Source Byte

#ShortVideo How to Deal With Password Protect Video Master (PPVM) Integrity Check 🦅 کانال بایت امن | گروه بایت امن _

SWAPPALA: Why Change When You Can Hide? Advanced Module Stomping technique Github

CookieKatz Dump cookies directly from Chrome, Edge, or Msedgewebview2 process memory. Chromium-based browsers load all their cookies from the on-disk cookie database on startup. The benefits of this approach are:

  • Support dumping cookies from Chrome’s Incogntio and Edge’s In-Private processes
  • Access cookies of other user’s browsers when running elevated
  • Dump cookies from webview processes
  • No need to touch on-disk database file
  • DPAPI keys not needed to decrypt the cookies
  • Parse cookies offline from a minidump file

This solution consists of three projects:

   • CookieKatz - PE executable
   • CookieKatz-BOF - Beacon Object File version
   • CookieKatzMinidump - minidump parser.

Abusing the SeRelabelPrivilege

that a specific Group Poilcy granted via “User Right Assignments” the SeRelabelPrivilege to the built-in Users group and was applied on several computer accounts.

https://decoder.cloud/2024/05/30/abusing-the-serelabelprivilege #malware_dev

Google Chrome Use After Free vulnerability reported by S4E Team https://github.com/s4e-lab/CVE-2021-30573-PoC-Google-Chrome #cve #Exp #browser

Getting RCE in Chrome with incomplete object initialization in the Maglev compiler

In this post, I'll exploit CVE-2023-4069, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.

https://github.blog/2023-10-17-getting-rce-in-chrome-with-incomplete-object-initialization-in-the-maglev-compiler/ #cve #Exp #browser

Getting RCE in Chrome with incorrect side effect in the JIT compiler

In this post, I'll exploit CVE-2023-3420, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.

https://github.blog/2023-09-26-getting-rce-in-chrome-with-incorrect-side-effect-in-the-jit-compiler/ #cve #Exp #browser

Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals Chrome Browser Exploitation, Part 2: Introduction to Ignition, Sparkplug and JIT Compilation via TurboFan Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463 #cve #Exp

https://blog.0daylabs.com/2024/05/27/jetbrains-teamcity-auth-bypass/ Diving deep into Jetbrains TeamCity Part 1 - Analysing CVE-2024-23917 leading to Authentication Bypass

Synapse Ransomware Technical Analysis Link

rule Synapse_Ransomware_1_0_0
{
meta:
description = "Synapse Ransomware 1.0.0 Stable Version Release - Detection Rule"
author = "CRT"
date = "2024-05-22"
version = "1.0"
malware_type = "ransomware"
strings:
$str1 = "Global\\FSWiper" ascii wide nocase
$str2 = "ZLWP.tmp" ascii wide nocase
$str3 = "Microsoft Primitive Provider" ascii wide nocase
$str4 = "RNG" ascii wide nocase
$str5 = "Synapse" ascii wide nocase
$clsid1 = {11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24}
$clsid2 = {98 66 4B 67 92 EE D0 11 AD 71 00 C0 4F D8 FD FF}
$clsid3 = {87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24}
$clsid4 = {74 A6 AC 44 FC E8 D0 11 A0 7C 00 C0 4F B6 88 20}
condition:
all of them
}

Projects on undocumented windows APIs, a keylogger PoC, and dll injection PoC.

Based off of a Defcon workshop

GitHub

Code injection via undocumented NtAllocateVirtualMemory Cocmelonc #malware_dev

Name: Windows System Programming Requirements: C, Windows (structure and etc) Level: Intermediate to Advanced Author: Johnson M. Hart Table of Contents: 1- Getting Started with Windows 2- Using the Windows File System and Character I/O 3- Advanced File and Directory Processing, and the Registry 4- Exception Handling 5- Memory Management, Memory-Mapped Files, and DLLs 6- Process Management 7- Threads and Scheduling 8- Thread Synchronization 9- Locking, Performance, and NT6 Enhancements 10- Advanced Thread Synchronization 11- Interprocess Communication 12- Network Programming with Windows Sockets 13- Windows Services 14- Asynchronous Input/Output and Completion Ports 15- Securing Windows Objects 16- Using the Sample Programs 17- Source Code Portability: Windows, UNIX, and Linux 18- Performance Results

Name: Mach-O Runtime and File Format Reference Requirements: Compiling Steps, C Programming Level: Intermediate Author: Apple Inc. Contents Index: 1 - Overview of Runtime Architecture 2 - Building Mach-O Files 3 - Executing Mach-O Files 4 - Loading Code At Runtime 5 - Runtime Conversations for PowerPC 6 - Data Types 7 - Data Alignment 8 - Stack Structure 9 - Routine Calls 10 - Dynamic Code Generation 11 - Mach-O File Format Reference 12 - Mach-O Header Data Structure 13 - Load Command Data Structures 14 - Symbol Table and Related Data Structures 15 - Relocation Data Structures 16 - Static Archive Libraries 17 - Multi-CPU Architecture Files #apple #mac #mach_o #reverse_engineering #binary #paper #resource