BumbleBee: Round Two - In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector to deploy Cobalt Strike and Meterpreter.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
The DFIR Report
BumbleBee: Round Two
In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee has been identified as an initial access vector utilized by several ransomware affiliates. …
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV [PDF+EXPLOIT](https://github.com/Wh04m1001/ZoneAlarmEoP)
🗣soupcreamychicken
🎖@malwr
🗣soupcreamychicken
🎖@malwr
GitHub
GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV - GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV
Microsoft Shift F10 bypass + Autopilot privilege escalation
🗣k4m1ll0
Am i missing something, or could you just as easily pop out the harddisk and put it in another machine to remove the DisableCMDRequest.TAG file/do whatever you want?
👤Bl00dsoul
There are ways to disable it: https://call4cloud.nl/2022/01/the-oobe-massacre-the-beginning-of-shift-f10/
Another attack vector would be audit mode at beginning of setup. After creating admin accounts or whatever sysprep back to OOBE to continue with autopilot
👤HankMardukasNY
This vuln is fairly well-known in the Intune community, but mostly theoretical - great to see a writeup and full attack chain. Do you have any recommendations for mitigating it? I've focused on using preprovisioning to lock down the system and defaultuser0, but being able to alt-tab and modify system state at all seems like a huge attack surface
👤Pl4nty
🎖@malwr
🗣k4m1ll0
Am i missing something, or could you just as easily pop out the harddisk and put it in another machine to remove the DisableCMDRequest.TAG file/do whatever you want?
👤Bl00dsoul
There are ways to disable it: https://call4cloud.nl/2022/01/the-oobe-massacre-the-beginning-of-shift-f10/
Another attack vector would be audit mode at beginning of setup. After creating admin accounts or whatever sysprep back to OOBE to continue with autopilot
👤HankMardukasNY
This vuln is fairly well-known in the Intune community, but mostly theoretical - great to see a writeup and full attack chain. Do you have any recommendations for mitigating it? I've focused on using preprovisioning to lock down the system and defaultuser0, but being able to alt-tab and modify system state at all seems like a huge attack surface
👤Pl4nty
🎖@malwr
K4M1Ll0
Shift F10 bypass and Autopilot privilege escalation - Microsoft
Shift + F10 bypass and privilege escalation
👍1
Process Memory Basics for Reverse Engineers - Tracking Memory With A Debugger (OALABS Tutorial)
🗣herrcore
🎖@malwr
🗣herrcore
🎖@malwr
YouTube
Process Memory Basics for Reverse Engineers - Tracking Memory With A Debugger [ Patreon Unlocked ]
Full Patreon tutorial (with examples):
https://www.patreon.com/posts/process-memory-1-72454056
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
htt…
https://www.patreon.com/posts/process-memory-1-72454056
-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
htt…
Poseidon’s Offspring: Charybdis and Scylla - The attacks target a number of advertising SDKs within apps available via both Google’s Play Store and Apple’s App Store.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
HUMAN Security
Poseidon’s Offspring: Charybdis and Scylla - HUMAN Security
HUMAN's Satori Threat Intelligence and Research Team uncovered a network of 89 Android and iOS apps committing various flavors of ad fraud.
Tips and tricks for reversing foreign architecture games
🗣jeandrew
Um, no, the 6809 is not the same as m68k. The latter is the later 68000 series.
👤ohmantics
🎖@malwr
🗣jeandrew
Um, no, the 6809 is not the same as m68k. The latter is the later 68000 series.
👤ohmantics
🎖@malwr
mahaloz.re
Tips and tricks for reversing foreign architecture games
Some common techniques used while reversing unknown architectures seen through the lens of an 80's game hacking challenge from 0CTF22
Hardware encrypted usb suggestions??
What products are we using for hardware encrypted drives to move data around and store forensic data securely?
🗣dfzachary
I’ve used Aegis and SiForce. I much prefer the latter as they are more reliable and less prone to disconnection due to power consumption issues.
👤ucfmsdf
Apricorn Aegis Padlock drives are the best!
👤no_sushi_4_u
🎖@malwr
What products are we using for hardware encrypted drives to move data around and store forensic data securely?
🗣dfzachary
I’ve used Aegis and SiForce. I much prefer the latter as they are more reliable and less prone to disconnection due to power consumption issues.
👤ucfmsdf
Apricorn Aegis Padlock drives are the best!
👤no_sushi_4_u
🎖@malwr
reddit
Hardware encrypted usb suggestions??
What products are we using for hardware encrypted drives to move data around and store forensic data securely?
What’s In A Bit – Designing, Using And Reverse-engineering Binary File Formats - Peter Bindels
🗣mttd
🎖@malwr
🗣mttd
🎖@malwr
YouTube
What’s In A Bit – Designing, Using And Reverse-engineering Binary File Formats - Peter Bindels
C++ on Sea Website: https://cpponsea.uk/
C++ on Sea Twitter: https://twitter.com/cpponsea
---
What’s in a Bit – Peter Bindels - C++ on Sea 2022
Slides: https://github.com/philsquared/cpponsea-slides/tree/master/2022
Ever tried to create a .COM program by…
C++ on Sea Twitter: https://twitter.com/cpponsea
---
What’s in a Bit – Peter Bindels - C++ on Sea 2022
Slides: https://github.com/philsquared/cpponsea-slides/tree/master/2022
Ever tried to create a .COM program by…
Blue Team Lab guide 7 - End Devices
Hello everyone, after a small break I wrote another article in my series for Blue Team Home Lab, this time the focus was on end devices, that represent the corporate devices. Hope you'll like it. :)
https://facyber.me/posts/blue-team-lab-guide-part-7/
🗣facyber
🎖@malwr
Hello everyone, after a small break I wrote another article in my series for Blue Team Home Lab, this time the focus was on end devices, that represent the corporate devices. Hope you'll like it. :)
https://facyber.me/posts/blue-team-lab-guide-part-7/
🗣facyber
🎖@malwr
facyber
Building Blue Team Home Lab Part 7 - Corporate LAN (End Devices)
After a while, I returned with a new tutorial, a continuation of my Blue Team Home Lab series, and this time it’s about adding the end devices to our lab. For this part, we are going to use Windows 7 and Windows 10 evaluation images, which can be downloaded…