Вариант, как сделать "гдбшные хуки" в windbg
Печатаем строку-название файла, которая передаётся в CreateFile
Печатаем строку-название файла, которая передаётся в CreateFile
bp kernel32!CreateFileW ".echotime; .echo====================; du rcx; g"
❤🔥1
Reverse Dungeon
Setup среды для ядерной отладки Дебаг десятки: install sdk: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk на debuggee: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 .\kdnet.exe 192.168.0.1 (host addr) Получаем такую строчку:…
myworkspace1.WEW
1.5 KB
мой workspace для windbg
❤1
CVE-2018-8611 Exploiting Windows KTM
https://research.nccgroup.com/2020/04/27/cve-2018-8611-exploiting-windows-ktm-part-1-5-introduction
https://research.nccgroup.com/2020/05/04/cve-2018-8611-exploiting-windows-ktm-part-2-5-patch-analysis-and-basic-triggering
https://research.nccgroup.com/2020/05/11/cve-2018-8611-exploiting-windows-ktm-part-3-5-triggering-the-race-condition-and-debugging-tricks
https://research.nccgroup.com/2020/05/18/cve-2018-8611-exploiting-windows-ktm-part-4-5-from-race-win-to-kernel-read-and-write-primitive
https://research.nccgroup.com/2020/05/25/cve-2018-8611-exploiting-windows-ktm-part-5-5-vulnerability-detection-and-a-better-read-write-primitive
https://research.nccgroup.com/2020/04/27/cve-2018-8611-exploiting-windows-ktm-part-1-5-introduction
https://research.nccgroup.com/2020/05/04/cve-2018-8611-exploiting-windows-ktm-part-2-5-patch-analysis-and-basic-triggering
https://research.nccgroup.com/2020/05/11/cve-2018-8611-exploiting-windows-ktm-part-3-5-triggering-the-race-condition-and-debugging-tricks
https://research.nccgroup.com/2020/05/18/cve-2018-8611-exploiting-windows-ktm-part-4-5-from-race-win-to-kernel-read-and-write-primitive
https://research.nccgroup.com/2020/05/25/cve-2018-8611-exploiting-windows-ktm-part-5-5-vulnerability-detection-and-a-better-read-write-primitive
NCC Group Research Blog
CVE-2018-8611 Exploiting Windows KTM Part 1/5 – Introduction
The first of five blog posts exploring the detailed exploitation of CVE-2018-8611.
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Только опубликовано крутое исследование по обходу методов анализа EDR на основе трассировки стека
https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/
#redtram #maldev
https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/
#redtram #maldev
0xdarkvortex.dev
Hiding In PlainSight - Proxying DLL Loads To Hide From ETWTI Stack Tracing
Dark Vortex provides various cybersecurity trainings, products and other services.
Forwarded from Ralf Hacker Channel (Ralf Hacker)
И ещё одно крутое исследование по обходу EDR!
(По утверждению автора: всех EDR)
https://0xdarkvortex.dev/hiding-in-plainsight/
#redteam #maldev
(По утверждению автора: всех EDR)
https://0xdarkvortex.dev/hiding-in-plainsight/
#redteam #maldev
0xdarkvortex.dev
Hiding In PlainSight - Indirect Syscall is Dead! Long Live Custom Call Stacks
Dark Vortex provides various cybersecurity trainings, products and other services.
Forwarded from greg0r0 life&work
Please open Telegram to view this post
VIEW IN TELEGRAM