HoangSpecial

Security Researcher | Pentester | Red Team | APT69

[HoangSpecial @SpecialHoang]

@timmisiak look at rsp for example is great. The stack window is there but most the time I want to scroll further and beyond alongside with a more intuitive understanding of where I am in the stack is the only reason I am still on windbg :(. Thanks again for the great product!

[HoangSpecial @SpecialHoang]

@timmisiak big fan of windbgx. Everything is much better and more fluid. However, just a feedback and it is that hotkey-only new windows suck. I had to ask tons of people after googling resulting in nothing useful (it was ctrl + shift + m). Would love a more intuitive way!

[HoangSpecial @SpecialHoang]

@timmisiak Thanks for the reply Tim! I appreciate it. One last suggestion (and maybe I am a coconut and haven't figure it out yet) but the ability to view memory as other forms (Pointer and Symbol to be specific) would be godsend. The ability to scroll &

[HoangSpecial @SpecialHoang]

@layle_ctf @ColtonSkees On top of that, what DB implemented is more than many other manufacturers does to secure their signed drivers. Go get some CVEs and clout there instead where the source is not open to the public unlike CE (https://t.co/YUcY89AHNZ).

[HoangSpecial @SpecialHoang]

@layle_ctf @ColtonSkees Because DB and CE's job is to provide hackers with a hacking tool. Not adding more and more security on top of already existing ones. Plus, it is open source. So this will require DB to:
1. wild goose chase on an open source software to keep you happy.
2. everyone signs their own

[HoangSpecial @SpecialHoang]

@layle_ctf But why tho? DarkByte wrote one of the greatest tool that every game hacker relies on and give it out for free. Why wouldn't you honor his wishes to keep things safe?

[HoangSpecial @SpecialHoang]

@leoloobeek Next time Leo, I promise

[HoangSpecial @SpecialHoang]

@GossiTheDog @byt3bl33d3r @TalBeerySec @cyb3rops @anthomsec Shhhhhh 🤫

[HoangSpecial @SpecialHoang]

Are there any Write-What-Where primitive left in W10 x64 1909? Seem like Gh?4 RGNOBJ is the only one intact and I'm not even sure if that is usable as a primitive. @msftsecurity, give back my GDI objects!

[Leo Loobeek @leoloobeek]

New COM post (and PoC) just published. This one journeys into COM server development, building a component for offensive use cases that can then be loaded with registration-free COM. Feedback welcome.
https://t.co/ccJBSLiXsn

[Faisal Tameesh @primal0xF7]

During a recent long-term red team op, we bypassed CloudFlare to obtain a foothold on a subsidiary. AD forest exploitation followed, which allowed for compromising the parent company. This post focuses on bypassing CloudFlare WAF.

https://t.co/WpGN9aMw0i

[HoangSpecial @SpecialHoang]

@vysecurity When your opponent is a kernel level anticheat that disregards usability, privacy, stability, and compatibility, Modern EDR Solutions (TM) looks cute in comparison.

[HoangSpecial @SpecialHoang]

@james0x40 nice! is this with sandbox escape as well?

[HoangSpecial @SpecialHoang]

@n4r1B Amazing work. Loves the attention to detail and how far you go into each of WD's module and structure =)

[HoangSpecial @SpecialHoang]

@BillDemirkapi Similarly, I also happen to get to use forced exception through pointer destruction which is another nice trick to pair up with VEH. AGAIN, sorry for necroing this haha.

[HoangSpecial @SpecialHoang]

Ever want to hook functions stealthily? Check out my new blog! Vectored Exception Handling Hooking!

https://t.co/9ghSxH9t5h

[HoangSpecial @SpecialHoang]

@BillDemirkapi Sorry for replying to something a year back, was scrolling through my Twitter and realized I never replied, my fault. I think you know this by now that a lot of games do anticheat do use DR register as a way to stop debuggers from placing hwbp but your comment is correct =).

[HoangSpecial @SpecialHoang]

@leoloobeek @bohops @Oddvarmoe @xenosCR @ConsciousHacker @curi0usJack @CyberWarship @EranShimony @PhilipTsukerman @mrgretzky I wish i was 10

[HoangSpecial @SpecialHoang]

@leoloobeek @bohops @Oddvarmoe @xenosCR @ConsciousHacker @curi0usJack @CyberWarship @EranShimony @PhilipTsukerman @mrgretzky One of the smartest hacker I know. The man, the legend, leoloobeek

[HoangSpecial @SpecialHoang]

@jasc22 @TomahawkApt69 @NCCGroupInfosec @leoloobeek If you can show me the code. It have a custom cmd that you can use, just ends with &. This should let you execute anything in cmd as admin. Sorry for the late reply, holiday and travel. Do let me know if you need more help we can hit up DM.

[HoangSpecial @SpecialHoang]

Thanks to @NCCGroupInfosec for releasing their write up on CVE-2019-1405 and CVE-2019-1322. I figured it is time for me to learn some COM stuff so I whip up a PoC.
Source: https://t.co/Ucpa7SykiS .
Video: https://t.co/h45WJKhMMO
Thanks to @leoloobeek and @TomahawkApt69

[HoangSpecial @SpecialHoang]

@vm_call This was always a known thing in project's file is it not? Just give a quick look around project file and solution file before opening.