Meelo retweeted
CUPS RCE (@evilsocket), driver vulns (@vinopaljiri), NamelessC2 release (@trickster012), liveness detection bypass (@CaptMeelo), and more! blog.badsectorlabs.com/last-…
Meelo retweeted
🔥 New blogpost 🔥
Running PEs inline without a console.
You now can, for example, run PowerShell in CobaltStrike and obtain its output without spawning any process (including conhost.exe)
coresecurity.com/core-labs/a…
Meelo retweeted
Finally done!
My latest article introduce the basics of Windows kernel drivers/internals and how to find and exploit process killer drivers using LOLDrivers 🤓
I hope you'll enjoy it!
alice.climent-pommeret.red/p…
Meelo retweeted
Abusing undocumented features to spoof PE section headers by @x86matthew secret.club/2023/06/05/spoof…
Meelo retweeted
I just published my implementation of call stack spoofing using hardware breakpoints 😁
Works for syscalls and APIs, supports x64, x86 and WoW64.
coresecurity.com/blog/hardwa…
Meelo retweeted
For the past couple of months @NUL0x4C and I have been working on a module-based malware dev training course that covers various techniques in-depth. Its emphasis is on simplifying complex concepts & evasion. Every module contains highly commented custom code. Stay tuned!
Meelo retweeted
[BLOG 📝] Some notes on how to automate the generation of Position Independent Shellcodes (without msfvenom windows/x64/exec) from object files in memory (by @NinjaParanoid) to be used in Threadless Process Injection (by @_EthicalChaos_) ⬇️
snovvcrash.rocks/2023/02/14/…
Meelo retweeted
My first blog at CS - Dynamically spoofing call stacks with timers: cobaltstrike.com/blog/behind…
PoC: github.com/Cobalt-Strike/Cal…
Meelo retweeted
Finally revamped my original @hashcat rule OneRuleToRuleThemAll.
The new and improved OneRuleToRuleThemStill has ~5% reduced rules with 0% performance drop against multiple breach datasets.
Link is in the blog. Happy cracking!
in.security/2023/01/10/oneru…
#pentest #redteam
Meelo retweeted
macOS x64 shellcode that uses an eggHunter to find and decipher the command shell string. Tinkering with macOS x64 shellcoding as I work through the offsec macOS course.
Check it out here:
packetstormsecurity.com/file…
ALT https://packetstormsecurity.com/files/170322/macOS-x64-Execve-Caesar-Cipher-String-Null-Free-Shellcode.html
Meelo retweeted
[BLOG POST] And as promised, this is a brief article the describing the technique used within SilentMoonwalk. Might be a good weekend read!
klezvirus.github.io/RedTeami…
Meelo retweeted
Windows internals resources that I have collected in around an year #infosec
Win32 programming with code examples: installsetupconfig.com/win32…
Notes for Windows API programming;
caiorss.github.io/C-Cpp-Note…
Windows undocumented functions' docs:
undoc.airesoft.co.uk/
Meelo retweeted
We have published a paper: "About malware writing and how to start"
This paper exists to address the questions we frequently encounter. It is an opinionated piece on malware development, the path to success, and some personal anecdotes
Check it out here: papers.vx-underground.org/pa…
Meelo retweeted
[RELEASE] After a little wait, I'm happy to present SilentMoonwalk, a PoC implementation of a TRUE call stack spoofer, result of a joint research on an original technique developed by namazso, done with my friends @trickster012 and @waldoirc.
Enjoy! ;)
github.com/klezVirus/SilentM…
Meelo retweeted
[NEW SHORT COURSE]
DevOps for Pentesters
training.zeropointsecurity.c…
Meelo retweeted
laZzzy : a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques : github.com/capt-meelo/laZzzy credits @CaptMeelo
Meelo retweeted
Releasing a new tool: Orpheus! Bypasses most Kerberoast Detections (including my own). Blog post and video is up at @TrustedSec! Even used @HackingDave's old alias in the demo. trustedsec.com/blog/the-art-… #infosec #security #kerberoast
Meelo retweeted
my first windows kernel exploit. it's cool to abuse CVE-2021-21551 to unlink the current process from EPROCESS list & hide itself :)
github.com/aaaddress1/PR0CES…
Meelo retweeted
Happy to share a new blog post I wrote about how I managed to dump LSASS undetected using a simple MiniDumpWriteDump against some of the most advanced EDRs in the market.
"It’s all in the details: The curious case of an LSASS dumper gone undetected"
dec0ne.github.io/research/20…
Meelo retweeted
You can now buy vx-underground Blackmass Volume 1. on Amazon in paperback form.
The book is $8. 😎👍
amazon.com/dp/B0BM4BMD53
