Today I'm launching 0x12DarkSandbox, my biggest project to date🥂🥂
Built for offensive security professionals who want to understand not just whether a payload is detected, but exactly how and why it gets caught
https://t.co/sTlq2l3bTr
More info here:
https://t.co/EUsnZm1u7B
@mihomoparty Is similar to vuln drivers, the Microsoft ones usually don't have many vulnerabilities, but the third party ones yes, it's exactly what we are searching here, DLLs from third party apps or projects with RWX (in the example of the post we use a simple DLL from the Git application)
Bring Your Own RWX Region DLL (BYORWXDLL)
New Medium post, today we are exploring a technique I call Bring Your Own RWX Region DLL, inspired by the well-known BYOVD (Bring Your Own Vulnerable Driver)
https://t.co/slNKv9qF4W
Honestly, what is this ? I got a response from @github support team. So here after legal Security Research and PoC's is not allowed on GitHub ?
I'm Completely got disappointment by @github and @Microsoft@MsftSecIntel .
In what ways i distribute and share malware. Can anyone tell me if there is a mistake from my side, did i share 0 days, vulnerabilities, direct binaries or full exploit chain that harm users ? NONE ?
is posting Legal source codes and tools that are made of public PoCs are wrong ? there are thousand of full chain real expoits that bypasses EDRs, C2s that evades security solutions, phishing kits that bypasses MFA of Microsoft out there in @github , if that is legal then why cant this simple publically made poc can't be in the github ?
I have replied regarding my statements, please don't disappoint younger legal windows security researchers like this. I have some little hope on @github@Microsoft@MsftSecIntel .
I have a little hope. So Please don't make me loose on @github & @Microsoft & @MsftSecIntel .
Ticket ID: #4440743
Will be waiting for your kind response. Thank you.
https://t.co/FTpHwmDK8D
#github #microsoft #security #research
Instead of loading a vulnerable driver to gain kernel read/write primitives, this technique abuses legitimate, signed DLLs that already contain pre-defined RWX (Read+Write+Execute) memory regions when loaded into a process.
Hey @martinwoodward
My GitHub account was flagged without any prior notice. I'm a college student and have been an active open-source contributor for over 4 years. I've released multiple security research projects and even contributed to Microsoft's open source editor.
My repositories help security researchers test and strengthen defensive systems through authorized work. Today I was releasing updates to a new tool when the flag occurred. I've already submitted a reinstatement request (Ticket #4440743).
So I kindly request you to help and resolve this issue.
Thank you
Sysprep.exe UAC Bypass via AppID Hijack
New Medium post, today we will see another UAC bypass technique through Sysprep.exe approaching the AppID Hijack technique!
https://t.co/OAM4FKxIUp
Eventvwr.exe UAC Bypass via mscfile
New Medium post. Today, we’ll take a look at one of the most popular UAC bypass techniques in Windows and explore how it abuses Event Viewer to execute code with elevated privileges
https://t.co/ChFWSSNsJo
UAC Bypass via ComputerDefaults.exe
New Medium post, this week we will look at a series of three basic but always useful well documented UAC Bypasses in Windows. Today ComputerDefaults.exe as the first one
https://t.co/iPgLfu2zkR
Remote PEB Walking: Enumerating Loaded Modules
New Medium post, today we are enumerating remote modules walking the PEB, a stealthy way to do it instead of relaying on the classical ways!
https://t.co/JDBdsE9y4R