DEVEXPLš§ IT
Open in Telegram
No data
Subscribers
+724 hours
+217 days
+6930 days
Posts Archive
Windows Heap Exploitation - From Heap Overflow to Arbitrary R/W
https://mrt4ntr4.github.io/Windows-Heap-Exploitation-dadadb/
šŖ CVE-2025-50168: Windows 11 LPE Exploit
Windows win32kbase Type Confusion Local Privilege Escalation Vulnerability (CVSS 8.8). Pwn2Own Berlin 2025 winning bug.
Blog: https://www.oobs.io/posts/four-bytes-one-lie/
Android backdoor hijacks Telegram accounts, gaining complete control over them
ā¢ļøhttps://news.drweb.com/show/?i=15076&lng=en&c=5
š§ t.me/Devexploit
Streamlining Vulnerability Research with the idalib Rust Bindings for IDA 9.2
https://hex-rays.com/blog/streamlining-vulnerability-research-idalib-rust-bindings
š§ t.me/Devexploit
Windows API Arsenal
š„ FAUT.L Reverse Engineering Reference š„
https://blog.fautl.com/api-list.html
š§ t.me/Devexploit
Binary Exploitation 101
ā¢ļø https://r1ru.github.io/categories/binary-exploitation-101/
š§ t.me/Devexploit
Reverse Engineering for Noobs
ā¢ļø https://aceresponder.com/blog/reversing-for-noobs
š§ t.me/Devexploit
APT28 Operation Phantom Net Voxel
ā¢ļø https://blog.sekoia.io/apt28-operation-phantom-net-voxel/
š§ t.me/Devexploit
Hunting Bugs in Linux Kernel With KASAN: How to Use it & What's the Benefit?
ā¢ļø https://slavamoskvin.com/hunting-bugs-in-linux-kernel-with-kasan-how-to-use-it-whats-the-benefit/
š§ t.me/Devexploit
How to Perform Clipboard Forensics: ActivitiesCache.db, Memory Forensics and Clipboard History
ā¢ļø https://www.inversecos.com/2022/05/how-to-perform-clipboard-forensics.html?m=1
š§ t.me/Devexploit
Bypassing EDR using an In-Memory PE Loader
ā¢ļø https://g3tsyst3m.com/fileless%20techniques/Bypassing-EDR-using-an-In-Memory-PE-Loader/
š§ t.me/Devexploit
Reverse engineering undocumented Windows Kernel features to work with the EDR
ā¢ļø https://fluxsec.red/reverse-engineering-windows-11-kernel
š§ t.me/Devexploit
Notepad++ DLL Hijacking Vulnerability Let Attackers Execute Malicious Code
ā¢ļø https://cybersecuritynews.com/notepad-hijacking-vulnerability/amp/
š§ t.me/Devexploit
Intro to Syscalls & Windows internals for malware development:
ā¢ļø 1- https://medium.com/%40amitmoshel70/intro-to-syscalls-windows-
internals-for-malware-development-pt-1-b5bb0cd90c52
ā¢ļø 2- https://medium.com/@amitmoshel70/intro-to-syscalls-windows-internals-for-malware-development-pt-2-b8d88bb10eb9
š§ t.me/Devexploit
New EDR-Freeze Tool That Puts EDRs and Antivirus Into A Coma State.
ā¢ļø https://cybersecuritynews.com/edr-freeze-tool/
ā ā ā ā ā” The EDR-Freeze tool is a proof-of-concept exploit that leverages Windows' built-in components to suspend EDR and antivirus processes into a "coma" state, effectively rendering them inactive without installing any third-party drivers.
Mechanism:
1. MiniDumpWriteDump API: This function, part of the Windows DbgHelp library, is designed to create memory dumps by suspending all threads of a target process.
2. Bypassing PPL Protection: EDR and antivirus processes are typically protected by Protected Process Light (PPL). The tool utilizes WerFaultSecure.exe, a component of the Windows Error Reporting service, which can run with WinTCB level protection, allowing it to interact with these protected processes.
3. Race Condition Attack: After initiating WerFaultSecure.exe to create a memory dump, the tool monitors the target process. Upon detecting that the target process has entered a suspended state, the tool immediately suspends WerFaultSecure.exe. This prevents the completion of the memory dump, leaving the target process in a suspended state indefinitely.
Usage:
Parameters: The tool requires two parameters: the Process ID (PID) of the target process and the duration of the suspension in milliseconds.
Example: On Windows 11 24H2, the tool successfully suspended the MsMpEng.exe process of Windows Defender.
Detection and Mitigation:
Monitoring: Defenders should monitor for unusual executions of WerFaultSecure.exe, especially when targeting sensitive processes like lsass.exe or EDR agents.
Preventive Measures: Implementing tamper protection, maintaining stringent role hygiene in Windows security settings, and ensuring systems are up to date can help mitigate the risk of such attacks.
This technique offers a stealthier alternative to traditional methods like Bring Your Own Vulnerable Driver (BYOVD) attacks, as it does not require introducing vulnerable drivers onto a target system.
š§ t.me/Devexploit
Enumerating Windows clipboard history in PowerShell
ā¢ļø https://devblogs.microsoft.com/oldnewthing/20230303-00/?p=107894
š§ t.me/Devexploit
ā¢ļø More Fun With WMI
Win32_Process has been the go to WMI class for remote command execution for years. In this post we will cover a new WMI class that functions like Win32_Process and offers further capability.
ā¢ļø WMI_Proc_Dump.py
Dump processes over WMI with MSFT_MTProcess
ā¢ļø mtprocess.py
Python script that uses Impacket to use the MSFT_MTProcess WMI class to execute a command. If wanting to use against a Workstation it can install the provider.
P.S. One more way to dump LSASS.
š§ t.me/Devexploit
