Required Programming Concepts To Learn For Malware Analysts
🗣AGDCservices

This was a great read. Thanks for the link!
👤ready_delete


🎖@malwr

Reverse Engineering CTF Walkthrough - Evil Santa's Mysterious Box
Hello Everyone,


We (mainly just the founder WittsEnd2) are a new group looking to share our expertise on Reverse Engineering, Binary Exploitation, and Penetration Testing! Our primary focus is CTF Challenges, but we have plans related to other subjects. The goal is to give everyone the foundation to start their Cyber Security journey through CTFs, and build upon those foundational skills! Your cyber skills will improve significantly faster than WittsEnd2's video production skills (lol).


Our most recent video is a Reverse Engineering CTF Challenge walkthrough written by WittsEnd2 himself! Please let us know what you think and give us feedback! We want to use this feedback to help craft videos in the future. https://www.youtube.com/watch?v=\_9MvIsuA8Xo
🗣Ragnar-Security


🎖@malwr

Arbitrium RAT, Fully UnDetectable & Cross-platform (Android, Windows & Linux) Check it out
Github repo (I hope u give a star to the repo if u liked it): https://github.com/BenChaliah/Arbitrium-RAT

Demo video: https://youtu.be/7KlPPND2b0g

Arbitrium is a cross-platform is a remote access trojan (RAT), Fully UnDetectable (FUD), It allows you to control Android, Windows and Linux and doesn't require any firewall exceptions or port forwarding.

1. WebApp UI: 
2. HTTP proxy:
proxy.png
3. Powershell:
powershell.png
4. Port scanner:
portscan.png

It gives access to the local networks, you can use the targets as a HTTP proxy and access the router to which they're connected, discover local IPs and scan their ports. It also includes modules like Mimikatz, new modules can easily be added. In addition, if Arbitrium is used with a DNS spoofing software is can spread autonomously between devices. Arbitrium is a project of multiple components, built using Java, JS, C, Python, Cordova and VueJS.


it's Fully Undetectable: it not because iut's new but befause, first, the client doesn't listen to any port (more on that in the README.md in github), second, the clients also use simple tools such as netcat to run tasks.
Another feature:
Battery optimization / StealthMode : Unlike with Stock Android, customizations like MIUI by Xiaomi, EMUI by Huawei or Samsung's Android Pie ignore the permissions/exceptions given to an app by the user. So if you try to run an Android's trojan in the background, the moment the app start running frequent or heavy (in some cases even lightweight) tasks (example: sending requests periodically) it will be killed no matter what permissions the user grants, ths OS completely ignores the current settings, dontkillmyapp.com is an known website dedicated for this particular issue. Arbitrium Stealthmode offers a solution that keep ur app seamlessly running and always waiting for new instructions.

I hope u star it and share it
🗣hdellagi

full undetectable for couple hours
👤visually_cool

>FUD

Windows Client:

PyInquirer been present is an IOC

Python 3.6 been present is an IOC

WinRAR been present is an IOC

Network traffic out and in from/to the control server is an IOC

Process existing / child process spawning is an IOC,

RAT doesn't claim to be ephemeral/Diskless etc or hide inside another process, persistence looks like it would leave artifacts aswell due to dependency list

>Doesn't require a firewall rule

Block by default says hello


"Fully Undetectable" is a massive overstatement

This shit may not even work at all in a sanely secured system if script signing is enforced.
👤BeardedCuttlefish

thought you were actually serious, then i saw that its made in python. Who makes a rat in python??!!
👤RLinux12


🎖@malwr

On AV signature reversing (and its ethical implications)
🗣hellorccie

The paper is quite dated, and does not strictly address ethics, but it seems relevant and, as prior googling suggested, it wasn't posted here already.

Now to what I mean, more specifically, by ethical implications. As you may know, ZDI offers money, generally on the same range as vendors of the vulnerable software, for vulnerability information. And as they point out, this information eventually (that is, a few months later) reaches said vendors. Bear in mind that, even for vulnerabilities officially sold as weaponry, 6 months is a petty good longevity. In the meantime, "encrypted" information about the vulnerability is shipped to some clients as part of a subscription. Officially, it is claimed this information is meant solely for defensive purposes, but as the paper demonstrates, as far as ~~2012~~ 2007, it was not difficult to reverse, and then weaponise. I do not personally have the money (or skills) to check if it still is the case, but I think it is likely. After all, given the prevalence of vulnerabilities, even in recent quality software, and accounting for rediscovery, the subscription is of little usefulness for defense. It does, however, make much more sense as an 0day cartel plan, whereby the most economically viable way to protect yourself against ZDI subscribers is to become one.

Moral of the story, don't trust ZDI, and next time someone says they're ethical, give them a good laugh, and refer them to the article.
👤hellorccie


🎖@malwr

Test a TLS server: check the security of your SSL/TLS services
🗣dr_fogs

Do it yourself - https://github.com/F5-Labs/cryptonice
👤dunsany

Looks like a UI to testssl.sh ( it is mentioned at the bottom to be based )
👤rathaus

https://www.ssllabs.com/ssltest/
👤kaipee


🎖@malwr

Threat Intelligence from Honeypots
I've tried googling for this but it just shows me how I can setup my own Honeypots, which I'm tempted to do. Is there a way I can view data from other people's Honeypots? I'd be interested to see what vulnerabilities are being exploited right now (i.e. CVEs), what the sources are (region) and how often. Does anything exist like this?
🗣InternalCode

I don't think private companies would be willing to fork over some info about their honey pots, however, you could find a friend or student for sure.
👤TheBaldTech58

honeydb.io and badpackets.net come to mind
👤1128327

I don't think there is an incentive for others to provide you their raw data.

Unit 42 from Palo Alto will publish data that they obtain via their honeypots, but I don't think that is what you're after.

Black Hills will do a lot of honeypot education, as they are very strong in active defense.


Not pissing on your campfire, just drawing your attention to the biz. Much of their methodology is proprietary and they don't want you learning it since its their business.
👤ajay63


🎖@malwr

Determining VueScan's autofocus is nonfunctional using a shared library shim
🗣freezway

Uh, flatbed scanners don't have variable focus - because the scanned item is in a fixed location -- pressed against the glass.

The focus feature works on scanners that have variable focus -- like Nikon 35mm negative & slide scanners.
👤PsychYYZ


🎖@malwr

Prelude Operator is a new free/open-source red team platform, built as a desktop C2. It is heavily supported & community-driven. Main goal is to train IT/InfoSec/DevOps/blue teams to conduct their own security assessments. There is even open-source (free) "in person" training...
🗣privat3duck3y

It seems when you run the Electron app you're greeted with a requirement to provide an email address. After providing it you receive a password that essentially gives you access to the application and it's inner functions.

I may be missing something but there doesn't seem to be any source code available for the Electron app or back-end application server in your Github repository. The only things I can find are the procedures/TTPs, pneuma (c2 agent) and operator-support which contains YAML and HTML files that do not appear to be electron client related. The latter is also described as shown below:

> This repository is a public spot to report issues and request features.

If I'm correct and you can't truly self-host Prelude, it seems like the only thing opensource about this project is the procedures. It feels like you're trying to benefit from the community for a massive part of what makes Prelude function (the plugins) without giving back with the meat of the project.

If I'm wrong I'm happy to update this comment, I just don't understand how based on the above Prelude as a solution can be considered opensource. In summary, I think it's misleading to advertise it as opensource if only a subsection of it is.
👤Top-Brilliant-8

This looks really interesting. Your docs also lead me to the blog, which has some really great content that I'm working through now. Very cool stuff all around, thank you for sharing!
👤initstring


🎖@malwr

Sailing Past Security Measures In AD
🗣The-Luemmel

Nice
👤Dmcxblue

Nice write up!
👤biglib

Thanks for this post, very informative :)
👤GameNCode


🎖@malwr

🚨 CVE-2020-7343
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.

🎖@cveNotify