nixbyte

| APT69

[nixbyte @nixbyte]

@byt3bl33d3r @TalBeerySec @cyb3rops @anthomsec @SpecialHoang

[nixbyte @nixbyte]

@TheRealWover @_RastaMouse Perfect time to get everything up to par then

[nixbyte @nixbyte]

@_RastaMouse @TheRealWover I’ll take a look this week and see exactly “how” far behind I am

[nixbyte @nixbyte]

@_RastaMouse @TheRealWover I haven’t been up to date but which feature? I don’t know that the core code needs too much to be updated though. I’ll take a look next week and try to get it updated

[HoangSpecial @SpecialHoang]

Thanks to @NCCGroupInfosec for releasing their write up on CVE-2019-1405 and CVE-2019-1322. I figured it is time for me to learn some COM stuff so I whip up a PoC.
Source: https://t.co/Ucpa7SykiS .
Video: https://t.co/h45WJKhMMO
Thanks to @leoloobeek and @TomahawkApt69

[nixbyte @nixbyte]

https://t.co/B9XpXcBNcv
.NET Core version of @TheRealWover's Donut.
Rewrote for dynamic usage with C2 payload generation. Stable in .NET for Linux and Windows.
Other cool stuff in store. Possible Nuget package in the futureeeeeezzzzz

[nixbyte @nixbyte]

@SBousseaden @SwiftOnSecurity And contrary to popular belief the channel (MS_T120) is absolutely needed for RDP. There is just no reason for the client to request it as it's used all internally, server-side

[nixbyte @nixbyte]

@SBousseaden @SwiftOnSecurity If you don't see log generation on your normal RDP sessions then it could very well be a client attempting to open the channel (scanner, etc) and the server automatically closing or something of the sort. Worth looking into

[nixbyte @nixbyte]

@SwiftOnSecurity @SBousseaden Since you cannot open this channel arbitrarily like you could in Win7/2008 and below (the root cause of Bluekeep) I'm going to guess that these are internal logs and should not be considered an IoC.

[nixbyte @nixbyte]

@SwiftOnSecurity @SBousseaden The actual vulnerability was not exploitable in Win8+. You're looking at logs from RDPCoreTS which is the new/unaffected remote desktop services in Win8+. The channel is valid and used internally in every RDS session (Every one I've performed anyways)

[HoangSpecial @SpecialHoang]

After 10 days of minimal sleep and thank to @nixbyte for the majority of the work, here we have it - #bluekeep #LPE. I've learned so much along the way and I am looking forward to the RCE version.

https://t.co/I6rTArI9DL

[Nate @nnwakelam]

Like y’all ain’t running burp at 500 threads too

[nixbyte @nixbyte]

@hannibals @vkamluk hey could one of you guys ping me about Absolute research back from 2014? Questions :)

[nixbyte @nixbyte]

@jack_daniel i have a bad habit of suggesting things when I'd take the easy way out too haha https://t.co/gkguDxv4eW it is

[nixbyte @nixbyte]

@jack_daniel Probably makes the most sense to stand up a server (or two for failover), have all the devices check in to it one on one or more services, log source ip and update records server side

[nixbyte @nixbyte]

@jack_daniel Custom script with registrar API
https://t.co/VeR31m98Aw

[nixbyte @nixbyte]

@QjA4OFk Thanks!

[nixbyte @nixbyte]

@notdan @GossiTheDog @2sec4u @MalwareTechBlog @zerosum0x0 So work in progress I imagine will be quite awhile. Thanks nonetheless though

[nixbyte @nixbyte]

@notdan @GossiTheDog @2sec4u @MalwareTechBlog @zerosum0x0 After talking with zero earlier there is definitely a common agreement that going from this to RCE is no easy task. Kernel pool grooming isn’t so bad locally for kernel sploits but remotely is difficult using just RDP components