Created a PoC for loading DLLs without LoadLibraryA. Instead we'll leverage the VEH (Vectored Exception Handler) to modify the context, especially RIP and RCX to hold the LoadLibraryA address and it's argument.
👉 Github project:
#CyberSecurity
#Infosec
wrapping things up with my hugo theme and post ideas, im happy with the minimal design as seen on (inspired by )
blog will be up at , ill make an announcement once it actually is in prod!!
merry christmas ^_^
POC for the silly shenanigans i talk about in my last blogpost can be found here
now working on a version that doesn't rely on NtContinue, as I now have an "agnostic" IOC for such chains; on top of implementing different ways to "flow" :)
nothing major but thought of it and decided to add support for json as a configuration language so people can choose whats up (i know some people love their nesting)
(cooler stuff to be announced soon enough xoxo)
time to get hyper super duper silly >:3
wont be recorded but ill upload the slides and make a more in depth blogpost on which will be the first one there !
(shall also come to Havoc as a build option in the implant , when possible :]] cc:
@C5pider
)
there is still some cool stuff to be said, ill blog about it after my talk (which is on the 19th, will also upload the slides); no spoilers till then however >:3
The last time I posted anything about sleep obfuscation because it is already sucked dry kek. this was just me trying out something and seeing if it was working.
my idea for tasking atm is pretty scuffed, have small tasks cached in memory and the bigger ones (anything beyond a certain size ie execute-assembly rubeus) be written to db, i guess disk I/O is cheaper than memory but dam
thanks to
@crackticker
the theme got fixed up a bit
the banner took it's meds aswell and wont blow up when you hover it either
not responsive but viewing it on phone isnt as horrible as it was an hour ago (can actually read the content, banner and images wonky tho)
xoxo
i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard i love patchguard
think imma start giving more updates about what im up to for the sake of hehe funny
lately went back to my c2 i started end of sept which i didnt touch for a month after i started my new job
@GabrielLandau
@jdu2600
first off, sorry gonna fix xD
the way you would go about this could still be detected however, I have some IOCs for FOLIAGE/EKKO/... I plan on releasing soon
but even then a second version of flower im working on will get around this.
cool work yet again, keep it up guys 😎
i have two server module ideas for beam (obfuscation and exploitation, those two could be use standalone too (yes im very bored))
what kind of server module would be useful in an engagement context (QoL and stuff)??? looking for more ideas atm :|
@h0mbre_
i think fnv1a is better than djb2 (way better distribution and slightly speedier), some dude benchmarked a lot of hash algos on stackoverflow you could take a look at that
ngl doubt it matters for you but could interest you :)
the more malleable i make my c2 the more TOML seems to be a poor choice if i still want to have something readable (no real indentation is backfiring) 😔😔😔
We just released Reflective Call Stack Detections and Evasions! This was co-authored by our
@XForce
Red intern Dylan Tran
@d_tranman
! Dylan is wicked smart and it was fun working with him! Check it out!🥷
going to redo and move my blog elsewhere and try to be more active with it (ie stop overthinking what would be really cool to the people)
that will be only when i get through making my own theme for it (5 eons ish)
New blogpost and small tool release: Wrote a naive anti-rootkit driver that detects mapped drivers, and talk about some bypasses for those detections in part I of my new (anti-)-anti-rootkit series.
More research on rootkit evasion coming soon : )
@0xclient
@domchell
mb, meant you can have proper proof of protection I guess, just not doing a file hash, posting it and @'ing literally everybody to stroke your e-wiener
thinking of adding separate engagement support (however i can say it waaaah) like how its done in mythic
do people actually enjoy/find practical such a feature ?
@C5pider
@ilove2pwn_
They're denying that allegation.
"No it's not true. It’s actually not that project at all that was used that he linked. The UEFI loader was pasted into the project originally. That is the UEFI code used."