DEVEXPL🧠IT

Windows Heap Exploitation - From Heap Overflow to Arbitrary R/W https://mrt4ntr4.github.io/Windows-Heap-Exploitation-dadadb/

🪟 CVE-2025-50168: Windows 11 LPE Exploit Windows win32kbase Type Confusion Local Privilege Escalation Vulnerability (CVSS 8.8). Pwn2Own Berlin 2025 winning bug. Blog: https://www.oobs.io/posts/four-bytes-one-lie/

Android backdoor hijacks Telegram accounts, gaining complete control over them ☢️https://news.drweb.com/show/?i=15076&lng=en&c=5

🧠 t.me/Devexploit

Streamlining Vulnerability Research with the idalib Rust Bindings for IDA 9.2 https://hex-rays.com/blog/streamlining-vulnerability-research-idalib-rust-bindings

🧠 t.me/Devexploit

Windows API Arsenal 🔥 FAUT.L Reverse Engineering Reference 🔥 https://blog.fautl.com/api-list.html

🧠 t.me/Devexploit

Binary Exploitation 101 ☢️ https://r1ru.github.io/categories/binary-exploitation-101/

🧠 t.me/Devexploit

Reverse Engineering for Noobs ☢️ https://aceresponder.com/blog/reversing-for-noobs

🧠 t.me/Devexploit

APT28 Operation Phantom Net Voxel ☢️ https://blog.sekoia.io/apt28-operation-phantom-net-voxel/

🧠 t.me/Devexploit

☢️ https://blog.elmo.sg/posts/breaking-disassembly-through-symbol-resolution/

🧠 t.me/Devexploit

☢️ https://cybersecuritynews.com/whatsapp-0-click-vulnerability-exploited/

🧠 t.me/Devexploit

☢️ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/

🧠 t.me/Devexploit

Hunting Bugs in Linux Kernel With KASAN: How to Use it & What's the Benefit? ☢️ https://slavamoskvin.com/hunting-bugs-in-linux-kernel-with-kasan-how-to-use-it-whats-the-benefit/

🧠 t.me/Devexploit

How to Perform Clipboard Forensics: ActivitiesCache.db, Memory Forensics and Clipboard History ☢️ https://www.inversecos.com/2022/05/how-to-perform-clipboard-forensics.html?m=1

🧠 t.me/Devexploit

Bypassing EDR using an In-Memory PE Loader ☢️ https://g3tsyst3m.com/fileless%20techniques/Bypassing-EDR-using-an-In-Memory-PE-Loader/

🧠 t.me/Devexploit

Reverse engineering undocumented Windows Kernel features to work with the EDR ☢️ https://fluxsec.red/reverse-engineering-windows-11-kernel

🧠 t.me/Devexploit

Notepad++ DLL Hijacking Vulnerability Let Attackers Execute Malicious Code ☢️ https://cybersecuritynews.com/notepad-hijacking-vulnerability/amp/

🧠 t.me/Devexploit

Intro to Syscalls & Windows internals for malware development: ☢️ 1- https://medium.com/%40amitmoshel70/intro-to-syscalls-windows- internals-for-malware-development-pt-1-b5bb0cd90c52 ☢️ 2- https://medium.com/@amitmoshel70/intro-to-syscalls-windows-internals-for-malware-development-pt-2-b8d88bb10eb9

🧠 t.me/Devexploit

New EDR-Freeze Tool That Puts EDRs and Antivirus Into A Coma State. ☢️ https://cybersecuritynews.com/edr-freeze-tool/ ■■■■□ The EDR-Freeze tool is a proof-of-concept exploit that leverages Windows' built-in components to suspend EDR and antivirus processes into a "coma" state, effectively rendering them inactive without installing any third-party drivers. Mechanism: 1. MiniDumpWriteDump API: This function, part of the Windows DbgHelp library, is designed to create memory dumps by suspending all threads of a target process. 2. Bypassing PPL Protection: EDR and antivirus processes are typically protected by Protected Process Light (PPL). The tool utilizes WerFaultSecure.exe, a component of the Windows Error Reporting service, which can run with WinTCB level protection, allowing it to interact with these protected processes. 3. Race Condition Attack: After initiating WerFaultSecure.exe to create a memory dump, the tool monitors the target process. Upon detecting that the target process has entered a suspended state, the tool immediately suspends WerFaultSecure.exe. This prevents the completion of the memory dump, leaving the target process in a suspended state indefinitely. Usage: Parameters: The tool requires two parameters: the Process ID (PID) of the target process and the duration of the suspension in milliseconds. Example: On Windows 11 24H2, the tool successfully suspended the MsMpEng.exe process of Windows Defender. Detection and Mitigation: Monitoring: Defenders should monitor for unusual executions of WerFaultSecure.exe, especially when targeting sensitive processes like lsass.exe or EDR agents. Preventive Measures: Implementing tamper protection, maintaining stringent role hygiene in Windows security settings, and ensuring systems are up to date can help mitigate the risk of such attacks. This technique offers a stealthier alternative to traditional methods like Bring Your Own Vulnerable Driver (BYOVD) attacks, as it does not require introducing vulnerable drivers onto a target system.

🧠 t.me/Devexploit

Enumerating Windows clipboard history in PowerShell ☢️ https://devblogs.microsoft.com/oldnewthing/20230303-00/?p=107894

🧠 t.me/Devexploit

☢️ More Fun With WMI Win32_Process has been the go to WMI class for remote command execution for years. In this post we will cover a new WMI class that functions like Win32_Process and offers further capability. ☢️ WMI_Proc_Dump.py Dump processes over WMI with MSFT_MTProcess ☢️ mtprocess.py Python script that uses Impacket to use the MSFT_MTProcess WMI class to execute a command. If wanting to use against a Workstation it can install the provider.

P.S. One more way to dump LSASS.

🧠 t.me/Devexploit