Source Byte

winsos-poc: A PoC demonstrating code execution via DLL Side-Loading in WinSxS binaries. https://github.com/thiagopeixoto/winsos-poc.git

Аналог GetProcAddress, но написан на ассемблере. Гуд... https://github.com/WKL-Sec/FuncAddressPro #redteam #maldev #evasion

SyzRetrospector: A Large-Scale Retrospective Study of Syzbot credit : Ardalan Amiri Sani , Zhiyun Qian

#memes

The HKEY_CLASSES_ROOT (HKCR) key in the Windows registry is a merged view of the HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes keys. By default, only users with administrator privileges can modify the keys and values under HKCR. If a non-administrator user attempts to write to a key under HKCR, and the key already exists under HKEY_CURRENT_USER\Software\Classes, the system will store the information there instead of under HKEY_LOCAL_MACHINE\Software\Classes. However, writing directly to HKCR typically requires administrator access because it affects system-wide settings²³.

In the simplest terms possible, this registry hive contains the necessary information for Windows to know what to do when you ask it to do something, like to view the contents of a drive, or open a certain type of file, etc. HKEY_CLASSES_ROOT\.avi HKEY_CLASSES_ROOT\.bmp HKEY_CLASSES_ROOT\.exe HKEY_CLASSES_ROOT\.html HKEY_CLASSES_ROOT\.pdf HKEY_CLASSES_ROOT\AudioCD HKEY_CLASSES_ROOT\dllfile ... Each of these keys stores information on what Windows should do when you double-click or double-tap a file with that extension in File Explorer. It might include the list of programs found in the "Open with..." section when right-clicking/tapping a file, and the path to each application listed. For example, when you open a file called draft.rtf, WordPad might open it. The registry data that makes that happen is stored in the HKEY_CLASSES_ROOT\.rtf key, which defines WordPad as the program that should open the RTF file.

tl;dr modify shell open command (default) to malicious payload with subsequent invocation of text editor + parameters. The .txt file won't be malicious, but the thing responsible for opening them will be ¯\_(ツ)_/¯

"Can a .txt file be malicious?" Short answer: No Long answer: Anything is possible through the power of Windows HKEY_CLASSES_ROOT

Inspired Shell Obfuscatio https://github.com/CyberSecurityN00b/shellfeck

Linux internals https://youtube.com/playlist?list=PLSIUOFhnxEiC3YTdxwqZqgEY5imVL8U8J&si=kVQOBW8ZFk33yYM- https://youtube.com/playlist?list=PLOEpetqiDZSrfM_HYPe9l6RC782Ttul2H&si=9nk4B_uVAbL2VtSK https://youtube.com/playlist?list=PLsI2APLEA9Eq6z8zUlOJrqmc5KBwLTV4A&si=oW0Nqinw5PgTw27q

Kimsucky analysis part2 https://somedieyoungzz.github.io/posts/kimsucky-2/ #malware_analysis