How to monitor in real-time for SSH sessions
Blog post on how to monitor in real-time for SSH sessions: https://cryptsus.com/blog/ssh-security-siem-dashboard-kibana.html
🗣krabelize


🎖@malwr

Endpoint Discovery - Navigating your way through unmanaged devices
🗣digicat

This is pretty awesome.
👤m0wax


🎖@malwr

Disables the Windows Platform Binary Table (WPBT) in your firmware. This program use a non-permenant, non-destructive method to remove the table from system memory, so it should be executed every time the computer is rebooted before Windows bootloader starts. - sophisticated UEFI implant mitigation
🗣digicat

This would be such a pain in the ass to deploy on one machine, let alone an entire enterprise
👤edward_snowedin

>Because this feature provides the ability to persistently execute system software in the context of Windows, it becomes critical that WPBT-based solutions are as secure as possible and do not expose Windows users to exploitable conditions. In particular, WPBT solutions must not include malware (i.e., malicious software or unwanted software installed without adequate user consent).

Basically this is a catch-22 situation. This tablet could be used for legitimate purposes like loading antitheft software OR it could be used to load malware persistently
👤CrowGrandFather


🎖@malwr

Compromised Linux VM for DF training?
Does anyone have a vmdk of a compromised Linux host (perhaps from a Honeypot?) they'd be willing to share? I'd like to have my blue team try their hand at manual forensics as a table-top / Forensics Capture-the-Flag exercise

Plans:
\- Have them import it into Virtualbox (they all use Ubuntu as their workstations)
\- Browse around the host and see what they can find manually first
\- Utilize something like Plaso / log2timeline and import it into a log tool like Splunk
🗣AbracaBOOYAH

Not exactly what you are looking for but I was just at a competition last week and it had some forensic CTFs. Found them here, might be what you are interested in.
👤AppCompatCache-SI-TS

Just infect a Linux vm
👤Stofers

The Great Hal Pomeranz made a course, with resources from Ali Hadi/Champlain College, that might help you out:
https://archive.org/download/HalLinuxForensics
https://github.com/ashemery/LinuxForensics
👤awk_warden


🎖@malwr

[Video Makop Ransomware - Decrypting the Encrypted Section](https://youtu.be/mlIRoGrxrmA)
🗣Struppigel


🎖@malwr

Getting Started Reverse Engineering Bare Metal Kernel Images - (Part 1/Setup) | This is a series, more will be released soon.
🗣ragnarsecurity

Arent all kernels bare metal kernels? Iv not seen one that is specifically designed to run in a VM. I dont doubt that one may exist, but ive never seen one.
👤AllenKll

Hey man, good write up :)

Can I ask what do you refer to as a "kernel"? In my experience, kernel is generally only used to refer to a component of an OS.

I'd generally describe a bare metal firmware as having no kernel. And the built application is just a binary, or a firmware image.
👤Palantir555


🎖@malwr

List of Popular Applications that use the `--no-sandbox` flag when running Chromium and Chrome based Applications and may expose users to RCE vulnerabilities.
🗣docker-osx

This is literally just a list of Electron apps...

I'm not sure what "Untrusted desktop application without source code" has to do with sandboxing... if they wanted to give you malicious code, they don't need to use JS to do it. This feels like the author fundamentally doesn't understand the purpose of the sandbox and/or the security issues at hand.

Similarly with extensions, it seems pretty dumb to assume that a malicious extension in many of these applications wouldn't be able to cause damage regardless, especially considering that some of the extensions (e.g. for Teams, VSCode) are designed for performing file-system operations already.

It's also odd to me that this list doesn't separate what I would consider to be the biggest distinction for a discussion of sandboxing, which is whether or not the app renders web content from untrusted sources (e.g. chat rooms). I believe that would exclude VSCode, but would include Twitch, Slack, Signal, FBM, Teams, Discord, and Keybase. However, I don't think any of these intentionally accept arbitrary JS, so exploits still seem unlikely without some kind of additional XSS exploit.
👤thealliedhacker

PoC or GTFO
👤airza

What's the concern with Slack if it's sandboxed? That it's not open source?
👤hillgod


🎖@malwr

qrljacker for whatsapp
working program to generate a qrl code that when scanned, takes over somenes whatsapp session https://www.youtube.com/watch?v=TTf2MSPGuuA
🗣pwndbyqatux


🎖@malwr