Deobfuscate malicious macro – Part 0x1 https://www.securityinbits.com/malware-analysis/deobfuscate-malicious-macro/
Securityinbits
Deobfuscate malicious macro - Part 0x1 - Securityinbits
We will concentrate on malicious macro embedded in Emotet downloader office document and see how to deobfuscate the macro code.
Lazarus/Bluenoroff/APT38 indictments » Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and
Department of Justice
Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe
A federal indictment unsealed today charges three North Korean computer programmers with participating in a wide-ranging criminal conspiracy to conduct a series of destructive cyberattacks, to steal and extort more than $1.3 billion of money and cryptocurrency…
Offensive Windows IPC Internals 2: RPC https://csandker.io/2021/02/21/Offensive-Windows-IPC-2-RPC.html
csandker.io
Offensive Windows IPC Internals 2: RPC
Remote Procedure Calls (RPC) is a technology to enable data communication between a client and a server across process and machine boundaries (network communication). Therefore RPC is an Inter Process Communication (IPC) technology...
Exploit Writeup for CVE-2021–3156 (Sudo Baron Samedit) https://datafarm-cybersecurity.medium.com/exploit-writeup-for-cve-2021-3156-sudo-baron-samedit-7a9a4282cb31
Medium
Exploit Writeup for CVE-2021–3156 (Sudo Baron Samedit)
A Sudo vulnerability (CVE-2021–3156) found by Qualys, Baron Samedit: Heap-Based Buffer Overflow in Sudo, is a very interesting issue…
RCE on a Laravel Private Program https://zdresearch.com/rce-on-a-laravel-private-program/
ZDResearch
RCE on a Laravel Private Program - ZDResearch
The recent Laravel CVE enables remote attackers to exploit a RCE flaw in websites using Laravel. I’ve read the article about the exploitation procedure using the Ignition library on Laravel. To get started, I went through our recon database which contains…
Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli https://neroli.medium.com/is-math-random-safe-from-missing-rate-limit-to-bypass-2fa-and-possible-sqli-2a4ea66f82c5
Medium
Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli
Hi everyone It’s Yasser Again,
Nice post to start analyzing Android binaries » CrackMe challenges for Android https://persianov.net/crackme-challenges-for-android
Persianov on Security
CrackMe challenges for Android
Some crackme challenges for Android. Sorted in 3 different difficulty levels and easy to run on any Android emulator. Download and try your RE skills!
Tracking Cryptocurrency Malware In The Homelab - Pt 2 https://www.archcloudlabs.com/projects/tracking-crypto-miners-in-the-homelab-2-new-tricks/
Arch Cloud Labs
Tracking Cryptocurrency Malware In The Homelab - Pt 2
About The Project Continuing from the last blog post that discussed malicious Linux Cryptocurrency miners, I have discovered new activity that blends two of my previous Cryptocurrency mining malware (aka Cryptojacking) blog posts.
By taking a deeper look…
By taking a deeper look…
Analysis of CVE-2021-1647 vulnerability exploitation techniques (worth reading, but in Chinese; use Google Translator) » https://www.anquanke.com/post/id/231625
UnhookMe: Dynamically unhooking imports resolver https://securityonline.info/unhookme-dynamically-unhooking-imports-resolver/
Penetration Testing
UnhookMe: Dynamically unhooking imports resolver • Penetration Testing
UnhookMe presents us with the first MessageBoxW that is not subject for hooking. Then we hook MessageBoxW prologue ourselves
Server-Side Template Injection https://portswigger.net/research/server-side-template-injection
PortSwigger Research
Server-Side Template Injection
Template engines are widely used by web applications to present dynamic data via web pages and emails. Unsafely embedding user input in templates enables Server-Side Template Injection, a frequently c
A little bit of crypto engineering » Serving up zero-knowledge proofs https://blog.trailofbits.com/2021/02/19/serving-up-zero-knowledge-proofs/
The Trail of Bits Blog
Serving up zero-knowledge proofs
Zero-knowledge (ZK) proofs are gaining popularity, and exciting new applications for this technology are emerging, particularly in the blockchain space. So we’d like to shine a spotlight on an interesting source of implementation bugs that we’ve seen—the…
Windows kernel zero-day exploit (CVE-2021-1732) is used by BITTER APT in targeted attack https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/
Misconfigurations in Java XML Parsers http://immunityservices.blogspot.com/2021/02/misconfigurations-in-java-xml-parsers.html
Blogspot
Misconfigurations in Java XML Parsers
Misconfigurations in Java XML Parsers XML is a powerful data format that can elegantly encapsulate any conceivable kind of information. T...
The importance of continuity in fuzzing - CVE-2020-28362 https://adalogics.com/blog/the-importance-of-continuity-in-fuzzing-cve-2020-28362
ApoMacroSploit : Apocalyptical FUD race https://research.checkpoint.com/2021/apomacrosploit-apocalyptical-fud-race/
Check Point Research
ApoMacroSploit : Apocalyptical FUD race - Check Point Research
1.1 Introduction At the end of November, Check Point Research detected a new Office malware builder called APOMacroSploit, which was implicated in multiple malicious emails to more than 80 customers worldwide. In our investigation, we found that this…
Introducing MacHound: A Solution to MacOS Active Directory-Based Attacks https://www.xmcyber.com/introducing-machound-a-solution-to-macos-active-directory-based-attacks/
XM Cyber
Introducing MacHound: A Solution to MacOS Active Directory-Based Attacks
Learn all about MacHound, a plugin for Bloodhound Active Directory, allowing to collect Active Directory relationships from MacOS devices.
Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801] https://blog.confiant.com/malvertiser-scamclub-bypasses-iframe-sandboxing-with-postmessage-shenanigans-cve-2021-1801-1c998378bfba
Confiant
Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801]
This blog post is about the mechanics of a long tail iframe sandbox bypass found in a payload belonging to the persistent malvertising attacker that we call ScamClub.
PE-Packer: Windows x86 PE file packer written in C & Microsoft Assembly https://securityonline.info/pe-packer-windows-x86-pe-file-packer-written-in-c-microsoft-assembly/
Penetration Testing
PE-Packer: Windows x86 PE file packer written in C & Microsoft Assembly
PE-Packer is a simple packer for Windows PE files. The new PE file after packing can obstruct the process of reverse engineering.
Neurax: A framework for constructing self-spreading binaries https://github.com/redcode-labs/Neurax
GitHub
GitHub - redcode-labs/neurax: A framework for constructing self-spreading binaries
A framework for constructing self-spreading binaries - redcode-labs/neurax