Anas

Cyber Security Consultant | Security Researcher

[Anas @ZeroMemoryEx]

And since it's an arbitrary file deletion, we can easily use it to exploit the MSI installer rollback to achieve privilege escalation :)

https://t.co/gwBdYHeJWx

[vx-underground @vxunderground]

Shoutout to the homies at "IObit Malware Fighter".

Their IMFForceDelete driver is so wildly vulnerable, and poorly written, you can have their driver arbitrarily delete any file on the machine with 0 privileges and literally 1 line of code

Thanks @_mmpte_software for sharing

[Anas @ZeroMemoryEx]

@Pix3l_Peeper @AnassAb01

[Anas @ZeroMemoryEx]

@_xpn_ If you add an antenna extender to it, it’ll become a black hole for RFIDs.

[Anas @ZeroMemoryEx]

@liquidstate_1 @osint_based Yeah, I know that, but in the context of the post, I don’t think it applies. Even if you have the session key/cookies, you still wouldn’t have permission to transfer funds since you’d need 2FA as well.

[Anas @ZeroMemoryEx]

@osint_based Yeah, that’s the closest pattern, I guess. He has a bunch of stealer logs, and he probably runs automated drainer software on them which automatically drains funds from extensions, seed phrases ...

[Anas @ZeroMemoryEx]

@DeanLo66 @NulliusResearch @UK_Daniel_Card Yeah, the guardrails were what confused me, because all those circles have them, while the image you posted doesn’t. but glad it was that close!

[Anas @ZeroMemoryEx]

@MagnusH2 @DailyDarkWeb Those keys can be used to make a bot that watches for any transaction and sweeps the tokens as soon as they land in any of those addresses. I’ve seen a guy who did this in 2017 and swept many bitcoins using this.

[Anas @ZeroMemoryEx]

@tdatwja this DLL : d265fcf18b14b98e55aa9fffd6b64b39de84304a1796854e72eef35bc6dca2c6
TencentVideoReporterPC.dll

[Anas @ZeroMemoryEx]

@tdatwja interesting It abuses a ZEON signed program to perform DLL sideloading of a hidden DLL.

[Anas @ZeroMemoryEx]

@medusa_0xf besides the csrf style attack with it, you can also chain CSPT with an open redirect to get xss or leak csrf tokens.

[Anas @ZeroMemoryEx]

@eversinc33 The easiest way to get blacklisted on literally every website that uses Akamai is by visiting this page🤣.
https://t.co/GSeSvbJSOH<script>alert("XSS")</script>

[Anas @ZeroMemoryEx]

@0xmadvise 🔥🔥

[Anas @ZeroMemoryEx]

@Haus3c Unfortunately, you can’t!

[Anas @ZeroMemoryEx]

@Haus3c You need to check the certificate details to see if you can use it to dump PPL processes.

[Anas @ZeroMemoryEx]

@Salsa12__ what do you mean by help disable PPL/PP by manipulating links ?

[Anas @ZeroMemoryEx]

@smakosh @yezz123 We can go even lower
kfta dyal djaj : 300dh
lma dyal bir : free
internet : 50dh mchrok m3a bzf nas
khbz karm: 10dh ( 7to f ma bach yrtab )
srdine : laknti 9rib b7ar sydo
kra : camping tent

[Anas @ZeroMemoryEx]

@rustdesk @ESET @anydesk @TeamViewer beside that i also found that it was used by several cybercriminal groups, including BlackBasta, as early as 2022.

[Anas @ZeroMemoryEx]

@rustdesk @ESET @anydesk @TeamViewer No idea, but from my point of view, a threat actor can easily deploy it stealthily, while other remote desktop apps are harder due to the message box that appears when someone tries to connect.

[Anas @ZeroMemoryEx]

I published a blog post explaining the features of Chaos-Rootkit and how each one works internally.
https://t.co/noIGKuSsxb