Anas

Cyber Security Consultant | Security Researcher

[Anas @ZeroMemoryEx]

And since it's an arbitrary file deletion, we can easily use it to exploit the MSI installer rollback to achieve privilege escalation :)

https://t.co/gwBdYHeJWx

[vx-underground @vxunderground]

Shoutout to the homies at "IObit Malware Fighter".

Their IMFForceDelete driver is so wildly vulnerable, and poorly written, you can have their driver arbitrarily delete any file on the machine with 0 privileges and literally 1 line of code

Thanks @_mmpte_software for sharing

[Anas @ZeroMemoryEx]

@0xmadvise 🔥🔥

[Anas @ZeroMemoryEx]

@Haus3c Unfortunately, you can’t!

[Anas @ZeroMemoryEx]

@Haus3c You need to check the certificate details to see if you can use it to dump PPL processes.

[Anas @ZeroMemoryEx]

@provocateur_io @SFNloubnan you think the U.S. doesn’t have transportation? They don’t need Al Boraq to go from LA to San Francisco in 3 hours they already have flights that take only about 1 hour and 20 minutes.

[Anas @ZeroMemoryEx]

@Salsa12__ what do you mean by help disable PPL/PP by manipulating links ?

[Anas @ZeroMemoryEx]

@banthisguy9349 @whiteintel_io found he tried to translate this from English to Korean

[Anas @ZeroMemoryEx]

@smakosh @yezz123 We can go even lower
kfta dyal djaj : 300dh
lma dyal bir : free
internet : 50dh mchrok m3a bzf nas
khbz karm: 10dh ( 7to f ma bach yrtab )
srdine : laknti 9rib b7ar sydo
kra : camping tent

[Anas @ZeroMemoryEx]

@rustdesk @ESET @anydesk @TeamViewer beside that i also found that it was used by several cybercriminal groups, including BlackBasta, as early as 2022.

[Anas @ZeroMemoryEx]

@rustdesk @ESET @anydesk @TeamViewer No idea, but from my point of view, a threat actor can easily deploy it stealthily, while other remote desktop apps are harder due to the message box that appears when someone tries to connect.

[Anas @ZeroMemoryEx]

I published a blog post explaining the features of Chaos-Rootkit and how each one works internally.
https://t.co/noIGKuSsxb

[Anas @ZeroMemoryEx]

@0x_alibabas Thanks. didn’t try BaitAndSwitch. when I suggested a redirect policy, it wasn’t an option they said it was incompatible with their SDK. It also took a long time for them to implement a fix, so I gave up testing.

[Anas @ZeroMemoryEx]

I’ve released a PoC and a technical write-up for a local privilege escalation vulnerability I discovered last year and reported to Lenovo PSIRT, affecting many gaming laptop brands, including Lenovo, MSI, Thunderobot, and others.
https://t.co/f5K1JfGu8S

[Anas @ZeroMemoryEx]

write up https://t.co/F7OdHxlAnm

[Anas @ZeroMemoryEx]

@7N7 Then calls DuplicateHandle with the DUPLICATE_CLOSE_SOURCE option which should close it in the source process allowing you to open it freely and dump everything without the user noticing.

[Anas @ZeroMemoryEx]

@7N7 2. The last issue was that browser processes open the cookies database file with sharing flags that prevent other processes from accessing it. To bypass that you can enumerate handles until you find the right one via NtQuerySystemInformation

[Anas @ZeroMemoryEx]

@7N7 If I remember correctly, if the user is already using the browser and you inject the DLL, it closes once creds are dumped. I didn’t look deeply, but I just run the browser with a new profile (since you can’t spawn two instances), headless then inject dll and pull data via RPC.

[Anas @ZeroMemoryEx]

@7N7 Yeah it’s a lot of effort since you have to handle both ABE and the classic one in ABE some maldevs focus on stealth while others don’t because the browser closes and users notice i can share what I did if you’re interested or you can figur it out yourself if you like challenges.

[Anas @ZeroMemoryEx]

@7N7 Damn, too many things waiting for you down there it almost gave me brain damage.

[Anas @ZeroMemoryEx]

@IntelOpsV3 @dulls I see this is how it started by phishing his friends.😭

[Anas @ZeroMemoryEx]

@AUZombie panel/#scripts

[Anas @ZeroMemoryEx]

@AUZombie This is their builder. You can see the features since it checks authentication on the client side if you set the response of /api/users to true.