ripits

Cyber Operations Tech

[ripits @ripits170]

@NoiceGuy_ We will have a 100 pop server up

[ripits @ripits170]

@NoiceGuy_ https://t.co/j9cNc218eA

[ripits @ripits170]

@dhh Amen

[PandaRE 🐼 🇺🇦 @PandaRE__]

One way to spot a malicious proxy DLL when there are over 20 DLLs in the folder and one of them is lying, under 60 seconds. Let's go 👇

1/ An unsigned DLL named like a Microsoft runtime (𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶.𝚍𝚕𝚕)? Open it in your favorite disassembler. Exports look normal. Now double-click any export, and you see:

𝚖𝚘𝚟 𝚛𝚊𝚡, 𝚌𝚜:𝚐𝚃𝚊𝚛𝚐𝚎𝚝
𝚓𝚖𝚙 𝚚𝚠𝚘𝚛𝚍 𝚙𝚝𝚛 [𝚛𝚊𝚡+𝟾𝟸𝟶𝚑]

Click another one, and it's the same thing. You see 291 exports but zero real code - every function is a forwarding address.

2/ Now check that table: 𝚐𝚃𝚊𝚛𝚐𝚎𝚝 in the .𝚍𝚊𝚝𝚊 section - it's zeroed on disk. Every export jumps through it, and the file has nothing in it. It stays empty until the DLL loads, then one function does 𝙻𝚘𝚊𝚍𝙻𝚒𝚋𝚛𝚊𝚛𝚢("𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶𝚊.𝚍𝚕𝚕") + 𝙶𝚎𝚝𝙿𝚛𝚘𝚌𝙰𝚍𝚍𝚛𝚎𝚜𝚜 a few hundred times.

And there it is: 𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶𝚊.𝚍𝚕𝚕 - the legitimate DLL in the same folder with one extra letter in the name. The fake DLL carries the real one's name and forwards every call to it.

The 60-second checklist:

☑️ DLL named like a Microsoft runtime (𝚌𝚘𝚗𝚌𝚛𝚝𝟷𝟺𝟶.𝚍𝚕𝚕), but wait, Microsoft didn't sign it
☑️ all exports share one identical code stub
☑️ jump table zeroed on disk
☑️ a second DLL with the same name + one extra letter

[Panos Gkatziroulis 🦄 @ipurple]

Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust https://t.co/9c0Nm56xty

[ripits @ripits170]

Wardogs needs platoon voip @WARDOGS @Brammflakes

[ripits @ripits170]

@Brammflakes Fire and arrow and see how far it goes ..

[ripits @ripits170]

https://t.co/VU38jUD7kx

[ripits @ripits170]

@5mukx @zerotracelab How long you been working on this? Looks pretty good.

[ripits @ripits170]

@IntCyberDigest AUR may need to change

[ripits @ripits170]

@0xTib3rius I had claude hook up to my strava MCP and help me design a workout plan for a half marathon. The subtle life improvements..

[ripits @ripits170]

Which of these potato 's are the best for Windows privesc?

#privesc #cyber #redteam

[4mat.spinning cat @i4mat]

👀
#DataCenters

[ripits @ripits170]

@brrtxd @SilkOCE @Brammflakes

[ripits @ripits170]

@Brammflakes @Pornhub @CallofDuty @WARDOGS @Battlefield Wardogs kissing when

[ripits @ripits170]

@AnthonyLee59 @WARDOGS @xQc There is joystick support

[ripits @ripits170]

@L0SSY @GhostGamingG @WARDOGS My crash was due to a driver cpuz170 I think other people are mentioning inpoutx64 as another conflicting driver

[ripits @ripits170]

@Brammflakes @WARDOGS
Pre-ordered and downloaded beta but it crashes immediately.

[ripits @ripits170]

@0xTib3rius If you have an NVIDIA GPU I use Nvidia Broadcast. Me and my wife work right next to each other and it works great.