Understanding Stealerium Malware and Its Evasion Techniques https://www.uptycs.com/blog/understanding-stealerium-malware-and-its-evasion-techniques
Uptycs
Understanding Stealerium Malware and Its Evasion Techniques
We observed an increase in promotion of Stealerium on hacker forums. This malware is used by cybercriminals focused on stealing account credentials.
Where there is love, there is ...malware?
Analyzing an undetected persistent macOS updater https://objective-see.org/blog/blog_0x72.html
Analyzing an undetected persistent macOS updater https://objective-see.org/blog/blog_0x72.html
objective-see.org
Where there is love, there is ...malware?
Analyzing an undetected persistent macOS updater
LokiBot packer analysis https://uint8ptr.github.io/posts/lokibot-packer/
uint8ptr.github.io
LokiBot packer analysis
Summary File type: Win32 EXE Size: 276.992 bytes MD5: 17a062692257bfe27e95a64a9e4e6a65 SHA1: 6580ac9fb2f54376ba1bea40f6339662dd1c76ab SHA256: faa18e54f144e8377cc6492f1daabeed658d4c2fbfdbdaf3caec6f5188c95ac9 This sample is a packed version of LokiBot. This…
C99Shell-PHP7 - PHP 7 And Safe-Build Update Of The Popular C99 Variant Of PHP Shell https://www.kitploit.com/2023/02/c99shell-php7-php-7-and-safe-build.html
KitPloit - PenTest & Hacking Tools
C99Shell-PHP7 - PHP 7 And Safe-Build Update Of The Popular C99 Variant Of PHP Shell
cURL audit: How a joke led to significant findings https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/
The Trail of Bits Blog
cURL audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually…
Server-side prototype pollution: Black-box detection without the DoS https://portswigger.net/research/server-side-prototype-pollution
PortSwigger Research
Server-side prototype pollution: Black-box detection without the DoS
Server-side prototype pollution is hard to detect black-box without causing a DoS. In this post, we introduce a range of safe detection techniques, which we've also implemented in an open source Burp
New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign https://blog.talosintelligence.com/new-mortalkombat-ransomware-and-laplas-clipper-malware-threats/
Cisco Talos
New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign
Since December 2022, Cisco Talos has been observing an unidentified actor deploying two relatively new threats, the recently discovered MortalKombat ransomware and a GO variant of the Laplas Clipper malware, to steal cryptocurrency from victims.
Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-1/
TimDbg
Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process
I’ve left the Microsoft Debugger Platform team twice, and each time I’ve started writing my own debugger. I must really like debuggers or something. This time, I have two reasons for writing a new debugger. The first is because I want to learn Rust better…
🤪2
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955 https://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955/
Decoder's Blog
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955
Summary A standard domain user can exploit Arbitrary File Write/Overwrite with NT AUTHORITY\SYSTEM under certain circumstances if Group Policy “File Preference” is configured. I reported this findi…
Bypassing Okta MFA Credential Provider for Windows https://www.n00py.io/2023/02/bypassing-okta-mfa-credential-provider-for-windows/
www.n00py.io
Bypassing Okta MFA Credential Provider for Windows
I'll state this upfront, so as not to confuse: This is a POST exploitation technique. This is mostly for when you have already gained admin on the system via other means and want to be able to RDP without needing MFA. Okta MFA Credential Provider for Windows…
Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/
STAR Labs
Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability
Introduction
I recently discovered a very interesting kernel vulnerability that allows the reading of arbitrary kernel-mode address. Sadly, the vulnerability was patched in Windows 21H2 (OS Build 22000.675), and I am unsure of the CVE being assigned to it.…
I recently discovered a very interesting kernel vulnerability that allows the reading of arbitrary kernel-mode address. Sadly, the vulnerability was patched in Windows 21H2 (OS Build 22000.675), and I am unsure of the CVE being assigned to it.…
Ghidra Golf: reverse engineering/forensics Capture The Flag event with focus on Ghidra Script development https://ghidra.golf/
Ghidra Golf
About
Website for Ghidra Golf
Tracing emails in Microsoft 365 with PowerShell https://4sysops.com/archives/tracing-emails-in-microsoft-365-with-powershell/
Malware Reverse Engineering for Beginners - Part 2 https://www.intezer.com/blog/incident-response/malware-reverse-engineering-for-beginners-part-2/
Intezer
Malware Reverse Engineering for Beginners - Part 2
As a reverse engineer, you need to understand how malware is packed, obfuscated, delivered, and executed on the endpoint.
CVE-2022-24942 Heap-based buffer overflow in Silicon Labs Gecko SDK https://bugprove.com/knowledge-hub/cve-2022-24942-heap-based-buffer-overflow-in-silicon-labs-gecko-sdk/
Hacking Apple: Two Successful Exploits and Positive Thoughts on their Bug Bounty Program https://blog.infiltrateops.io/hacking-apple-two-successful-exploits-and-positive-thoughts-on-their-bug-bounty-program-963efe7518f6
Escaping misconfigured VSCode extensions https://blog.trailofbits.com/2023/02/21/vscode-extension-escape-vulnerability/
The Trail of Bits Blog
Escaping misconfigured VSCode extensions
TL;DR: This two-part blog series will cover how I found and disclosed three vulnerabilities in VSCode extensions and one vulnerability in VSCode itself (a security mitigation bypass assigned CVE-2022-41042 and awarded a $7,500 bounty). We will identify the…
HTML Smuggling: Recent observations of threat actor techniques https://blog.delivr.to/html-smuggling-recent-observations-of-threat-actor-techniques-74501d5c8a06
Medium
HTML Smuggling: Recent observations of threat actor techniques
HTML smuggling isn’t a new technique by any means, but its utility and flexibility make it a potent technique that still proves effective…