Deciphering Ransomware in Virtual Machines
UEFI Reverse Engineering, Vulnerability Discovery, and Exploit Development: Part 0
Malware Analysis - ConfuserEx 2 Deobfuscation with Python and dnlib, BBTok Loader
Identifying Human-operated Ransomware through Windows Event Logs
APT-C-00 (OceanLotus) Dual Loader and Homologous VMP Loader
poc for CVE-2024-45383
Collection of Docker honeypot logs from 2021 - 2024
UEFI Reverse Engineering, Vulnerability Discovery, and Exploit Development: Part 0
Malware Analysis - ConfuserEx 2 Deobfuscation with Python and dnlib, BBTok Loader
Identifying Human-operated Ransomware through Windows Event Logs
APT-C-00 (OceanLotus) Dual Loader and Homologous VMP Loader
poc for CVE-2024-45383
Collection of Docker honeypot logs from 2021 - 2024
Low-Level Development on Retail Android Hardware - Reconnaissance and Prototyping a Bootloader
https://blog.timschumi.net/2024/10/05/lldorah-bootloader-prototype.html
https://blog.timschumi.net/2024/10/05/lldorah-bootloader-prototype.html
timschumi’s low-traffic blog
Low-Level Development on Retail Android Hardware - Reconnaissance and Prototyping a Bootloader
Many months ago, a slightly younger Tim thought that porting mainline Linux to his old Android phone for the purpose of experimentation would be a great way to pass time. (In hindsight it was, but not for the reasons imagined.)
VMK extractor for BitLocker with TPM and PIN
https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/
https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/
post-cyberlabs.github.io
VMK extractor for BitLocker with TPM and PIN
Jacky's privesc
LSASS memory dumper using only NTAPIs, creating a minimal minidump, built in Rust
https://github.com/safedv/RustiveDump
https://github.com/safedv/RustiveDump
GitHub
GitHub - safedv/RustiveDump: LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode…
LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode (PIC), supports XOR encryption, and remote file transmission. - safedv/RustiveDump
64-bit, position-independent implant template for Windows in Rust.
https://github.com/safedv/Rustic64
https://github.com/safedv/Rustic64
GitHub
GitHub - safedv/Rustic64: 64-bit, position-independent implant template for Windows in Rust.
64-bit, position-independent implant template for Windows in Rust. - safedv/Rustic64
FROM MOONLIGHT MAZE TO SOLARWINDS: HOW RUSSIAN APT GROUPS OPERATE?
https://jyx.jyu.fi/bitstream/handle/123456789/92296/1/URN%3ANBN%3Afi%3Ajyu-202312138287.pdf
https://jyx.jyu.fi/bitstream/handle/123456789/92296/1/URN%3ANBN%3Afi%3Ajyu-202312138287.pdf
Hacking the Cosmos: Cyber operations against the space sector
https://www.research-collection.ethz.ch/handle/20.500.11850/697348
https://www.research-collection.ethz.ch/handle/20.500.11850/697348
Sekai Ctf Windows Kernel challenge Process Flipper
https://nu1lptr0.github.io/2024/10/10/windows-kernel-challenge-process-flipper.html
https://nu1lptr0.github.io/2024/10/10/windows-kernel-challenge-process-flipper.html
nu1lptr’s Blog
Sekai Ctf Windows Kernel challenge Process Flipper
This blog post is about the windows kernel challenge that came in Sekai ctf 2024 organized by team Project Sekai. The author of this challenge is nyancat0131.The author has setup an incredible way to run this challenge which he has explained in this blogpost…
Exploiting AMD atdcm64a.sys arbitrary pointer dereference – Part 3
Living off Microsoft Copilot
hunt down APTs
eBPF Crash Course for Beginners
Exploiting Visual Studio via dump files - CVE-2024-30052
PowerShell Command History Forensics
chill kernel hacking for fun
Silently Install Chrome Extension For Persistence
Popping Android Vulnerabilities From Notification to WebView XSS
Reverse Engineering Android Spyware ...with LaurieWired
Материалы KLEE 2024 workshop (1,2)
Fuzzing and Symbolic Execution for Multipath Malware Tracing: Bridging Theory and Practice via Survey and Experiments
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
Living off Microsoft Copilot
hunt down APTs
eBPF Crash Course for Beginners
Exploiting Visual Studio via dump files - CVE-2024-30052
PowerShell Command History Forensics
chill kernel hacking for fun
Silently Install Chrome Extension For Persistence
Popping Android Vulnerabilities From Notification to WebView XSS
Reverse Engineering Android Spyware ...with LaurieWired
Материалы KLEE 2024 workshop (1,2)
Fuzzing and Symbolic Execution for Multipath Malware Tracing: Bridging Theory and Practice via Survey and Experiments
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
Security Analysis of WeChat’s MMTLS Encryption Protocol
Coverage-guided Fuzzing as Online Stochastic Control
Discover Microsoft Browser 0-DAY (CVE-2024-38178)
control over the Outlook desktop application and therefore to the emails configured in it (Github)
Let’s Clone a Cloner - Part 2: You Have No Power Here (hardware hacking)
persistence techniques for macOS
Attacking the Samsung Galaxy A* Boot Chain
Make Binwalk Fast Again - Rust Rewrite of Binwalk is in Beta
Coverage-guided Fuzzing as Online Stochastic Control
Discover Microsoft Browser 0-DAY (CVE-2024-38178)
control over the Outlook desktop application and therefore to the emails configured in it (Github)
Let’s Clone a Cloner - Part 2: You Have No Power Here (hardware hacking)
persistence techniques for macOS
Attacking the Samsung Galaxy A* Boot Chain
Make Binwalk Fast Again - Rust Rewrite of Binwalk is in Beta
Automating binary vulnerability discovery with Ghidra and Semgrep
https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/
https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/
HN Security
HN Security Automating binary vulnerability discovery with Ghidra and Semgrep
Introducing new binary vulnerability research tools and methodology, based on custom Ghidra plugins and Semgrep.
Linux kernel instrumentation from Qemu and Gdb
https://blog.quarkslab.com/linux-kernel-instrumentation-from-qemu-and-gdb.html
https://blog.quarkslab.com/linux-kernel-instrumentation-from-qemu-and-gdb.html
Quarkslab
Linux kernel instrumentation from Qemu and Gdb - Quarkslab's blog
Techniques for analyzing binaries or kernel modules that may try to monitor themselves, similar to malware behavior. To avoid detection during analysis, one approach is to use an hypervisor like QEMU to conduct research within a virtualized environment. Although…