Linux kernel exploit development tutorial
ChrisTheCoolHut published this tutorial as GitBook:
https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development
🗣linkersec
🎖@malwr
ChrisTheCoolHut published this tutorial as GitBook:
https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development
🗣linkersec
🎖@malwr
breaking-bits.gitbook.io
Linux kernel exploit development | Breaking Bits
Windows Defender AV allows Everyone to read the configured exclusions on the system 🤦
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s
🗣splinter_code
🎖@malwr
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s
🗣splinter_code
🎖@malwr
New #SysJoker backdoor targets Windows, Linux and macOS
Discovered during an active attack on a Linux-based web server
Linux and Mac versions are fully undetected in VirusTotal 🚷
http://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker
🗣IntezerLabs
🎖@malwr
Discovered during an active attack on a Linux-based web server
Linux and Mac versions are fully undetected in VirusTotal 🚷
http://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker
🗣IntezerLabs
🎖@malwr
Technical details on APT35 attempts to exploit Log4j vulnerability:
💣Both targeted attacks and mass-scanning
💎CharmPower: still-in-development Powershell-based modular toolkit
🧩Shared infrastructure with previous mobile and ransomware campaigns.
https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit
🗣_CPResearch_
🎖@malwr
💣Both targeted attacks and mass-scanning
💎CharmPower: still-in-development Powershell-based modular toolkit
🧩Shared infrastructure with previous mobile and ransomware campaigns.
https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit
🗣_CPResearch_
🎖@malwr
Malware development serie:
• https://0xpat.github.io/Malware_development_part_1/
• https://0xpat.github.io/Malware_development_part_2/
• https://0xpat.github.io/Malware_development_part_3/
• https://0xpat.github.io/Malware_development_part_4/
• https://0xpat.github.io/Malware_development_part_5/
• https://0xpat.github.io/Malware_development_part_6/
• https://0xpat.github.io/Malware_development_part_7/
• https://0xpat.github.io/Malware_development_part_8/
• https://0xpat.github.io/Malware_development_part_9/
🗣aas_s3curity
🎖@malwr
• https://0xpat.github.io/Malware_development_part_1/
• https://0xpat.github.io/Malware_development_part_2/
• https://0xpat.github.io/Malware_development_part_3/
• https://0xpat.github.io/Malware_development_part_4/
• https://0xpat.github.io/Malware_development_part_5/
• https://0xpat.github.io/Malware_development_part_6/
• https://0xpat.github.io/Malware_development_part_7/
• https://0xpat.github.io/Malware_development_part_8/
• https://0xpat.github.io/Malware_development_part_9/
🗣aas_s3curity
🎖@malwr
❤4🔥2👍1
Signed kernel drivers – Unguarded gateway to Windows’ core | WeLiveSecurity
https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
🗣tais9
🎖@malwr
https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
🗣tais9
🎖@malwr
Welivesecurity
Signed kernel drivers – Unguarded gateway to Windows’ core
ESET researchers look at malware that abuses vulnerabilities in kernel drivers and outline mitigation techniques against this type of exploitation
Anyone else aware that .asd files can contain macros? Literally just found out.
Added to Filesec:
https://filesec.io/asd
https://filesec.io/wbk
🗣mrd0x
🎖@malwr
Added to Filesec:
https://filesec.io/asd
https://filesec.io/wbk
🗣mrd0x
🎖@malwr
📦 EtwTi-Syscall-Hook
👤 NinjaParanoid
⭐ 79 (+15)
🗒 C
A simple program to hook the current process t...
https://github.com/paranoidninja/EtwTi-Syscall-Hook
🗣gh_trending_
🎖@malwr
👤 NinjaParanoid
⭐ 79 (+15)
🗒 C
A simple program to hook the current process t...
https://github.com/paranoidninja/EtwTi-Syscall-Hook
🗣gh_trending_
🎖@malwr
GitHub
GitHub - paranoidninja/Process-Instrumentation-Syscall-Hook: A simple program to hook the current process to identify the manual…
A simple program to hook the current process to identify the manual syscall executions on windows - paranoidninja/Process-Instrumentation-Syscall-Hook
[Tooling ⚔️] Updated DInjector with 'RemoteThreadKernelCB' technique for shellcode invocation by spoofing the fnCOPYDATA value in kernel callback table based on @SoumyadeepBas12’s gist. Thread execution via SendMessageA. Works for GUI processes ⚙️ https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThreadKernelCB.cs
🗣snovvcrash
🎖@malwr
🗣snovvcrash
🎖@malwr
Today's quick #malware analysis with #SecurityOnion: #TA551 / #SHATHAK / #IcedID / #BOKBOT pcap from 2022-01-06!
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-ta551-shathak_12.html
🗣securityonion
🎖@malwr
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-ta551-shathak_12.html
🗣securityonion
🎖@malwr
Here's a #dfir #malware analysis of the Dridex anti-analysis methods of obfuscating API calls with hashing and vector exception handling
#cybersecurity #infosec
https://www.0ffset.net/reverse-engineering/malware-analysis/dridex-veh-api-obfuscation/?s=09
🗣AGDCservices
🎖@malwr
#cybersecurity #infosec
https://www.0ffset.net/reverse-engineering/malware-analysis/dridex-veh-api-obfuscation/?s=09
🗣AGDCservices
🎖@malwr
0ffset Training Solutions | Practical and Affordable Cyber Security Training
DRIDEX: Analysing API Obfuscation Through VEH | 0ffset
DRIDEX is one of the most famous and prevalent banking Trojans that dates back to around late 2014. Throughout its improvement and variations, DRIDEX has been successful in targeting the financial services sector to steal banking information and crucial user…
I updated #IdaIFL plugin (v1.4.3): https://github.com/hasherezade/ida_ifl/releases/ - now you can load "*.imports.txt" report from #PEsieve into your IDB
🗣hasherezade
🎖@malwr
🗣hasherezade
🎖@malwr
🔍We publish 6⃣ #Yara rules to detect 🪓#HackTools that read / modify🖥️ #RDP system settings. The rules are deliberately not only limited to detect PE files since these modifications may also take place in scripts etc.
https://github.com/telekom-security/malware_analysis/blob/main/hacktools/hacktools.yar
#100DaysofYARA
- via @tbarabosch
🗣DTCERT
🎖@malwr
https://github.com/telekom-security/malware_analysis/blob/main/hacktools/hacktools.yar
#100DaysofYARA
- via @tbarabosch
🗣DTCERT
🎖@malwr