Source Byte

Below is an example of how you can use the Windows API in C++ to create a communication channel with http.sys. This example demonstrates how to set up a simple HTTP server using the HTTP Server API: #include <windows.h> #include <http.h> #pragma comment(lib, "httpapi.lib") int main() { ULONG retCode = NO_ERROR; HTTPAPI_VERSION HttpApiVersion = HTTPAPI_VERSION_2; HTTP_SERVER_SESSION_ID sessId = NULL; HTTP_URL_GROUP_ID groupId = NULL; HTTP_REQUEST_ID requestId = NULL; HTTP_SERVER_CONTEXT context = 0; // Initialize HTTP Server APIs retCode = HttpInitialize(HttpApiVersion, HTTP_INITIALIZE_SERVER, NULL); if (retCode != NO_ERROR) return retCode; // Create a server session retCode = HttpCreateServerSession(HttpApiVersion, &sessId, 0); if (retCode != NO_ERROR) goto cleanup; // Create a URL group retCode = HttpCreateUrlGroup(sessId, &groupId, 0); if (retCode != NO_ERROR) goto cleanup; // Add a URL to the URL group PCWSTR pFullyQualifiedUrl = L"http://localhost:8080/"; retCode = HttpAddUrlToUrlGroup(groupId, pFullyQualifiedUrl, context, 0); if (retCode != NO_ERROR) goto cleanup; // Your code to handle requests here // ... cleanup: // Clean up in case of failure or after serving requests if (groupId != NULL) { HttpRemoveUrlFromUrlGroup(groupId, pFullyQualifiedUrl, 0); HttpCloseUrlGroup(groupId); } if (sessId != NULL) { HttpCloseServerSession(sessId); } HttpTerminate(HTTP_INITIALIZE_SERVER, NULL); return retCode; } This code initializes the HTTP service, creates a server session, sets up a URL group, and adds a URL to the group. You would need to add your own code to handle the HTTP requests. Please note that this is a simplified example and does not include error handling or request processing logic. For a complete implementation, you would need to handle incoming HTTP requests and send appropriate responses. You can find more detailed information and examples in the [Microsoft documentation](^2^). Remember to run your application with administrative privileges, as setting up an HTTP server requires elevated permissions. Using the WinHTTP C/C++ API - Win32 apps | Microsoft Learn. c++ - HTTP client example on win32 - Stack Overflow. c++ - Communication between two windows created using TCP Sockets .... https://github.com/pedro-vicente/lib_netsockets.

VOID MANTICORE DESTRUCTIVE ACTIVITIES IN ISRAEL

Void Manticore is an Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS). They carry out destructive wiping attacks combined with influence operations.

(Checkpoint Report) Research @source_byte #apt #TI

VOID MANTICORE DESTRUCTIVE ACTIVITIES IN ISRAEL

Void Manticore is an Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS). They carry out destructive wiping attacks combined with influence operations.

(Checkpoint Report) Research

no-defender A slightly more fun way to disable windows defender. (through the WSC api)

🍏 macOS Red Teaming. • Gathering System Information Using IOPlatformExpertDevice; • Targeting Browser and Diagnostic Logs; • Manipulating the TCC Database Using PackageKit; • Leveraging Application Bundles and User-Specific Data; • Taking Over Electron App TCC Permissions with electroniz3r; • Exploiting Keychain Access; • Signing Your Payload; • Exploiting Installer Packages; • Exploiting DMG Files for Distribution; • Leveraging HealthInspector Utility; • Generating Shared Secrets and Accessing Computer$ Password; • Over-Pass-The-Hash; • Kerberoasting; • User Level Persistence with Launch Agents; • User Level Persistence with Login Items; • Folder Action Scripts; • Dylib Insertion/Hijack; • Evasion Techniques with XPC on macOS; • Process Injection on macOS; • In-Memory Loading on macOS.

We have many people asking us how to begin their journey into malware development. Here is a step by step guide to get started! 1. Stop asking how to get started 2. Learn to code (NOT PYTHON) 3. Do something 4. Expect failure Have a nice day.

Writing an Independent Malware There’s no greater feeling when the malware (or any project/tool) you’re developing works as expected. Until suddenly you realized it only works on your dev machine but not on any other machine.

🦀 | RustRedOps is a repository dedicated to gathering and sharing advanced techniques and offensive malware for Red Team, with a specific focus on the Rust programming language.

Malware for education Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

Unorthodox and stealthy way to inject a DLL into the explorer using icons [ GitHub ] @source_byte #malware_dev #windows

Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids)

TrollUAC • .NET library that serves as a UAC bypass for x64 • Any* process with the uiAccess flag enabled can "Send Keystrokes" to high integrity processes even from medium integrity • We steal the token of On Screen Keyboard (uiAccess enabled) to spawn a new process that does GUI automation • The GUI automation simply sends keystrokes to taskmgr (auto elevate) to spawn our new desired process in high integrity • *Refer to tiraniddo's article for requirements, although they can easily be conjured up

Golang Virus Example

ExfilDocs Searches drive for specific file extensions Uploads files to C2 via SSH Outlook Exfil Asks for Outlook Credentials Authenticates via IMAP, searches attachments and uploads files to C2 via SSH TO DO: Fix Windows Compilation Screen Shotter Uploads screenshot every 20 seconds to C2 via SSH Dropper Hosts 3 files, downloads them from itself then executes them.

[ GitHub ] Process Injection Techniques with Golang [ GitHub ] Proof of concept SMB C2 using named pipes in Golang [ GitHub ] DLL creation and injection with Golang [ Medium ] ColdFire II(Golang malware development library) [ GitHub ] A POC Windows crypto-ransomware (Academic). Now Ransom:Win32/MauriCrypt.MK!MTB [ GitHub ] Windows Botnet written in Golang [ GitHub ] @source_byte #malware_dev #go

Golang Virus Example

ExfilDocs Searches drive for specific file extensions Uploads files to C2 via SSH Outlook Exfil Asks for Outlook Credentials Authenticates via IMAP, searches attachments and uploads files to C2 via SSH TO DO: Fix Windows Compilation Screen Shotter Uploads screenshot every 20 seconds to C2 via SSH Dropper Hosts 3 files, downloads them from itself then executes them.

[ GitHub ] @source_byte #malware_dev

:(

https://github.com/shreyaschavhan/advanced-sql-injection-for-awae Learning a lil' bit of SQL #github  #SQL

Cloud-Based Identity to Exfiltration Attack Part2 Today, I would like to showcase some detection insights regarding attacks, starting from cloud-based identity attacks and extending to compromised Office 365 environment. https://github.com/LearningKijo/SecurityResearcher-Note/blob/main/SecurityResearcher-Note-Folder/Day16-CloudId-Exfiltration-AttackReport-Part2.md

Cloud-Based Identity to Exfiltration Attack Part1 As I've divided this blog into two parts, this part focuses on Part 1, examining cloud-based identity attacks leading to successful logins to Outlook activities. https://github.com/LearningKijo/SecurityResearcher-Note/blob/main/SecurityResearcher-Note-Folder/Day16-CloudId-Exfiltration-AttackReport-Part1.md