Recaf 2.X: The modern Java bytecode reversing tool
🗣PartOfTheBotnet

Looks really nice will have to try it out!
👤j_rapp

Hello again /r/ReverseEngineering its been over a year since I last shared my pet project, Recaf. Since then it has been almost completely re-written and is continues to make improvements upon what a reversing tool should provide.

2.X aims to make reverse engineering as user friendly as possible. How so? Here's the gist:

1. Automatic compiler integration
- Dependencies pulled from your current workspace (primary file plus any libraries)
- Can't find a dependency? Don't worry, Recaf will dynamically generate missing code for you via JPhantom. That's right, you don't even need to specify your missing compile dependencies.
2. Text based bytecode assembler with user friendly features
- Reference variables not by their index but by their source-code name for maximum legibility
- Write short bytecode snippets as plain old Java source code, Recaf will translate inline expressions for you
- See what values are on the stack and in your local variables at any point by selecting the line
- Verify all your modifications on the fly to prevent time-wasting mistakes
3. Multiple class representations, defaulting to decompiled code
- View the class in one of 3 decompilers, CFR, FernFlower, or Procyon
- Context sensitive right-click actions on source code elements
- Automatically suggest switching decompilers when errors occur in current one
- Code too obfuscated? Change the class representation to a table to show fields, methods, and class attributes in an organized table while retaining all the context sensitive menu actions
4. Highly configurable search
- Search for string constants by containment, equality, starts-with, ends-with, or regex
- You can do the same search types with member references
- You can also do the same for disassembled instruction text
5. Track changes per each class modified with the ability to revert to a prior state at any time
6. Apply mappings to an obfuscated file from a variety of popular mapping formats
7. Drag tabs to other windows for duplicate views that can be swapped out (Compare decompilers, switch one tab to table mode, etc)

More info on the documentation page: https://www.coley.software/Recaf-documentation/

And beyond those points, there's a lot more planned for the future.

I'm always looking for suggestions and bug reports, so do feel free to drop a comment.

Happy reversing and merry Christmas o/
👤PartOfTheBotnet


🎖@malwr

Various Visual Basic Macros-based Remote Code Execution techniques to get meterpreter invoked on the infected machine.
🗣digicat

It blows my mind that macros are still enabled by default.

A while back I walked into an organisation that had ongoing issues with ransomware. They got to call it "ransomware Friday" because of how common it was. They haven't had an incident in three years and I made the only change they had budget for - disable macros by GPO.
👤disclosure5


🎖@malwr

Threat Intelligence Feeds - threatview.io
Hello All,

In an effort to give back to the information security community, SOC Teams and DFIR folks, I have strated a portal for providing free threat intelligence feeds.

Currently published feeds contains malicious- Domains, IP, Bitcoin addresses, MD5 Hash, SHA Hash etc. collected from top blocklists, honeypots, pastebins etc. Feeds includes IOC for recent Sunburst/ Solarwinds incident.

Queries, Advise, Collaboration opportunities and IOC's are welcome - m@threatview.io

>> Threatview.io <<
🗣MohitK_

I'd love to get in touch with you.
👤indonemesis


🎖@malwr

Faking a JARM signature by replaying TLS Server Hello's
🗣Robbedoes_

This was actually a pretty slick writeup. I enjoyed the use cases mentioned in the article:

>They could be used by malicious actors to hide their applications when tools like JARM scanners are deployed to identify services in a network or on the internet. It can also be used for good. A honeypot replaying the fingerprint of a specific service can be used to setup a digital smokescreen for attackers.
👤-SnowBl1nd-


🎖@malwr

Microsoft Defender for Identity: ADFSDump
Microsoft updated Microsoft Defender for Identity to detect the ADFSDump tool’s use, which was the initial tool used in the Solorigate campaign. This blog post will describe what the attack does and bypass Microsoft Defender for Identity detection using a tool I have written, including mitigation to the attack.

https://thalpius.com/2020/12/28/microsoft-defender-for-identity-adfsdump/

&#x200B;

P.s. Don't forget to join the Discord server.
🗣thalpius


🎖@malwr

Reverse Engineering Source Code of the Biontech Pfizer Vaccine: Part 2
🗣ASIC_SP

I don't understand shit, but it's an interesting read
👤the_dancing_squirel

Wouldn't have this problem if people weren't neurotic to germs. That's why we have an immune system and it needs practice.


Now, it seems like the only practice our immune system gets is from VSCode, JavaScript, and Electron. No wonder why covid turned our vital organs into liquid shit.
👤IamRudeAndDelusional


🎖@malwr

(anti-forensics) What's the best way to physically destroy data on a device
So, I have some drives that I want to physically destroy. I've read up on it a bit but the links mentioned like this one are no longer valid and I'm worried that with advancements in forensics or hard drive construction, that the methods are no longer viable.

What is the best way to 100% ensure the destruction of a hard drive (desktop and laptop)? What would be the quickest way? and would this change based on if it were a HDD or USB? (if I wanted to do like an average sandisk USB or phone, would that change anything in the process?
🗣Early-Winner9849

Throw it in a volcano.
Or lunch it to the sun.
Or use DBAN with 7 passes.
Most fire and explosion are not good. Many HDD could be, theoretically, partially recovered by LEA and military, although I read those cases are from '80s or '90s. Many says that physical recovery with broken disks is pretty much impossible since 2000 because HDD are much more dense.
There ie no point in physical destruction if you encrypt.
Encrypt + DBAN
the only fail I can imagine is firmware trojan.
👤Redfruitz

Destroying the drive assuming it was not uploaded to the cloud or anything is the only real method. It really depends on your situation.

Theoretically if you were under investigation and wanted to destroy the data, you're fucked. Every method is pretty obvious to the investigators to be expunging of evidence and it will be assumed it says whatever your investigators claimed it did by the court and submitted as evidence (and an extra charge or 3) generally.

If it's just embarrassing data or passwords or even card numbers encrypting and formatting the driver or downloading one of the programs meant specifically for that come to mind.

If it's enterprise stuff where you potentially actually have trade secrets at stake, just destroy the drive as best you can then see to it that the garbage trucks picks it up.
👤ruskyon

A plastic bucket and 18 molar H2SO4.
👤pogidaga


🎖@malwr

Bypass Windows protection mechanisms & Playing with OffensiveNim
🗣S3cur3Th1sSh1t

Good writeup! There are things in here I know a lot of companies would want to take a look at for their own security.
👤PwnistryCR

Java strikes again lol
👤cluberti

This is a great explanation. Really great work so thank you!
👤flani00


🎖@malwr

Monitoring with PowerShell: Monitoring Storage Sense
Hi all,

First off; I wish you all the best for the coming year. May it be filled with a 100% increase in MRR, no security incidents and lot's of easy clients.

As the year is ending I figured to release some blogs I still had waiting, this one is about StorageSense. Storage Sense is a sort of automated disk cleanup that works a lot more efficient than the standard disk cleanup. The blog can be found here https://www.cyberdrain.com/monitoring-with-powershell-monitoring-storage-sense-settings/.

Best wishes to you all! :)
🗣Lime-TeGek

I currently deploy storage sense settings via GPO but I’ve been working on ways to monitor this and other things that probably require impersonation. Maybe even something older like like folder redirection status.

I’m a little concerned about deploying something like this via RMM and being dependent package repo. (Both having the module and taking supply chain into account)
Is there anyway repackage a module like this into a single script?
👤mspit

2 two many doors. Nice ride.
👤Gatorvw

This is great. Thanks!
👤pinncomp


🎖@malwr