nt!RajKit

Jellybee the cutting-edge red team C2 and module tradecraft system.

[nt!RajKit @NtRajkit]

https://t.co/SiH82LjrLH

[nt!RajKit @NtRajkit]

🪼 🐝 A demo showing the complete lifecycle of how an operator can #craft a #position-independent #binary from imported C/C++, how they can re-craft it to add features (called CAPs), and finally, how to execute it remotely on the #implant.

https://t.co/GPjpfgCPJc

[nt!RajKit @NtRajkit]

Crafting the uncrafteable

[nt!RajKit @NtRajkit]

@_winterknife_ 😂😂

[nt!RajKit @NtRajkit]

🐝🪼 Creating PICs quickly and easily is one of JellyBee's advantages. This allows us to turn almost any C project into a position-independent binary with superpowers, thanks to the capabilities we can add prior to compilation.

📹 https://t.co/y9B89tfUq6

Why JBKORE? The Jellybee implant does not use COFF, BOF, or DLL payloads, so it does not require reflective loading, just kick PIC craft.

🐝 https://t.co/6e9SfyDo5Q

[nt!RajKit @NtRajkit]

🪼🐝A serie of videos where going to increase the complexity of the compiled C proyect from the simplest to hardest with JBKORE to obtain a perfect PIC from it.

https://t.co/pCnY3Yfihf

[nt!RajKit @NtRajkit]

@_winterknife_ Great for quick testing, is there only the executable for etw-kaac-test.exe or did I miss something? Thx for shr🫡

[nt!RajKit @NtRajkit]

🗞️ In this blog, I trace the evolution from Beacon Object Files and their dependency on Beacon to Crystal Palace Linker and the JellyBee System’s integrated compiler: JBKORE.

🔭 I explore #BOF, #COFF, #PIC and #PICO, and how modularity in post-exploitation could be key in a future that is already the present.

🪼 🐝 #JellyBee the first command-and-control system with a position-independent code compiler integrated into its own development environment.

[nt!RajKit @NtRajkit]

https://t.co/SSx36NmCuo

[nt!RajKit @NtRajkit]

@NinjaParanoid When the sensor needs a sensor.

[nt!RajKit @NtRajkit]

🐝 🪼 Analyzing the Pe-Sieve scan of the implant, I am working on every detail.

I am also getting good results from the SIEM in an environment with ElasticEDR.

On the other hand, later I want to offer live demonstrations of the complete system to show the key details of its architecture.

Long live for the position independent shellcode modules system!!!

[nt!RajKit @NtRajkit]

@MrT4ntr4 @mooofinnn thanks for share!! long live the heaps 🤟

[nt!RajKit @NtRajkit]

Interesting! I remember trying ByePg about three or four years ago and reversing the whole flow, from the point where the system saved the context and started preparing for the bug check through KeBugCheck2, HalPrepareForBugCheck, and HalPrivateDispatchTable. By hooking the latter and restoring the saved context, you could actually prevent the BSOD in loop. Back in the K-dog days 🐶

[nt!RajKit @NtRajkit]

🥷🏿 🧪 Been a while since I came across a reversing find this hard. @_CPResearch_ . Thanks for share!!

[Check Point Research @_CPResearch_]

⚒️ BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive

⚠ Trusted Remediation Primitives with Undocumented Internals.
🔓 15+ years. Unchanged. Unblockable.
🤔 What if an attacker learned its language? We did.

👇
https://t.co/AICs7JCI4d

[nt!RajKit @NtRajkit]

@co11ateral 🥷🏿 dope!

[nt!RajKit @NtRajkit]

https://t.co/TxMrYHUncm

[nt!RajKit @NtRajkit]

🔬 Researching EDR telemetry and correlations around a PIC implementation of ResetNightmare using @elasticseclabs.

[nt!RajKit @NtRajkit]

https://t.co/LW3sJjhL58

[Nicolas Krassas @Dinosn]

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive https://t.co/oFL9mxp6lh