I Like to Move It: Windows Lateral Movement Part 3: DLL Hijacking https://www.mdsec.co.uk/2020/10/i-live-to-move-it-windows-lateral-movement-part-3-dll-hijacking/
MDSec
I Like to Move It: Windows Lateral Movement Part 3: DLL Hijacking - MDSec
Overview In the past two posts of this series, we’ve covered lateral movement through WMI event subscriptions and DCOM, detailing approaches to improve the OpSec of our tradecraft. In the...
CVE-2019-8081 in Adobe Experience Manager https://pankajupadhyay.in/2020/10/02/cve-2019-8081-in-adobe-experience-manager/
Pankaj Upadhyay
CVE-2019-8081 in Adobe Experience Manager
Adobe Experience Manager is a suite of online cloud-based services provided by Adobe for content and digital asset management. It includes a set of analytics, social, adver…
Arbitrary code execution on Facebook for Android through download feature https://medium.com/@dPhoeniixx/arbitrary-code-execution-on-facebook-for-android-through-download-feature-fb6826e33e0f
Medium
Arbitrary code execution on Facebook for Android through download feature
TL;DR
Frida Android Binder hooking example (on GitHub) https://github.com/mame82/misc/blob/master/native_binder.ts
GitHub
misc/native_binder.ts at master · mame82/misc
Contribute to mame82/misc development by creating an account on GitHub.
From Zero to main(): Bare metal C https://interrupt.memfault.com/blog/zero-to-main-1
Interrupt
From Zero to main(): Bare metal C
Throughout the Zero to main() series of posts, we demystify what happens between when power is applied and your main function is called. In the process, we’ll learn how to bootstrap a C environment, implement a bootloader, relocate code, and more!
Sysmon Internals - From File Delete Event to Kernel Code Execution https://undev.ninja/sysmon-internals-from-file-delete-event-to-kernel-code-execution/
undev.ninja
Sysmon Internals - From File Delete Event to Kernel Code Execution
Sysmon File Delete Event Internals and Kernel Code Execution
XDSpy: Stealing government secrets since 2011 https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/
WeLiveSecurity
XDSpy: Stealing government secrets since 2011
ESET researchers uncover a new APT group that has been stealing sensitive documents from several governments in Eastern Europe and the Balkans since 2011.
Crouching T2, Hidden Danger https://ironpeak.be/blog/crouching-t2-hidden-danger/
ironpeak.be
Crouching T2, Hidden Danger - ironPeak Blog
MITRE ATT&CK turned purple – Part 1: Hijack execution flow https://blog.nviso.eu/2020/10/06/mitre-attack-turned-purple-part-1-hijack-execution-flow/
NVISO Labs
MITRE ATT&CK turned purple – Part 1: Hijack execution flow
The MITRE ATT&CK framework is probably the most well-known framework in terms of adversary emulation and by extent, red teaming.It features numerous TTPs (Tactics, Techniques, and Procedures) a…
Microsoft Digital Defense Report, September 2020: Insights about the threat intelligence landscape https://www.microsoft.com/en-us/download/details.aspx?id=101738
Microsoft Download Center
Digital Defense Report, September 2020
Insights about the threat intelligence landscape and guidance from experts, practitioners, and defenders at Microsoft
Bug in New Function ExAllocatePoolZero Results in Security Vulnerability and Crashes
https://www.osr.com/blog/2020/07/14/bug-in-new-function-exallocatepoolzero-results-in-security-vulnerability-and-crashes/
https://www.osr.com/blog/2020/07/14/bug-in-new-function-exallocatepoolzero-results-in-security-vulnerability-and-crashes/
OSR
Bug in New Function ExAllocatePoolZero Results in Security Vulnerability and Crashes
Update: Late in December 2020 Microsoft issued an update to the WDK/EWDK that includes mitigations for this security issue. See our blog post describing these updates. tl;dr Last week (week of 5 Ju…
Ryuk’s Return https://thedfirreport.com/2020/10/08/ryuks-return/
The DFIR Report
Ryuk's Return - The DFIR Report
Intro The Ryuk group went from an email to domain wide ransomware in 29 hours and asked for over $6 million to unlock our systems. They used tools such as Cobalt Strike, AdFind, WMI, vsftpd, PowerShell, PowerView, and Rubeus to accomplish their objective.…
Security Analysis of CHERI ISA https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Security%20analysis%20of%20CHERI%20ISA.pdf
GitHub
MSRC-Security-Research/Security analysis of CHERI ISA.pdf at master · microsoft/MSRC-Security-Research
Security Research from the Microsoft Security Response Center (MSRC) - MSRC-Security-Research/Security analysis of CHERI ISA.pdf at master · microsoft/MSRC-Security-Research
Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks https://threatresearch.ext.hp.com/detecting-a-stealthy-trickbot-campaign/
Bromium
Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks - Bromium
In September 2020, TrickBot's operators launched a malicious spam campaign that was effective at evading detection. Read about the techniques they used.
Building an Obfuscator to Evade Windows Defender https://www.xanthus.io/post/building-an-obfuscator-to-evade-windows-defender
Xanthus
Building an Obfuscator to Evade Windows Defender - Xanthus
Introduction Any redteamer working in a windows enterprise environment will eventually have to cross paths with Windows Defender and its anti-malware competent AMSI. For an operator the inability to drop the proper tools during an engagement can be very frustrating…
Methodology for Static Reverse Engineering of Windows Kernel Drivers https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
SpecterOps
Blog - SpecterOps
Your new best friend: Introducing BloodHound Community Edition!
CVE-2019-0230: Apache Struts OGNL Remote Code Execution https://www.zerodayinitiative.com/blog/2020/10/7/cve-2019-0230-apache-struts-ognl-remote-code-execution
Zero Day Initiative
Zero Day Initiative — CVE-2019-0230: Apache Struts OGNL Remote Code Execution
In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Kc Udonsi and John Simpson of the Trend Micro Research Team detail a recent code execution vulnerability in the Apache Struts framework. The bug was originally discovered…
nice post --> A Deep Dive Into RUNDLL32.EXE https://medium.com/@nasbench/a-deep-dive-into-rundll32-exe-642344b41e90
Medium
A Deep Dive Into RUNDLL32.EXE
Understanding “rundll32.exe” command line arguments
How To Unpack Malware: Personal Notes https://marcoramilli.com/2020/10/09/how-to-unpack-malware-personal-notes/
We Hacked Apple for 3 Months: Here’s What We Found https://samcurry.net/hacking-apple/
samcurry.net
We Hacked Apple for 3 Months: Here’s What We Found
Between the period of July 6th to October 6th myself, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes worked together and hacked on the Apple bug bounty program.