Mohamed Saher

Security Researcher, System Programmer and Part-Time Garbage Collector

[Pedram Amini @pedramamini]

Austin hackers, let's gather for a night of lectures, libations, and BBQ on Wednesday June 5th. Thanks to our corporate sponsors tagged in the photo for fueling the evening. Limited capacity, register at: https://t.co/LA7d1sBD5N Looking forward to catching up with everyone.

[Rolf Rolles @RolfRolles]

New blog entry: An Abstract Interpretation-Based Deobfuscation Plugin for Ghidra https://t.co/1Z3cA7ziR0

[Mohamed Saher @halsten]

@leonyson Sorry for the delay, honestly no. This specific one was targetting me personally amongst other similar attempts against my other accounts as well. Fortunately, I know the person behind these attacks. If I out him out and name him here, he's gonna lose a lot.

[Mohamed Saher @halsten]

A #phishing email using obfuscated #JavaScript and encrypted HTML with #AES targeting #Apple #iCloud email accounts. Here's the URL if anyone wants to analyze it (hxxp://cl.ly/427897542763/asnkjksansnsfa). [1/2]

[Mohamed Saher @halsten]

@marcusjcarey @tx_drewdad If you don’t know what a logical fallacy is, I would suggest you read about it first, then see what your advice suffer from. I can tell you’re an emotional person and over reaction is your first reaction. Feel free to get upset again and blame this on anything irrelevant again.

[Mohamed Saher @halsten]

@tx_drewdad @marcusjcarey Elaborate on your first point. Correct me, on your second point. Third point, people have internet and as it’s already been paid for, you might as well use it.

[Mohamed Saher @halsten]

@marcusjcarey I will simplify it. My criticism was for your advice and not related to the color of your audience, but for any audience in general. The lazy man approach being your advice itself, the illogical fallacies are the incorrect ways you base assumptions/conclusions on.

[Mohamed Saher @halsten]

@WindowsATP Your EULA (https://t.co/pu9M2j5kpv) for Defender ATP has an invalid URL for the Copyright Infringement. This URL "https://t.co/t7IHJaDNb9" needs to end with "HTML" and not "HTM"

[Mohamed Saher @halsten]

@msuiche @pedramamini @ryanaraine Lucky me! ;)

[Mohamed Saher @halsten]

If you want the deobfuscated javascript, the decrypted payload and the email itself just send me a DM. [2/2]

[Evilcry_ @Blackmond_]

Translate x86_64 and ARM binaries to LLVM IR https://t.co/y1NrmxnzEC

[Azeria @Fox0x01]

As I was laying in bed with a cold yesterday, I felt like I should use that time to create a cute little cheatsheet on ARM assembly basics for you guys. Enjoy! 🖤
https://t.co/KPsDAV0Vai

[Rob Fuller @mubix]

My Metasploitable 3 CTF Start to Finish walk-through of all the challenges including CTF setup/prep, and alternative solutions: https://t.co/1YUUnKzxUf (Now downloadable/printable/copy allowed)

[偉 @_sinn3r]

The world could use a full C/C++ example of MSFT's Antimalware Scan Interface (AMSI), so here's one that I used in my lab: https://t.co/ZWJAE7oqDv

[偉 @_sinn3r]

Ran into this tool called PowerGUI. It packages a ps1 and DLL in a .Net binary and executes it. Almost like malware behavior, but not malware. I figured I'd share this so pentesters can play with it. Google PowerGUI Script Editor.

[Moriarty @Moriarty_Meng]

OMG, look what I got :-) Simply add a registry entry value (UAC free) on windows 10 1803, then we can make our vbscript or jscript files bypass AMSI PERMANENTLY! Isn't it so easy? or is it an Easter egg Microsoft left to us? :-( @tiraniddo @bohops @subTee @Oddvarmoe @domchell

[hasherezade @hasherezade]

[DEMO] Recovering a PE with damaged headers with #PEsieve: https://t.co/8k3ULRcX3M (example: #PrincessLocker) - I am currently testing this feature, if you want to help in tests, pls check the "Latest builds": https://t.co/w6pj3Qgf0g

[hackaday @hackaday]

Learn Verilog for #fpga by taking interactive exams in your browser https://t.co/tknflcSP6g

[Mohamed Saher @halsten]

@b0rk Always a delight to read your posts or see your illustrations, @b0rk!