Source Byte

Note during self-study OSEP course from the Internet. https://github.com/col-1002/OSEP-Notes/tree/main

ProxyAlloc: evading NtAllocateVirtualMemory detection ft. Elastic Defend & Binary Ninja In this article, we will explore a method for in-process shellcode execution evasion. This method is specifically designed to avoid the detection of NtAllocateVirtualMemory calls from unsigned DLLs. https://blog.cryptoplague.net/main/research/windows-research/proxyalloc-evading-ntallocatevirtualmemory-detection-ft.-elastic-defend-and-binary-ninja credit : Daniil Nababkin

gpu poisoning; hide the payload inside the gpu memory. https://github.com/H1d3r/GPU_ShellCode.git

Function Graph Overview https://marketplace.visualstudio.com/items?itemName=tamir-bahar.function-graph-overview

How to get the COM concurrency model for the current thread. by Rbmm & Dennis A. Babkin https://dennisbabkin.com/blog/?t=things-you-thought-you-knew-how-to-get-com-concurrency-model-for-current-thread #com #reverse_engineer #cpp

RedTeam Workshop - Part 4 * How do North Korean hackers bypass security mechanisms? * APT38 attacks simulation , in this section, "defense evasion" was discussed.

Defense Evasion + T1562.003 | Impair Command History Logging + T1562.004 | Disable or Modify System Firewall + T1070.001 | Clear Windows Event Logs + T1070.006 | Timestomp + T1112 | Modify Registry + T1218.001 | Compiled HTML File + T1218.011 | Rundll32

https://youtu.be/zDyPRrtXjus?si=265TY6KyElHGr-eR slides / notes : https://github.com/soheilsec/RT-workshop-2024 credit : @soheilsec language : persian

LOLESXi * Living Off The Land ESXi

COM PROCESS INJECTION for RUST

Process Injection via Component Object Model (COM) IRundown::DoCallback().

https://github.com/0xlane/com-process-inject.git

x64 WINAPI Recursive Loader

"Code provided by smelly - vx-underground"

https://web.archive.org/web/20240928164510/https://github.com/Evi1Grey5/Recursive-Loader #Loader

The Anti-EDR Compendium EDR functionality and bypasses in 2024, with focus on undetected shellcode loader. https://blog.deeb.ch/posts/how-edr-works/ credit : Dobin Rutishauser

Охуенная статья Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/

Injecting Code into Windows Protected Processes using COM, Part 1 and Part 2 by James Forshaw of the Project Zero team prompted an interest in COM internals and, more specifically, the undocumented DoCallback method part of the IRundown interface. - POC #COM

😈 [ Check Point Research @_CPResearch_ ] 10 years of DLL hijacking - featuring abused executables that shouldn't have existed, exported and malicious DLLs with discount bin "packing." Includes a PoC for app developers to pre-emptively stop hijacking without dealing with a certificate authority. 🔗 https://research.checkpoint.com/2024/10-years-of-dll-hijacking-and-what-we-can-do-to-prevent-10-more/ 🐥 [ tweet ]

Kimsuky Group's new backdoor appeared (HappyDoor) https://web.archive.org/web/20240626161026/https://asec.ahnlab.com/ko/67128/

Kimsuky Group's new backdoor appeared (HappyDoor)

COM from scratch

PART ONE

[ Code project ] #com #windows

🥤 Pivoting using ZeroTier 🥤 Pivoting using Nebula Demonstration of pivoting with ZeroTier and Nebula during the post-exploitation process. These tools showcase impressive capabilities such as flexible routing, NAT traversal, and the ability to build tunnels between isolated network segments, granting full access to internal infrastructure. Thx to my bro @casterbyte

Process Injection via Component Object Model (COM) IRundown::DoCallback()

From MDSec

https://www.mdsec.co.uk/2022/04/process-injection-via-component-object-model-com-irundowndocallback/