ADExplorerSnapshotβ€py updates:
- BloodHound 4.1+ output format support
- new output mode to dump all objects/attributes to NDJSON
https://github.com/c3c/ADExplorerSnapshot.py
π£c3c
π@malwr
- BloodHound 4.1+ output format support
- new output mode to dump all objects/attributes to NDJSON
https://github.com/c3c/ADExplorerSnapshot.py
π£c3c
π@malwr
GitHub
GitHub - c3c/ADExplorerSnapshot: ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHoundβ¦
ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-object dumping to NDJSON. - c3c/ADExplorerSnapshot
Bulk_extractor V2.0.0 is finished!
Download the current source code from GitHub.
I'm presenting at @The_AAFS in Seattle about the long process of "sharpening" this #DFIR tool.
https://github.com/simsong/bulk_extractor/releases/tag/v2.0.0
π£xchatty
π@malwr
Download the current source code from GitHub.
I'm presenting at @The_AAFS in Seattle about the long process of "sharpening" this #DFIR tool.
https://github.com/simsong/bulk_extractor/releases/tag/v2.0.0
π£xchatty
π@malwr
GitHub
Release bulk_extractor V2.0.0 RELEASE Β· simsong/bulk_extractor
Release 2.0.0 of bulk_extractor, a high-performance digital forensics tool that works like a "find evidence" button, pulling actionable intelligence out of disk images, files, memory dump...
I played Hayyim CTF because the organizers looked promising. There was a nice challenge to exploit a patched anti-virus and here's my write-up for it.
https://ptr-yudai.hatenablog.com/entry/2022/02/13/122744
π£ptrYudai
π@malwr
https://ptr-yudai.hatenablog.com/entry/2022/02/13/122744
π£ptrYudai
π@malwr
CTFγγγ
Writing Anti-Anti-Virus Exploit (AuViel - Hayyim CTF 2022) - CTFγγγ
Introduction I played Hayyim CTF 2022 with keymoon, st98, and theoremoon. We solved all pwn tasks there and stood the 3rd place. *1 There was a pwn challenge toβ¦
RE tip of the day: UPX structures are publically available, for example, https://buff.ly/3uAYU3L The most common ways how IoT malware authors modify them in samples is changing l_magic (UPX! signature) and p_filesize and p_blocksize fields
#infosec #malware #reverseengineering
π£re_and_more
π@malwr
#infosec #malware #reverseengineering
π£re_and_more
π@malwr
β€1
termshark: A terminal UI for tshark, inspired by Wireshark
βοΈ 6980
#golang
https://github.com/gcla/termshark
π£GolangRepos
π@malwr
βοΈ 6980
#golang
https://github.com/gcla/termshark
π£GolangRepos
π@malwr
GitHub
GitHub - gcla/termshark: A terminal UI for tshark, inspired by Wireshark
A terminal UI for tshark, inspired by Wireshark. Contribute to gcla/termshark development by creating an account on GitHub.
New blog post about analyzing a stealer distributed via MSI files! S/O to @MSAdministrator for helping me improve my MSI analysis game in a big way:
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
π£ForensicITGuy
π@malwr
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
π£ForensicITGuy
π@malwr
Tony Lambert
Analyzing a Stealer MSI using msitools
This post is dedicated to Josh Rickard (@MSAdministrator on Twitter) since his feedback on my blog posts has cut my triage time on MSI files down in a massive way! After writing an analysis of a MSI payload distributing njRAT, Josh hit me up on Twitter toβ¦
Abusing LNK "Features" for Initial Access and Persistence
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
π£CyberWarship
π@malwr
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
π£CyberWarship
π@malwr
VMProtect Devirtualization: An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x
https://github.com/JonathanSalwan/VMProtect-devirtualization
π£JonathanSalwan
π@malwr
https://github.com/JonathanSalwan/VMProtect-devirtualization
π£JonathanSalwan
π@malwr
GitHub
GitHub - JonathanSalwan/VMProtect-devirtualization: Playing with the VMProtect software protection. Automatic deobfuscation ofβ¦
Playing with the VMProtect software protection. Automatic deobfuscation of pure functions using symbolic execution and LLVM. - JonathanSalwan/VMProtect-devirtualization
π1
CinaRAT via HTML IDs; Protecting LSASS; Blocking Facebook Credential Exposure
https://i5c.us/p7878
π£sans_isc
π@malwr
https://i5c.us/p7878
π£sans_isc
π@malwr
Custom ReadMemory API x64 bit after @x86matthew's cool blogpost.
https://trickster0.github.io/posts/Custom-ReadMemory-API/
π£trickster012
π@malwr
https://trickster0.github.io/posts/Custom-ReadMemory-API/
π£trickster012
π@malwr
trickster0βs Nest
Custom ReadMemory API
After the great job and inspiration by x86matthew and his blogpost I decided to play with it as well for x64 bit. The NTAPI function in this method is RtlFirstEntrySList from ntdll.dll. Its definition like Matthew mentioned in his blog is similar like this:β¦
TECHNICAL MALWARE ANALYSIS: THE RETURN OF EMOTET
https://notes.netbytesec.com/2022/02/technical-malware-analysis-return-of.html
π£RempahRz
π@malwr
https://notes.netbytesec.com/2022/02/technical-malware-analysis-return-of.html
π£RempahRz
π@malwr
Netbytesec
Technical Malware Analysis: The return of Emotet
This post was authored by Taqi, Rosamira and Fareed. Overview NetbyteSEC malware analyst team has come across a Microsoft Excel document con...
So the first part of the blog post on OneDrive Logs (ODL) is finally posted, and so is the python script to parse it! π
and
https://www.swiftforensics.com/2022/02/reading-onedrive-logs.html
π£SwiftForensics
π@malwr
and
https://www.swiftforensics.com/2022/02/reading-onedrive-logs.html
π£SwiftForensics
π@malwr
Swiftforensics
Reading OneDrive Logs
Due to the popularity of OneDrive, it has become an important source of evidence in forensics. Last week, Brian Maloney posted about his res...
π1
π5π2π€―1
frida typescript trick : if you want to hook functions with reserverd names such as toString(), encode the string and get function with [""]
Instead of jsonObj.toString.implementation
use jsonObj[b64decode("dG9TdHJpbmc=")]
:D
π£0xabc0
π@malwr
Instead of jsonObj.toString.implementation
use jsonObj[b64decode("dG9TdHJpbmc=")]
:D
π£0xabc0
π@malwr
My write up for CVE-2021-43893, a vulnerability that allowed a remote attacker to upload files to a Domain Controller, just got posted π
https://www.rapid7.com/blog/post/2022/02/14/dropping-files-on-a-domain-controller-using-cve-2021-43893/
π£Junior_Baines
π@malwr
https://www.rapid7.com/blog/post/2022/02/14/dropping-files-on-a-domain-controller-using-cve-2021-43893/
π£Junior_Baines
π@malwr
Rapid7
Dropping Files on a Domain Controller Using CVE-2021-43893 | Rapid7 Blog
BigQuery SQL Injection Cheat Sheet
https://ozguralp.medium.com/bigquery-sql-injection-cheat-sheet-65ad70e11eac
π£tbbhunter
π@malwr
https://ozguralp.medium.com/bigquery-sql-injection-cheat-sheet-65ad70e11eac
π£tbbhunter
π@malwr
Medium
BigQuery SQL Injection Cheat Sheet
Last year, we (My researcher partner on this topic, Anil and me) and found a SQL injection vulnerability on a target at Synack which wasβ¦
dronesploit : Drone pentesting framework console : https://github.com/dhondta/dronesploit credits @alex_dhondt
π£binitamshah
π@malwr
π£binitamshah
π@malwr