@cedowens

Proud Husband to @sgowens0716 and Father | Offensive Security Engineer | https://xitter.cf/t.co/CQv4PZcuvG

 Charlotte, NC
cedowens.medium.com
Joined April 2013
  • Tweets1.1K
  • Following647
  • Followers2.8K
122Media
My latest blog post on how in memory JXA exec, dylib exec, keylogging, and other techniques look through the lens of Apple’s ESF 🔎: cedowens.medium.com/taking-e…

Taking ESF For A(nother) Spin

2+ years ago from the date of this blog post I wrote my initial blog post where I started becoming familiar with Apple’s Endpoint Security…

cedowens.medium.com
3
35
2
89
One thing I’m being reminded of lately: the only sure foundation that I have is Jesus Christ 🙏🏽. His kingdom transcends this economy and job market 🙌🏽. If I can help in any way during these uncertain times please reach out! Be encouraged!
1
8
296
Cedric Owens retweeted
L0Psec@L0Psec30 Apr 2024
Alright here’s a new blog post for a new macOS malware by @AdamJKohler and I! This was a fun one to reverse: stripped, encoded strings, persistence, and more :) Enjoy!! blog.kandji.io/malware-cucko…
15
1
48
5,151
What have I been doing recently? Working on a 100% automated attack simulation framework for Microsoft Defender 🛡️ called M0rphy (named after Paul Morphy the chess genius) that supports both Linux, macOS and Windows, as well as accidently finding some vulns while doing so!
11
53
3
261
28,509
Cedric Owens retweeted
Csaba Fitzl
@theevilbit19 Mar 2024
🆕🍎My new blogpost @KandjiMDM about how Apple attempts to mitigate some installer script vulnerabilities using "Install Script Actions" and "Install Script Mutations" in the PackageKit framework. blog.kandji.io/apple-mitigat…
2
30
3
92
14,576
Cedric Owens retweeted
Wojciech Reguła@_r3ggi24 Jan 2024
🔊 New blog post about impersonating TCC permissions via Electron apps on macOS Sonoma wojciechregula.blog/post/ele…
1
28
78
7,330
Cedric Owens retweeted
L0Psec@L0Psec24 Jan 2024
The recent macOS malware which leverages python and ObjC has some pretty cool functionality. How it creates the path for the .py script for killing the NotificationCenter is a fun one so let's dive in: 🧵
1
9
58
11,426
Cedric Owens retweeted
Leo Pitt@_D00mfist8 Dec 2023
Short post where I revisit NPM payloads on macOS. medium.com/@D00MFist/loads-o…

Loads of Fun

A simple alternative to NPM payload execution

medium.com
1
15
45
7,188
Cedric Owens retweeted
SpecterOps@SpecterOps29 Nov 2023
Mythic just got an update! ✨ Check out @its_a_feature_'s latest blog post for a rundown of the updates made in Mythic v3.2, including: ✅ Push C2 ✅ Interactive Async Tasking ✅ Dynamic File Browser Read more! ghst.ly/46zRFsg
18
51
6,529
Dropping a quick blog post with a few videos walking through a review of how Gatekeeper looks up Notarization tickets! Calling the endpoint yourself is super quick. swiftly-detecting.notion.sit…

How does Gatekeeper know if an executable is Notarized? | Notion

Summary

swiftly-detecting.notion.site
4
12
34
6,526
💺 SwiftBelt A macOS enumeration tool Stealthy: uses Swift instead of CLI tools, avoids pop-ups Checks: * Full disk access * Presence of security tools * Searches for SSH and cloud creds * Browser history * Slack cookies + more By @cedowens #redteam github.com/cedowens/SwiftBel…

GitHub - cedowens/SwiftBelt: A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt...

A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool. Author: Cedric Owens - cedowens/SwiftBelt

github.com
2
19
78
9,354
Cedric Owens retweeted
Csaba Fitzl
@theevilbit8 Oct 2023
I put all my slides, whitepapers, workbooks, etc... for all of my past workshops and talks on my blog and added links for recordings where available. Now it's all available in a single space. theevilbit.github.io/talks/

Talks and Workshops

macOS Exploit Mixtape – Hack Like it's the 80s /CA: Gergely Kalman/ (Zer0Con)

theevilbit.github.io
5
35
2
177
28,459
Cedric Owens retweeted
Csaba Fitzl
@theevilbit29 Sep 2023
🎉🥁 The wait is over. Please welcome "Dock Tile Plugins" to the persistence club. My new favorite. 🤩 In the blog: 🍎 background and details 🍎 how to create and use 🍎 how to detect 🍎 sample code and binary theevilbit.github.io/beyond/…

Beyond the good ol' LaunchAgents - 32 - Dock Tile Plugins

This is part 32 in the series of "Beyond the good ol' LaunchAgents", where I try to collect various persistence techniques for macOS. For more background check the introduction.

theevilbit.github.io
Csaba Fitzl
@theevilbit28 Sep 2023
Found the coolest macOS persistence ever: 🍎 Not visible and always runs 🍎 No root is required 🍎 Not sandboxed 🍎 Not detected by BTM 🍎 Not detected by BlockBlock and Knockknock 😱
7
39
2
148
53,723
My Okta for Red Teamers post is up! We look at how Kerberos SSO works, how to intercept credentials via a fake AD Agent, decrypting AD Agent tokens, adding skeleton key's, and even how to deploy a janky SAML IdP server to auth as any user for good measure. trustedsec.com/blog/okta-for…

Okta for Red Teamers

Okta Delegated Authentication We’ll start with a technology offered to users deploying their Okta tenant alongside traditional on-prem Active Directory…

trustedsec.com
24
364
13
902
98,606
Cedric Owens retweeted
Vlad Ionescu
@ucsenoi12 Sep 2023
During a @Fox0x01 training, Tom found stack smashing protection was broken for GCC AArch64 under a certain (not uncommon) condition. GCC + Arm have fixed it, but lots of exploitable overflows will remain compiled in the wild. Sometimes it is the compiler! rtx.meta.security/mitigation…

CVE-2023-4039: GCC’s -fstack-protector fails to guard dynamic stack allocations on ARM64

Technical writeups by Meta’s Security folks, including Red Team.

rtx.meta.security
17
60
9,502
Happy Monday!✌🏽 I added some macOS TTPs to our team’s public ForgeArmory repo (ForgeArmory is the TTP repo for our ttpforge tool). These TTPs span various macOS techniques and include some TTPs from the LOOBins project! Link: github.com/facebookincubator…
1
15
2
53
9,264
If you missed the BSidesLV talk @AdamTheAnalyst and I gave on TTPForge last week, you're in luck! It's already on youtube, enjoy: youtu.be/H9YqJ1Ry1l8?t=978
1
9
12
3,142
Great seeing old friends and making new friends in Vegas this week at #BlackHat and #BsidesLV! Also the retro 80s/90s theme of the Microsoft MSRC event was beyond dope!!!! Until next time! ✌🏽
5
21
1,468
Cedric Owens retweeted
Wojciech Reguła@_r3ggi11 Aug 2023
Tomorrow at 9:00 am, I'll have my first @defcon talk. Join me and see how Electron apps installed on Macs can be automatically exploited and abused to get the TCC-protected resources. #Defcon #macos #security
1
9
3
43
6,562
Neat tool release today on our team! 🙌🏽Check this out especially if you’re running purple team engagements in your environment
Jayson Grace@Jayson_Grace9 Aug 2023
Thank you to everyone that attended our #bsidesLV talk! The TTPForge and ForgeArmory are NOW LIVE!! Enjoy: github.com/facebookincubator… github.com/facebookincubator…

GitHub - facebookincubator/TTPForge: The TTPForge is a Cybersecurity Framework for developing,...

The TTPForge is a Cybersecurity Framework for developing, automating, and executing attacker Tactics, Techniques, and Procedures (TTPs). - facebookincubator/TTPForge

github.com
1
16
1,564
My most recent blog post on leveraging expect routines in Purple Team Exercises: cedowens.medium.com/what-to-…
12
41
3,725
Load more