safe

Red Team Operator

[safe @safe0x17]

I'm excited to share 𝗥𝘂𝘀𝘁𝗶𝗰𝟲𝟰. A Modern 64-bit 𝗣𝗼𝘀𝗶𝘁𝗶𝗼𝗻-𝗜𝗻𝗱𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝘁 Shellcode Template for 𝗪𝗶𝗻𝗱𝗼𝘄𝘀, written 𝗶𝗻 𝗥𝘂𝘀𝘁!

#rustlang #CyberSecurity #redteam

https://t.co/SF87YMJJrZ

[safe @safe0x17]

@_Kudaes_ Appreciate it! Really like the approach with litcrypt2_nostd; it can also be combined with ollvm

[safe @safe0x17]

I'm excited to share 𝗥𝘂𝘀𝘁𝗶𝗰𝟲𝟰. A Modern 64-bit 𝗣𝗼𝘀𝗶𝘁𝗶𝗼𝗻-𝗜𝗻𝗱𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝘁 Shellcode Template for 𝗪𝗶𝗻𝗱𝗼𝘄𝘀, written 𝗶𝗻 𝗥𝘂𝘀𝘁!

#rustlang #CyberSecurity #redteam

https://t.co/SF87YMJJrZ

[vx-underground @vxunderground]

Mildly irritating things seen by malware nerds:

- Person saying {thing} evades EDR and/or AV, but they've never performed against an enterprise environment with an active Blue Team (they don't know what they're talking about). Yes, your payload avoided basic analysis, but stop disrespecting Blue Team nerds, you're seriously under estimating them.

- Person saying {language} is superior to {other language} for malware development. This is like watching Linux nerds argue about distros

- Person saying their malware is FUD. It is only undetected because you've successfully infected 4 machines running Windows 7. Large scale campaigns are difficult to run. Stop disrespecting reverse engineers. They're dealing with serious Threat Groups.

- Person saying {thing} is undetectable (in theory) because they've implemented over 9000 different evasion techniques. No, you've filled your binary with IOCs.

- Person dissing ransomware payloads, saying it is for noobs. This is both correct and incorrect. Writing single threaded ransomware is easy. Writing fast ransomware (thread pools, queuing, I/O completion ports) that can both encrypt and decrypt successfully regardless of file type and file size can be challenging.

- Anyone who references Mr. Robot when discussing malware.

[x86matthew @x86matthew]

I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. https://t.co/KbsWfdLT3D

Project:
https://t.co/xJvm24qqXv

[safe @safe0x17]

@fin3ss3g0d haha, maybe someday! 😉

[safe @safe0x17]

@enigmelo I based my work entirely on the public repository, glad you liked it!

[safe @safe0x17]

🦀 𝗥𝘂𝘀𝘁𝗣𝗼𝘁𝗮𝘁𝗼: A Rust implementation of 𝗚𝗼𝗱𝗣𝗼𝘁𝗮𝘁𝗼, abusing 𝗦𝗲𝗜𝗺𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘁𝗲 to gain SYSTEM privileges. Includes a TCP-based reverse shell and indirect NTAPI for various operations.

https://t.co/ue0V34GGWu

#redteam #ethicalhacking

[safe @safe0x17]

@Incubus0x4d thanks, really appreciate it!

[safe @safe0x17]

🦀 𝗥𝘂𝘀𝘁𝗦𝗼𝗹𝗶𝗹𝗼𝗾𝘂𝘆: Rust-based Internal-Monologue implementation for capturing NetNTLM hashes locally without touching LSASS. Using SSPI for NTLM negotiation and indirect NTAPIs for core operations.

https://t.co/TpjfJQtMiq

#redteam #ethicalhacking

[vx-underground @vxunderground]

Interesting things that happened lately:

October 31st: @safe0x17 released RustVEHSyscalls, a Rust port for LayeredSyscalls — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH

October 30th: @FeribHellscream released a paper on forming a shell company and attempting to purchase an EV code sign cert (it's not fun)

October 29th: @404mediaco received a leaked document from the largest New York hospital system — the document encourages physicians to use Artificial Intelligence to summarize clinical evaluations, diagnose medical issues, and parse health records

October 29th: @BratvaCorp noted based on the recent United States Department of Justice indictment of Redline information stealer developers — the authors of Redline connected to their platform from their home IP addresses and linked assets to their personal iCloud accounts.

October 27th: @MalDevAcademy released a proof-of-concept code illustration of extracting an encrypted and embedded PE file from a PNG file and executing it via a LNK file.

October 23rd: @SttyK released a talk on how he discovered North Korean state-sponsored spys on Discord.

October 22nd: @0gtweet released a paper on on how to read BitLocker numerical passwords via the Windows API.

October 22nd: @__mez0__ via @TrustedSec released a paper on malware development via the Groovy programming language and it's usage in network enumeration.

October 19th: @Hexacorn discovered a new malware persistence technique by abusing the UserInstStubWrapper API in advpacker.dll and IEAdvpacker.dll

October 18th: @Hexacorn notes the discovery of 'ClickedOnRAT' windows API function from Windows XP. It's not related to malware, the API name is silly and misleading.

October 18th: @Hexacorn unveiled a prankware technique by abusing NdfRunDllDuplicateIPDefendingSystem and NdfRunDllDuplicateIPOffendingSystem

[safe @safe0x17]

🦀 𝗥𝘂𝘀𝘁𝗩𝗘𝗛𝗦𝘆𝘀𝗰𝗮𝗹𝗹𝘀: a Rust port of 𝗟𝗮𝘆𝗲𝗿𝗲𝗱𝗦𝘆𝘀𝗰𝗮𝗹𝗹 that performs indirect syscalls while generating legitimate API call stack frames by abusing VEH, bypassing user-land EDR hooks in Windows.

https://t.co/KndPJrF1ZE

#RedTeam #EthicalHacking

[safe @safe0x17]

🦀 RustiveDump can now be compiled 𝗮𝘀 𝘀𝗵𝗲𝗹𝗹𝗰𝗼𝗱𝗲 (𝗣𝗜𝗖) using the 𝗥𝘂𝘀𝘁𝗶𝗰𝟲𝟰 𝗱𝗲𝘀𝗶𝗴𝗻. LSASS memory dumper using only 𝗡𝗧 𝗔𝗣𝗜𝘀, supporting 𝗫𝗢𝗥 and 𝗿𝗲𝗺𝗼𝘁𝗲 𝘁𝗿𝗮𝗻𝘀𝗺𝗶𝘀𝘀𝗶𝗼𝗻.
#redteam #ethicalhacking

https://t.co/NF3DJElkgH

[safe @safe0x17]

@C5pider Thanks a lot!!

[safe @safe0x17]

🦀 Introducing 𝗥𝘂𝘀𝘁𝗶𝘃𝗲𝗗𝘂𝗺𝗽—LSASS memory dumper in pure Rust, using 𝗼𝗻𝗹𝘆 𝗡𝗧 𝗔𝗣𝗜𝘀, creating a 𝗺𝗶𝗻𝗶𝗺𝗮𝗹 𝗺𝗶𝗻𝗶𝗱𝘂𝗺𝗽 from scratch, with no std, no CRT, and just 𝟭𝟴𝗞𝗕!

https://t.co/NF3DJElS6f

#redteam #CyberSecurity

[Ebalo @ebalo_LTS]

Choosing the right #cybersecurity #certifications can feel like a maze 🧩. I’ve shared some #tips on how to avoid common pitfalls and align your #CertificationPath with your #CareerGoals. Check it out at https://t.co/WvUtG700bZ #InfoSec #CyberPath

[safe @safe0x17]

🚀 Just dropped Rustic64Shell—64-bit position-independent reverse tcp shell for Windows, built in Rust! 😎

https://t.co/7Egfip1ZbH

#RedTeam #EthicalHacking #CyberSecurity

[Ebalo @ebalo_LTS]

New on Medium: Analyzing the Rustic64 Project for building #Windows #Shellcode in #Rust. 🦀💻
Explore #PIC shellcode creation and dive into the code architecture!
Check it out here: 🔗 https://t.co/17skxEwvJl
#Cybersecurity #RustLang #MalwareDevelopment