A bunch of updates to REMnux today (see 🧵 for details). Run "remnux upgrade" to get them.
🗣REMnux
🎖@malwr
🗣REMnux
🎖@malwr
Process injection via the KernelCallBackTable involves replacing original callback function by custom payload so that whenever the function is invoked, payload will be triggered. In this case the fnCOPYDATA callback function has been used.
C# code snippet: https://gist.github.com/sbasu7241/5dd8c278762c6305b4b2009d44d60c13
🗣SoumyadeepBas12
🎖@malwr
C# code snippet: https://gist.github.com/sbasu7241/5dd8c278762c6305b4b2009d44d60c13
🗣SoumyadeepBas12
🎖@malwr
Token Universe is an advanced tool that provides a wide range of possibilities to research Windows security mechanisms. It has a convenient interface for creating, viewing, and modifying access tokens, managing Local Security Authority and Security Account Manager's databases.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - diversenok/TokenUniverse: An advanced tool for working with access tokens and Windows security policy.
An advanced tool for working with access tokens and Windows security policy. - diversenok/TokenUniverse
OpenDrop: An open Apple AirDrop implementation written in Python
https://github.com/seemoo-lab/opendrop
🗣newsycombinator
🎖@malwr
https://github.com/seemoo-lab/opendrop
🗣newsycombinator
🎖@malwr
GitHub
GitHub - seemoo-lab/opendrop: An open Apple AirDrop implementation written in Python
An open Apple AirDrop implementation written in Python - seemoo-lab/opendrop
Taking Water Cooler UX Into Your Own Hands With Ghidra
https://hackaday.com/2022/01/02/taking-water-cooler-ux-into-your-own-hands-with-ghidra/
🗣hackaday
🎖@malwr
https://hackaday.com/2022/01/02/taking-water-cooler-ux-into-your-own-hands-with-ghidra/
🗣hackaday
🎖@malwr
Hackaday
Taking Water Cooler UX Into Your Own Hands With Ghidra
Readers not aware of what Ghidra is might imagine some kind of aftermarket water cooler firmware or mainboard – a usual hacker practice with reflow ovens. What [Robbe Derks] did is no less im…
For the new year I started a new blog post series on HyperGuard: PatchGuard’s lesser-known sibling:
https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-1-skpg-initialization/
🗣yarden_shafir
🎖@malwr
https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-1-skpg-initialization/
🗣yarden_shafir
🎖@malwr
Happy New Year! 🎊🎈 🎉
Happy New Bug! 🐛🐜🐞
https://bugs.chromium.org/p/project-zero/issues/detail?id=2223
https://bugs.chromium.org/p/project-zero/issues/detail?id=2235
🗣natashenka
🎖@malwr
Happy New Bug! 🐛🐜🐞
https://bugs.chromium.org/p/project-zero/issues/detail?id=2223
https://bugs.chromium.org/p/project-zero/issues/detail?id=2235
🗣natashenka
🎖@malwr
I published a new blog post on “Automated RE of Kernel Configurations”:
This also includes the release of a new BN plugin (link in blog post).
https://zznop.com/2022/01/02/automated-re-of-kernel-build-configs/
🗣zznop_
🎖@malwr
This also includes the release of a new BN plugin (link in blog post).
https://zznop.com/2022/01/02/automated-re-of-kernel-build-configs/
🗣zznop_
🎖@malwr
Automated RE of Kernel Configurations
🗣zznop_
Pretty nice but seems to be somewhat manual process. I think somewhere on Twitter(?) I saw an idea of bruteforcing/bisecting the kconfig by building multiple variations of the kernel with different kconfig settings and comparing it against the image you have.
👤igor_sk
🎖@malwr
🗣zznop_
Pretty nice but seems to be somewhat manual process. I think somewhere on Twitter(?) I saw an idea of bruteforcing/bisecting the kconfig by building multiple variations of the kernel with different kconfig settings and comparing it against the image you have.
👤igor_sk
🎖@malwr
AccChecker LOLBIN [AccCheckConsole.exe - load a managed DLL](https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340)
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Gist
AccChecker LOLBIN [AccCheckConsole.exe]
AccChecker LOLBIN [AccCheckConsole.exe]. GitHub Gist: instantly share code, notes, and snippets.
WHAT?! 😂
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D
🗣0gtweet
🎖@malwr
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D
🗣0gtweet
🎖@malwr
Introducing inject-assembly! Execute a .NET assembly in any existing process, including your current Beacon, and retrieve the output!
- Patches Environment.Exit()
- PE header stomping
- Random pipe name generation
- No blocking of the current Beacon
https://github.com/kyleavery/inject-assembly
🗣kyleavery_
🎖@malwr
- Patches Environment.Exit()
- PE header stomping
- Random pipe name generation
- No blocking of the current Beacon
https://github.com/kyleavery/inject-assembly
🗣kyleavery_
🎖@malwr
GitHub
GitHub - kyleavery/inject-assembly: Inject .NET assemblies into an existing process
Inject .NET assemblies into an existing process. Contribute to kyleavery/inject-assembly development by creating an account on GitHub.
Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) (use translate if you cannot read the original)
https://github.com/alphaSeclab/awesome-reverse-engineering
🗣Dinosn
🎖@malwr
https://github.com/alphaSeclab/awesome-reverse-engineering
🗣Dinosn
🎖@malwr
GitHub
GitHub - alphaSeclab/awesome-reverse-engineering: Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT)…
Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) And Every Aspect! (More than 3500 open source tools and 2300 posts&videos) - alphaSeclab/awesome-rever...
🎉2