inbits

[5pider @C5pider]

Introducing Havoc Professional: A Lethal Presence

We’re excited to share a first look at Havoc Professional, a next-generation, highly modular Command and Control framework, and Kaine-kit our fully Position Independent Code agent engineered for stealth!

https://t.co/0aPVihoFIU

[inbits @inbits_sec]

Managed to pick up my first CVE recently, in a Netskope driver. Simple bug but learnt a lot in the process. Hopefully many more to come this year!

https://t.co/0kSwYwsR2R

[inbits @inbits_sec]

@vxunderground @whid_ninja 🥷

[inbits @inbits_sec]

@vxunderground @werupz This looks sick!

[inbits @inbits_sec]

@C5pider thanks man! 🙏

[inbits @inbits_sec]

Wrote a tool a few weeks ago to obfuscate a payload in a generated CSS file. Started off my career as a frontend dev - it's been years since i've looked properly at CSS and I can't say it was a happy reunion 😂

https://t.co/e8CaZk4cV8

[inbits @inbits_sec]

@0xTriboulet @KevinNaughtonJr It's a treadmill!

[inbits @inbits_sec]

@vxunderground Rootkits and Bootkits 🫚👢

[inbits @inbits_sec]

Started using a separate rig for maldev/lab stuff to keep it separate from the gaming one and all that's really happened is I've ended up convincing myself I need to buy a whole new set of nice peripherals

[inbits @inbits_sec]

Wrote up a post on some experiments #unhooking Falcon without using VirtualProtect:

https://t.co/qPJvlBgXOy

[inbits @inbits_sec]

@Securityblog @vxunderground Yep it’s here https://t.co/Bge2w3v2JT

[inbits @inbits_sec]

AES decryption using the Cryptography API: Next Generation (CNG) instead of the CryptoAPI.

https://t.co/kRfb9icgBw

[inbits @inbits_sec]

Been devouring the @SEKTOR7net maldev courses over the last few weeks. Wanted to build some other foundations before hitting maldev (OSCP/doing more C/bit of RE). Loving it now I’m here.

[inbits @inbits_sec]

4. With Kernel debugging enabled, you can actually run ntsd.exe without it spawning a new window at all by using the -d flag. This sends all debugger output to a non-existent kernel debugger):

ntsd.exe -d -cf C:\Tools\x64_calc.wds -o notepad.exe

[inbits @inbits_sec]

Been playing with using cbd.exe for execution after the @SentinelOne Metador report. @mrd0x has a great overview of some of the offsec capabilities, building on Matt Graber's work. Found a few possibly useless additions that I haven't seen mentioned elsewhere.

[inbits @inbits_sec]

3. Ntsd.exe is identical to cdb.exe except that it launches a new console window. It seems to be mentioned less frequently as a LOLbin that cdb.exe (it's not listed on https://t.co/hqvNbFSCfd for example). Presuming this is because the extra window is less stealthy?