 Juicy.

https://t.co/CzFTgMNknl

[Justin Elze @HackingLZ]

### Top-Line Findings

1. **The C2 ecosystem is far less diverse than it appears.** While there are 30+ "different" frameworks, the underlying technique implementations converge on a small number of canonical code patterns, many traceable to specific open-source authors or blog posts.

2. **Three source projects account for the majority of reused code:**
- **TrustedSec's COFFLoader** — the ancestor of nearly every open-source BOF loader
- **PowerSploit** (by @harmj0y, @mattifestation, @obscuresec) — Get-Keystrokes, Invoke-Mimikatz, PowerView, and persistence modules are shipped verbatim by Empire, PoshC2, PowerHub, Amnesiac, and Shad0w
- **Kevin Robertson's Invoke-WMIExec/Invoke-SMBExec** — the dominant PowerShell implementations for WMI and SMB lateral movement, bundled by Empire, PoshC2, PowerHub, and SilentTrinity

3. **A single detection rule can catch multiple frameworks.** Because many C2s share identical implementation code:
- One detection for the PowerSploit `Get-Keystrokes` GetAsyncKeyState polling loop catches Empire, PoshC2, and any framework that bundles PowerSploit
- One detection for the TrustedSec COFFLoader relocation pattern catches Apollo, Loki, Sliver (extension), and derivatives
- One detection for the .NET `ManagementScope` WMI pattern catches Apollo, Covenant, NimboC2, SilentTrinity, and DeimoC2

4. **Genuinely novel frameworks are rare.** Of the 30 analyzed:
- **4 frameworks** (Sliver, Havoc, Realm, TripleCross) demonstrate significant code originality
- **6 frameworks** show moderate originality (Wyrm, AdaptixC2, Emp3r0r, Merlin, NimPlant, GC2)
- **20 frameworks** rely heavily on shared code from the three source projects above, or implement techniques using the same well-known recipes

5. **HTTP C2 communications show the most behavioral convergence.** Three jitter formula families, shared User-Agent strings (the IE11 UA appears in Empire, Nuages, and Covenant), and common URL path patterns create fingerprinting opportunities.

[Print3M @Print3M_]

@mrgretzky I just love to code and I'm tired of this imposed AI-FOMO feeling attacking me from everywhere.

[Print3M @Print3M_]

Might be interesting for you: @hasherezade @gynvael @vxunderground @curi0usJack @mrgretzky @mrd0x @C5pider @ShitSecure @mariuszbit @MateuszChrobok @domchell @Octoberfest73 @mrexodia @5mukx

[Print3M @Print3M_]

Do you know you can create a custom Google search with limited scope? I collected 230+ high-quality IT security sources (blogs, etc.) and created Google Hack Search 🔥

https://t.co/BKgmkFNL9Z

No AI, no marketing, no bullshit. Old internet. Pure hacking.

#redteam #infosec

[Print3M @Print3M_]

Demo:

[Print3M @Print3M_]

Direct link:
https://t.co/Ibiv8c5hSN

[Print3M @Print3M_]

Highly recommend this summary. Not only because there's my research included... but mostly;)))))

[delivr.to @delivr_to]

It's that time again.

Our latest Top 10 includes the tradecraft that mattered most over the past six months; from filejacking, to polyglots, to the latest evolution in ClickFix attacks.

https://t.co/wXRDvs0EV2

[Print3M @Print3M_]

@Octoberfest73 I would say malware development is 80% of just a desktop software development and 20% of juicy things. I guess people like to write 80% of the code in a language they consider "more convenient to work with".

[Print3M @Print3M_]

@awesomekling Bro, it's going to be outdated from day 1...

[Print3M @Print3M_]

@_RastaMouse @_xpn_ This 100%. Every side-project, every blog post.

[Print3M @Print3M_]

Good lord, Signal is down...