git-vuln-finder v1.3 released - a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
Release git-vuln-finder v1.3 released - bug fixes release · cve-search/git-vuln-finder
git-vuln-finder v1.3 released - bug fixes released.
git-vuln-finder is a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associ...
git-vuln-finder is a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associ...
Cronos: PoC for a new sleep obfuscation technique leveraging waitable timers to evade memory scanners - leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - Idov31/Cronos: PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.
PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners. - Idov31/Cronos
👍1
List of Free Cybersecurity Services and Tools curated by CISA
https://www.cisa.gov/free-cybersecurity-services-and-tools
🗣apes_2gether_strong
🎖@malwr
https://www.cisa.gov/free-cybersecurity-services-and-tools
🗣apes_2gether_strong
🎖@malwr
Cybersecurity and Infrastructure Security Agency CISA
No-Cost Cybersecurity Services & Tools | CISA
BumbleBee: Round Two - In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector to deploy Cobalt Strike and Meterpreter.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
The DFIR Report
BumbleBee: Round Two
In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee has been identified as an initial access vector utilized by several ransomware affiliates. …
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV [PDF+EXPLOIT](https://github.com/Wh04m1001/ZoneAlarmEoP)
🗣soupcreamychicken
🎖@malwr
🗣soupcreamychicken
🎖@malwr
GitHub
GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV - GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV
Microsoft Shift F10 bypass + Autopilot privilege escalation
🗣k4m1ll0
Am i missing something, or could you just as easily pop out the harddisk and put it in another machine to remove the DisableCMDRequest.TAG file/do whatever you want?
👤Bl00dsoul
There are ways to disable it: https://call4cloud.nl/2022/01/the-oobe-massacre-the-beginning-of-shift-f10/
Another attack vector would be audit mode at beginning of setup. After creating admin accounts or whatever sysprep back to OOBE to continue with autopilot
👤HankMardukasNY
This vuln is fairly well-known in the Intune community, but mostly theoretical - great to see a writeup and full attack chain. Do you have any recommendations for mitigating it? I've focused on using preprovisioning to lock down the system and defaultuser0, but being able to alt-tab and modify system state at all seems like a huge attack surface
👤Pl4nty
🎖@malwr
🗣k4m1ll0
Am i missing something, or could you just as easily pop out the harddisk and put it in another machine to remove the DisableCMDRequest.TAG file/do whatever you want?
👤Bl00dsoul
There are ways to disable it: https://call4cloud.nl/2022/01/the-oobe-massacre-the-beginning-of-shift-f10/
Another attack vector would be audit mode at beginning of setup. After creating admin accounts or whatever sysprep back to OOBE to continue with autopilot
👤HankMardukasNY
This vuln is fairly well-known in the Intune community, but mostly theoretical - great to see a writeup and full attack chain. Do you have any recommendations for mitigating it? I've focused on using preprovisioning to lock down the system and defaultuser0, but being able to alt-tab and modify system state at all seems like a huge attack surface
👤Pl4nty
🎖@malwr
K4M1Ll0
Shift F10 bypass and Autopilot privilege escalation - Microsoft
Shift + F10 bypass and privilege escalation
👍1
Process Memory Basics for Reverse Engineers - Tracking Memory With A Debugger (OALABS Tutorial)
🗣herrcore
🎖@malwr
🗣herrcore
🎖@malwr
YouTube
Process Memory Basics for Reverse Engineers - Tracking Memory With A Debugger [ Patreon Unlocked ]
Full Patreon tutorial (with examples):
https://www.patreon.com/posts/process-memory-1-72454056
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
htt…
https://www.patreon.com/posts/process-memory-1-72454056
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
htt…
Poseidon’s Offspring: Charybdis and Scylla - The attacks target a number of advertising SDKs within apps available via both Google’s Play Store and Apple’s App Store.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
HUMAN Security
Poseidon’s Offspring: Charybdis and Scylla - HUMAN Security
HUMAN's Satori Threat Intelligence and Research Team uncovered a network of 89 Android and iOS apps committing various flavors of ad fraud.
Tips and tricks for reversing foreign architecture games
🗣jeandrew
Um, no, the 6809 is not the same as m68k. The latter is the later 68000 series.
👤ohmantics
🎖@malwr
🗣jeandrew
Um, no, the 6809 is not the same as m68k. The latter is the later 68000 series.
👤ohmantics
🎖@malwr
mahaloz.re
Tips and tricks for reversing foreign architecture games
Some common techniques used while reversing unknown architectures seen through the lens of an 80's game hacking challenge from 0CTF22
Hardware encrypted usb suggestions??
What products are we using for hardware encrypted drives to move data around and store forensic data securely?
🗣dfzachary
I’ve used Aegis and SiForce. I much prefer the latter as they are more reliable and less prone to disconnection due to power consumption issues.
👤ucfmsdf
Apricorn Aegis Padlock drives are the best!
👤no_sushi_4_u
🎖@malwr
What products are we using for hardware encrypted drives to move data around and store forensic data securely?
🗣dfzachary
I’ve used Aegis and SiForce. I much prefer the latter as they are more reliable and less prone to disconnection due to power consumption issues.
👤ucfmsdf
Apricorn Aegis Padlock drives are the best!
👤no_sushi_4_u
🎖@malwr
reddit
Hardware encrypted usb suggestions??
What products are we using for hardware encrypted drives to move data around and store forensic data securely?
What’s In A Bit – Designing, Using And Reverse-engineering Binary File Formats - Peter Bindels
🗣mttd
🎖@malwr
🗣mttd
🎖@malwr
YouTube
What’s In A Bit – Designing, Using And Reverse-engineering Binary File Formats - Peter Bindels
C++ on Sea Website: https://cpponsea.uk/
C++ on Sea Twitter: https://twitter.com/cpponsea
---
What’s in a Bit – Peter Bindels - C++ on Sea 2022
Slides: https://github.com/philsquared/cpponsea-slides/tree/master/2022
Ever tried to create a .COM program by…
C++ on Sea Twitter: https://twitter.com/cpponsea
---
What’s in a Bit – Peter Bindels - C++ on Sea 2022
Slides: https://github.com/philsquared/cpponsea-slides/tree/master/2022
Ever tried to create a .COM program by…