Offensive Security
Open in Telegram
I post what I read; I'm a low-level programmer with a focus on offensive security and redteam development.
Show more283
Subscribers
No data24 hours
+37 days
+530 days
Posts Archive
Reliable system call interception
This paper discusses a practical and reliable approach to intercepting Linux syscalls using seccomp user notify instead of traditional mechanisms like ptrace.
It explains how seccomp + BPF filters can be used to selectively trap specific syscalls and forward them to a userspace handler, allowing external decision-making without fully stopping the target process. Compared to ptrace, this approach significantly reduces overhead and avoids architecture-specific complexity.
The paper also highlights important limitations, especially TOCTOU race conditions, making this technique unsuitable for strict security policy enforcement but useful for monitoring, sandboxing, syscall tracing, and behavior analysis.
Overall, it’s a solid reference for anyone working on Linux internals, syscall interception, or modern sandboxing mechanisms.
@GoSecurity
#syscall #malware #interception #ptrace #seccomp
![❗️New ransomware Group: Dark Shinigamis darkshiz4d5ayumjvgbdhchwc7oeuc5jgbqkkgr2jj3ga5nvpjsswdad[.]onion @GoSecurity #raas #r](data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACgcHiMeGSgjISMtKygwPGRBPDc3PHtYXUlkkYCZlo+AjIqgtObDoKrarYqMyP/L2u71////m8H////6/+b9//j/2wBDASstLTw1PHZBQXb4pYyl+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj/wAARCAAoAB8DASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDHFLihelLQMTFIadTTQIUdKKQdKWgYZpDRQaBCUZoooAXNIaKKAP/Z)
❗️New ransomware Group:
Dark Shinigamis
darkshiz4d5ayumjvgbdhchwc7oeuc5jgbqkkgr2jj3ga5nvpjsswdad[.]onion
@GoSecurity
#raas #ransomware #malware
آگاهی یعنی اینکه شما بدونی قراره پولتو ندن و شرکت کنید.
برای اگاهسازی شما حداقل کاری که میتونید انجام بدید این هستش که راجب بدقولی و دروغ شرکتها توییت بزنید.
Researchers from Bitdefender revealed that a fake Leonardo DiCaprio movie torrent for "One Battle After Another" is spreading the Agent Tesla malware through a complex PowerShell chain, exploiting the film's popularity as a cybercriminal lure.
@GoSecurity
#malware #subtitles
منطق دودویی (Binary Logic)
ایدهی صفر و یک در اصل از منطق ارسطویی گرفته شده که بر پایهی دوگانگی «درست/نادرست» (True/False) بنا شده است.
بعدها جورج بول (George Boole) در قرن ۱۹ آن را به یک نظام ریاضی تبدیل کرد:
• ۱ = درست
• ۰ = نادرست
از همینجا منطق بولی و نهایتاً پایهی کامپیوترها شکل گرفت.
در این معنا، «فلسفهی صفر و یک» را میتوان همان فلسفهی منطق صوری و قطعیگرایی دانست.
@GoSecurity
#Binary
Repost from N/a
LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems (HIPS) through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed modules—completely fooling behavioral analysis engines that rely on call stack inspection and module origin verification.
Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks Uses hardware breakpoints + VEH to hijack legitimate functions and spoof module origins │ 1. Target Function Call │ ↓ │ 2. CPU Debug Register Triggers (DR0-DR3) │ │ ↓ │ 3. EXCEPTION_SINGLE_STEP Raised │ │ ↓ │ 4. VEH Handler Intercepts Exception │ │ ↓ │ 5. Execution Redirected to Hook Function │ │ ↓ │ 6. CallOriginal() Temporarily Disables Breakpoint │ ↓ │ 7. Original Function Executes │ │ ↓ │ 8. Breakpoint Re-enabled#callstackspoofing #edr
Linux Malware Sample Archive including various types of malicious ELF binaries and viruses. Be careful!
https://github.com/MalwareSamples/Linux-Malware-Samples
@GoSecurity
#Linux #malware
Age of Programming Languages
Swift (11 years old) (2014)
Kotlin (13 years old) (2011)
Rust (14 years old) (2010)
Go (15 years old) (2009)
TypeScript (12 years old) (2012)
C# (24 years old) (2000)
Ruby (29 years old) (1995)
Java (29 years old) (1995)
JavaScript (29 years old) (1995)
PHP (30 years old) (1994)
Python (34 years old) (1991)
Perl (37 years old) (1987)
C++ (39 years old) (1985)
Objective-C (40 years old) (1984)
Prolog (52 years old) (1972)
Smalltalk (52 years old) (1972)
C (52 years old) (1972)
Pascal (54 years old) (1970)
BASIC (60 years old) (1964)
COBOL (65 years old) (1959)
Lisp (66 years old) (1958)
Fortran (67 years old) (1957)
Assembly (76 years old) (1949)
@GoSecurity
#programming
Repost from Ai000 Cybernetics QLab
وقتی فکر میکنم که یک نفر در سال 2009 نشسته و کل سورسکد glibc را خطبهخط تحلیل کرده تا نهایتاً به تکنیک Prime برسد، واقعاً mind‑blowing است. اینکه بتوانی از دل پیادهسازی داخلی allocator، یک miscalculation در fastbin_index را شناسایی کنی و نشان بدهی چگونه یک heap overflow کاملاً معمولی میتواند به کنترل کامل ساختار malloc_state منجر شود و مسیر را برای یک arbitrary write تضمینی باز کند… این سطح دقت و توانایی dissect کردن allocator واقعاً یک ذهن فوقالعاده تیز میخواهد. بعد طرف داخل اسپلانک یک رول مینویسد که دو نوع مقدار را با هم مقایسه کند، فکر میکند ارباب حلقهها شده است.
@aioooir | #hell
https://x.com/vxunderground/status/1997436073908043946?s=46
❕Updates:
vx-underground.com
@GoSecurity
#malware #underground
‼️Smartphones worldwide were silently infected with Israeli malware via malicious ads
Simply viewing their ads was enough to get infected.
Surveillance company Intellexa gained full access to cameras, microphones, chat apps, emails, GPS locations, photos, files, and browsing activity.
@GoSecurity
#israel #malware
Repost from 1N73LL1G3NC3
Synology BeeStation RCE & A Novel SQLite Injection RCE Technique (CVE-2024-50629~50631)
This chain is a compelling case study of how chaining seemingly low-severity primitives can bridge the gap to full system compromise. A CRLF injection reads limited file, a conditional auth bypass, and a post-auth SQL injection—while individually limited, they become critical when chained together.
• CVE-2024-50629: Synology BeeStation BST150-4T CRLF Injection Information Disclosure Vulnerability • CVE-2024-50631: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology BeeStation BST150-4T devices. Authentication is required to exploit this vulnerability.Exploit: https://github.com/kiddo-pwn/CVE-2024-50629_50631 AFFECTED PRODUCTS: BeeStation BST150-4T Tweet: https://x.com/kiddo_pwn/status/1995435316304588881?s=46 Search Query: service: “synology” tag: “NAS” title: DiskStation
This cve addresses a vulnerability in sudo versions 1.9.14 to 1.9.17, enabling unauthorized local privilege escalation to root access.
https://github.com/Nowafen/CVE-2025-32463
@GoSecurity
#CVE #LPE #Linux #exploit
