Clement Rouault

Python (ab)user / Security / Windows internals / @ExaTrack

[Clement Rouault @hakril]

I am sharing my Windows-specific #Python codebase: https://t.co/MZFd0SfPhE.
It even has a documentation ! https://t.co/k7gIRZXaPv

[BeeRumP @BeeRumP_Paris]

Une septième rump ! @N1aKan nous racontera le déroulement du takedown du ransomware Hive dans sa rump "Histoires de PJ : Hive ransomware" !

[BeeRumP @BeeRumP_Paris]

Une sixième rump ! "Borne 2 Shell", présentation d'une attaque 0-click sur une borne de recharge de véhicule par b.

[BeeRumP @BeeRumP_Paris]

Une cinquième rump ! zadig (@prng1337) avec sa rump "TLS revisité par Nintendo" viendra nous présenter un bug trouvé sur la Nintendo Switch 2

[BeeRumP @BeeRumP_Paris]

Une quatrième rump ! @hakril revient pour cette édition de BeeRumP nous présenter de la vulnérabilité Windows avec sa rump "Retour vers le TAPI"

[Clement Rouault @hakril]

@BeeRumP_Paris

[BeeRumP @BeeRumP_Paris]

Une deuxième rump acceptée ! Un peu d'attaque hardware avec das (@_gquere) : "Temu EMFI: hardware hacking on a budget"

[BeeRumP @BeeRumP_Paris]

Pour notre première rump acceptée, @angel_killah nous parlera de reverse de jeu d'arcade dans sa rump "A practical example of how arcade games cheat you"

[Clement Rouault @hakril]

We are releasing a new method to collect the SRUM Windows forensic artifacts : https://t.co/LllcOTYvt8

@ExaTrack, we have discovered a new method to retrieve the database via a srumapi!SruQueryStatsEx.
Thus, we share this method that we used for 2 years in our tools.

[LE BERRE Stéfan @Heurs]

Discover a new linux backdoor hidden for 10 YEARS in a critical HTTP server, waiting for a "magic packet" to wake up.
Undocumented TTP. Full report: https://t.co/omP65ga7e9 #Malware #ThreatHunting #Cybersecurity @ExaTrack @LoginSecurite

[LE BERRE Stéfan @Heurs]

🚀 Take your malware analysis skills to the next level with Exalyze
Discover our unique capabilities to compare malware code with our entire database, identifying similar samples and uncovering hidden connections.
👉 https://t.co/AVASoPQLrp
@Exalyze_io

[Erik Pistelli @erikpistelli]

🚨 WARNING: A fake domain—cff-explorer[.]com—has been registered to distribute malware. It currently appears as the top Google result when searching for "CFF Explorer". The only legitimate domain is https://t.co/p4MhOw9vZ5.

[Nauseam (in sf!) @ChadNauseam]

"A calculator app? Anyone could make that."

Not true.

A calculator should show you the result of the mathematical expression you entered. That's much, much harder than it sounds.

What I'm about to tell you is the greatest calculator app development story ever told.

[REverse_Tactics @Reverse_Tactics]

For the first time, our training "Bug Hunting in Hypervisors" is open to the public at @reconmtl !
Designed for security researchers,we will dive into VM escapes, hypervisor attack surfaces, and real-world exploitation.
More info: https://t.co/Ngrjzu4Mun

[Colin Finck @colinfinck]

The second part of my #WinDbg deep-dive into the #Windows #bootloader is up: Get ready for a decades-old registry structure, unique sorting algorithms, and lots of corner cases. The result is a modern Rust replacement for Mark Russinovich's LoadOrder tool: https://t.co/Xol8O32F6r

[Thomas Rinsma @thomasrinsma]

Yes, PDF runs DOOM! https://t.co/pLtyqj2sR5

(PDFium only for now)

[Clement Rouault @hakril]

I wanted to know how WMI Win32_OperatingSystem.Caption get the correct Version number (ex: "Microsoft Windows 11 Pro").

Turns out it's a DLL export: winbrand!BrandingLoadString.
And there is a patent for that : https://t.co/DQznBaNEnt

[Clement Rouault @hakril]

I just reached 600 stars on PythonForWindows ! \o/ https://t.co/MZFd0Sgn7c

[ExaTrack @ExaTrack]

3+ YEARS of stealth! We uncovered new tactics used by the perfctl malware, including a userland rootkit & an SSH backdoor (a single SPACE in /etc/passwd!). More insights: https://t.co/2rUPbEtNZP #cybersecurity #threat_hunting #linux #infosec #perfctl #rootkit #ssh #exatrack

[Petr Beneš @PetrBenes]

After 6 years, I made a blog thingy again.

This time about MmScrubMemory. An innocuous looking function that has bitten my ass several times in the last several years. And if you're developing a hypervisor, it might've bitten yours, too.

https://t.co/9uEyjZPwVo

[watchTowr @watchtowrcyber]

in today's 'no way, is it real?' we found out that Palo Alto's PAN-OS CVE-2024-0012 and CVE-2024-9474 were the equivalents of saying 'turn off auth and give me a shell'.

Enjoy!

https://t.co/P0PZq0diFF