0x12 Dark Development

Offensive Security

[0x12 Dark Development @Salsa12__]

Today I'm launching 0x12DarkSandbox, my biggest project to date🥂🥂

Built for offensive security professionals who want to understand not just whether a payload is detected, but exactly how and why it gets caught

https://t.co/sTlq2l3bTr

More info here:
https://t.co/EUsnZm1u7B

[0x12 Dark Development @Salsa12__]

@mihomoparty Is similar to vuln drivers, the Microsoft ones usually don't have many vulnerabilities, but the third party ones yes, it's exactly what we are searching here, DLLs from third party apps or projects with RWX (in the example of the post we use a simple DLL from the Git application)

[0x12 Dark Development @Salsa12__]

Bring Your Own RWX Region DLL (BYORWXDLL)

New Medium post, today we are exploring a technique I call Bring Your Own RWX Region DLL, inspired by the well-known BYOVD (Bring Your Own Vulnerable Driver)

https://t.co/slNKv9qF4W

[Smukx.E @5mukx]

Honestly, what is this ? I got a response from @github support team. So here after legal Security Research and PoC's is not allowed on GitHub ?

I'm Completely got disappointment by @github and @Microsoft @MsftSecIntel .

In what ways i distribute and share malware. Can anyone tell me if there is a mistake from my side, did i share 0 days, vulnerabilities, direct binaries or full exploit chain that harm users ? NONE ?

is posting Legal source codes and tools that are made of public PoCs are wrong ? there are thousand of full chain real expoits that bypasses EDRs, C2s that evades security solutions, phishing kits that bypasses MFA of Microsoft out there in @github , if that is legal then why cant this simple publically made poc can't be in the github ?

I have replied regarding my statements, please don't disappoint younger legal windows security researchers like this. I have some little hope on @github @Microsoft @MsftSecIntel .

I have a little hope. So Please don't make me loose on @github & @Microsoft & @MsftSecIntel .

Ticket ID: #4440743

Will be waiting for your kind response. Thank you.

https://t.co/FTpHwmDK8D

#github #microsoft #security #research

[0x12 Dark Development @Salsa12__]

Remembering the Early Cascade Injection

[0x12 Dark Development @Salsa12__]

Instead of loading a vulnerable driver to gain kernel read/write primitives, this technique abuses legitimate, signed DLLs that already contain pre-defined RWX (Read+Write+Execute) memory regions when loaded into a process.

[Smukx.E @5mukx]

Hey @martinwoodward

My GitHub account was flagged without any prior notice. I'm a college student and have been an active open-source contributor for over 4 years. I've released multiple security research projects and even contributed to Microsoft's open source editor.

My repositories help security researchers test and strengthen defensive systems through authorized work. Today I was releasing updates to a new tool when the flag occurred. I've already submitted a reinstatement request (Ticket #4440743).

So I kindly request you to help and resolve this issue.

Thank you

[0x12 Dark Development @Salsa12__]

@babykuteok15 Some of these ones don't work in some build versions, my recommendation, test all the ones of this repo:
https://t.co/oHwiwyl7HB

[0x12 Dark Development @Salsa12__]

Sysprep.exe UAC Bypass via AppID Hijack

New Medium post, today we will see another UAC bypass technique through Sysprep.exe approaching the AppID Hijack technique!

https://t.co/OAM4FKxIUp

[0x12 Dark Development @Salsa12__]

Bring Your Own DLL with RWX spaces

[0x12 Dark Development @Salsa12__]

Remembering about set anti-malware level PPL with an unsigned driver

[0x12 Dark Development @Salsa12__]

Eventvwr.exe UAC Bypass via mscfile

New Medium post. Today, we’ll take a look at one of the most popular UAC bypass techniques in Windows and explore how it abuses Event Viewer to execute code with elevated privileges

https://t.co/ChFWSSNsJo

[0x12 Dark Development @Salsa12__]

Another classic UAC bypass, in this case is approaching sysprep.exe

Tomorrow in Medium

[0x12 Dark Development @Salsa12__]

UAC Bypass via ComputerDefaults.exe

New Medium post, this week we will look at a series of three basic but always useful well documented UAC Bypasses in Windows. Today ComputerDefaults.exe as the first one

https://t.co/iPgLfu2zkR

[0x12 Dark Development @Salsa12__]

@grere250598 🫡

[0x12 Dark Development @Salsa12__]

Classic Windows UAC bypass via computers.exe

[0x12 Dark Development @Salsa12__]

@eki_erk @ipurple Right! My bad thank you!

[0x12 Dark Development @Salsa12__]

@Pepperstone_1 You can find it on the internet, anyway tomorrow in medium

[0x12 Dark Development @Salsa12__]

Remote PEB Walking: Enumerating Loaded Modules

New Medium post, today we are enumerating remote modules walking the PEB, a stealthy way to do it instead of relaying on the classical ways!

https://t.co/JDBdsE9y4R

[0x12 Dark Development @Salsa12__]

Shitty custom driver to play with Windows registries, just for fun