All Security Engineering Courses

INE_Acces-Lists-Beyond-the-Basics-and-Extended_Technet24

https://wayland.freedesktop.org/ Wayland is a replacement for the X11 window system protocol and architecture with the aim to be easier to develop, extend, and maintain. Wayland is the language (protocol) that applications can use to talk to a display server in order to make themselves visible and get input from the user (a person). A Wayland server is called a "compositor". Applications are Wayland clients. Wayland also refers to a system architecture. It is not just a server-client relationship between a compositor and applications. There is no single common Wayland server like Xorg is for X11, but every graphical environment brings with it one of many compositor implementations. Window management and the end user experience are often tied to the compositor rather than swappable components. Wayland does not restrict where and how it is used. A Wayland compositor could be a standalone display server running on Linux kernel modesetting and evdev input devices or on many other operating systems, or a nested compositor that itself is an X11 or Wayland application (client). Wayland can even be used in application-internal communication as is done in some web browsers.

Blogs To Follow http://obscuresecurity.blogspot.com http://carnal0wnage.attackresearch.com https://www.netspi.com/blog http://itsecops.blogspot.com http://www.labofapenetrationtester.com http://www.harmj0y.net/ http://passing-the-hash.blogspot.com/ https://clymb3r.wordpress.com https://www.pentestgeek.com/ http://blog.portswigger.net/ http://blog.cobaltstrike.com/ http://exploit-monday.com https://www.fireeye.com/blog/threat-research.html http://www.hexacorn.com/blog/ https://enigma0x3.net/

OdinLdr Cobaltstrike UDRL with memory evasion Feature :

 • Redirect all WININET call over callstack crafting
 • Encrypt beacon during sleep
 • Encrypt beacon heap during sleep
 • Self delete of loader

Execution of loader:

1 - Create heap for beacon usage
2 - Allocation of RWX area with beacon size + UDRL size
3 - Copy the UDRL at the end of beacon in allocated area
| 0x00 | beacon | 0xBEACON_SIZE | UDRL | 0xEND_Alloc
4 - Copy the ODIN structure (heap handle, beacon addr, alloc size) to the start of allocated area (no pe header is present)
5 - Copy beacon section
6 - Resolve beacon import and patch IAT (also set hook)
7 - Patch relocation table
8 - Init the beacon
9 - Create thread on TpReleaseCleanupGroupMembers+0x450 to spoof the thread start addr & beacon run
10 - Self delete the loader

☢️ Malware development: persistence - part 1. Registry run keys. C++ example. ☢️ Malware development: persistence - part 2. Screensaver hijack. C++ example. ☢️ Malware development: persistence - part 3. COM DLL hijack. ☢️ Malware development: persistence - part 4. Windows services. Simple C++ example. ☢️ Malware development: persistence - part 5. AppInit_DLLs. Simple C++ example. ☢️ Malware development: persistence - part 6. Windows netsh helper DLL. Simple C++ example. ☢️ Malware AV evasion: part 7. Disable Windows Defender. Simple C++ example. ☢️ Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example. ☢️ Malware AV evasion - part 9. Encrypt base64 encoded payload via RC4. C++ example. ☢️ Malware AV/VM evasion - part 10: anti-debugging. NtGlobalFlag. Simple C++ example. ☢️ Malware AV/VM evasion - part 11: encrypt payload via DES. Simple C++ example. ☢️ Malware AV/VM evasion - part 12: encrypt/decrypt payload via TEA. Simple C++ example. ☢️ Malware AV/VM evasion - part 13: encrypt/decrypt payload via Madryga. Simple C++ example. ☢️ Malware AV/VM evasion - part 14: encrypt/decrypt payload via A5/1. Bypass Kaspersky AV. Simple C++ example. ☢️ Malware AV/VM evasion - part 15: WinAPI GetModuleHandle implementation. Simple C++ example. ☢️ Malware AV/VM evasion - part 16: WinAPI GetProcAddress implementation. Simple C++ example. ☢️ Malware AV/VM evasion - part 17: bypass UAC via fodhelper.exe. Simple C++ example. ☢️ Malware AV/VM evasion - part 18: encrypt/decrypt payload via modular multiplication-based block cipher. Simple C++ example. ☢️ Malware development: persistence - part 22. Windows Setup. Simple C++ example. ☢️ Malware and cryptography 1: encrypt/decrypt payload via RC5. Simple C++ example. ☢️ Malware and cryptography 20: encrypt/decrypt payload via Skipjack. Simple C++ example. ☢️ Malware and cryptography 21: encrypt/decrypt payload via WAKE. Simple C++ example. ☢️ Malware development: persistence - part 23. LNK files. Simple Powershell example. ☢️ Malware development: persistence - part 24. StartupApproved. Simple C example. ☢️ Malware and cryptography 22: encrypt/decrypt payload via XTEA. Simple C++ example. ☢️ Malware and cryptography 23: encrypt/decrypt file via TEA. Simple C/C++ example. ☢️ Malware and cryptography 24: encrypt/decrypt file via Madryga. Simple C/C++ example. ☢️ Malware and cryptography 25: encrypt/decrypt payload via RC6. Simple C/C++ example. ☢️ Malware AV/VM evasion - part 15: WinAPI GetModuleHandle implementation. Simple C++ example. ☢️ Malware AV/VM evasion - part 16: WinAPI GetProcAddress implementation. Simple C++ example. ☢️ Malware AV/VM evasion - part 17: bypass UAC via fodhelper.exe. Simple C++ example. ☢️ Malware AV/VM evasion - part 18: encrypt/decrypt payload via modular multiplication-based block cipher. Simple C++ example. ☢️ Malware development: persistence - part 22. Windows Setup. Simple C++ example. ☢️ Malware and cryptography 1: encrypt/decrypt payload via RC5. Simple C++ example. ☢️ Malware and cryptography 20: encrypt/decrypt payload via Skipjack. Simple C++ example. ☢️ Malware and cryptography 21: encrypt/decrypt payload via WAKE. Simple C++ example.

🧠 t.me/Devexploit

Exploit development courses https://docs.google.com/spreadsheets/d/19muaIO-PIIj9H3Ti0ajs3Jgujz9QEveUyV0OAV6Hcg0/edit?pli=1#gid=0

http://serveo.net/ Serveo is an SSH server just for remote port forwarding. When a user connects to Serveo, they get a public URL that anybody can use to connect to their localhost server.