Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-1/
TimDbg
Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process
I’ve left the Microsoft Debugger Platform team twice, and each time I’ve started writing my own debugger. I must really like debuggers or something. This time, I have two reasons for writing a new debugger. The first is because I want to learn Rust better…
🤪2
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955 https://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955/
Decoder's Blog
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955
Summary A standard domain user can exploit Arbitrary File Write/Overwrite with NT AUTHORITY\SYSTEM under certain circumstances if Group Policy “File Preference” is configured. I reported this findi…
Bypassing Okta MFA Credential Provider for Windows https://www.n00py.io/2023/02/bypassing-okta-mfa-credential-provider-for-windows/
www.n00py.io
Bypassing Okta MFA Credential Provider for Windows
I'll state this upfront, so as not to confuse: This is a POST exploitation technique. This is mostly for when you have already gained admin on the system via other means and want to be able to RDP without needing MFA. Okta MFA Credential Provider for Windows…
Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/
STAR Labs
Trying To Exploit A Windows Kernel Arbitrary Read Vulnerability
Introduction
I recently discovered a very interesting kernel vulnerability that allows the reading of arbitrary kernel-mode address. Sadly, the vulnerability was patched in Windows 21H2 (OS Build 22000.675), and I am unsure of the CVE being assigned to it.…
I recently discovered a very interesting kernel vulnerability that allows the reading of arbitrary kernel-mode address. Sadly, the vulnerability was patched in Windows 21H2 (OS Build 22000.675), and I am unsure of the CVE being assigned to it.…
Ghidra Golf: reverse engineering/forensics Capture The Flag event with focus on Ghidra Script development https://ghidra.golf/
Ghidra Golf
About
Website for Ghidra Golf
Tracing emails in Microsoft 365 with PowerShell https://4sysops.com/archives/tracing-emails-in-microsoft-365-with-powershell/
Malware Reverse Engineering for Beginners - Part 2 https://www.intezer.com/blog/incident-response/malware-reverse-engineering-for-beginners-part-2/
Intezer
Malware Reverse Engineering for Beginners - Part 2
As a reverse engineer, you need to understand how malware is packed, obfuscated, delivered, and executed on the endpoint.
CVE-2022-24942 Heap-based buffer overflow in Silicon Labs Gecko SDK https://bugprove.com/knowledge-hub/cve-2022-24942-heap-based-buffer-overflow-in-silicon-labs-gecko-sdk/
Hacking Apple: Two Successful Exploits and Positive Thoughts on their Bug Bounty Program https://blog.infiltrateops.io/hacking-apple-two-successful-exploits-and-positive-thoughts-on-their-bug-bounty-program-963efe7518f6
Escaping misconfigured VSCode extensions https://blog.trailofbits.com/2023/02/21/vscode-extension-escape-vulnerability/
The Trail of Bits Blog
Escaping misconfigured VSCode extensions
TL;DR: This two-part blog series will cover how I found and disclosed three vulnerabilities in VSCode extensions and one vulnerability in VSCode itself (a security mitigation bypass assigned CVE-2022-41042 and awarded a $7,500 bounty). We will identify the…
HTML Smuggling: Recent observations of threat actor techniques https://blog.delivr.to/html-smuggling-recent-observations-of-threat-actor-techniques-74501d5c8a06
Medium
HTML Smuggling: Recent observations of threat actor techniques
HTML smuggling isn’t a new technique by any means, but its utility and flexibility make it a potent technique that still proves effective…
The blog post on our latest research is now live! We have developed a tool to improve the extraction of Windows modules using a single or multiple memory dumps https://reversea.me/index.php/module-extraction-dll-hijacking-detection-single-multiple-memory-dumps/ (short summary in the tweet: https://twitter.com/reverseame/status/1638516729310597124)
ICS and OT Vulnerabilities Analysis for 2022 https://claroty.com/resources/reports/state-of-xiot-security-2h-2022
Claroty
Report: State of XIoT Security: 2H 2022
Uncover the latest trends in the State of XIoT Security Report for 2H 2022. Discover the changing landscape of vulnerabilities in OT, IoT, and IoMT.
Raspberry Robin’s Roshtyak: A Little Lesson in Trickery https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/?s=09
Avast Threat Labs
Raspberry Robin’s Roshtyak: A Little Lesson in Trickery - Avast Threat Labs
We take a deep dive into Roshtyak, the DLL backdoor payload associated with Raspberry Robin. Roshtyak is full of anti-analysis tricks. Some are well-known, and some we have never seen before. From a technical perspective, the lengths Roshtyak takes to protect…
Cyber Challenges for Students! (intended for middle school students, high school students, and anybody else interested in learning technical skills in cybersecurity) https://316ctf.com/
316ctf
Cyber Challenges for Students! | 316ctf
316ctf - Cybersecurity CTF Challenges for High School and Middle School Students
Reverse Engineering The Apple Lightning Connector https://hackaday.com/2023/02/22/reverse-engineering-the-apple-lightning-connector/
Hackaday
Reverse Engineering The Apple Lightning Connector
A frequent contributor to the hacker community, [stacksmashing] has prepared an excellent instructional video on reverse engineering Apple’s Lighting connector proprietary protocol. The video…
A Primer On Slowable Encoders https://research.nccgroup.com/2023/02/20/a-primer-on-slowable-encoders/
Hardening Firmware Across the Android Ecosystem https://security.googleblog.com/2023/02/hardening-firmware-across-android.html
Google Online Security Blog
Hardening Firmware Across the Android Ecosystem
Posted by Roger Piqueras Jover, Ivan Lozano, Sudhi Herle, and Stephan Somogyi, Android Team A modern Android powered smartphone is a comp...