DEVEXPL🧠IT
Відкрити в Telegram
Немає даних
Підписники
+724 години
+217 днів
+6930 днів
Триває завантаження даних...
Схожі канали
Хмара тегів
Вхідні та вихідні згадування
---
---
---
---
---
---
Залучення підписників
листопад '25лист '25
листопад '25
+40
в 0 каналах
жовтень '25
+71
в 0 каналах
Get PRO
вересень '25
+35
в 0 каналах
Get PRO
серпень '25
+94
в 0 каналах
Get PRO
липень '25
+53
в 0 каналах
Get PRO
червень '25
+19
в 0 каналах
Get PRO
травень '25
+85
в 1 каналах
Get PRO
квітень '25
+52
в 0 каналах
Get PRO
березень '25
+35
в 2 каналах
Get PRO
лютий '25
+33
в 2 каналах
Get PRO
січень '25
+64
в 0 каналах
Get PRO
грудень '24
+143
в 0 каналах
Get PRO
листопад '24
+357
в 0 каналах
Get PRO
жовтень '24
+419
в 1 каналах
Get PRO
вересень '24
+64
в 1 каналах
Get PRO
серпень '24
+266
в 1 каналах
Get PRO
липень '24
+80
в 4 каналах
Get PRO
червень '24
+164
в 2 каналах
Get PRO
травень '24
+242
в 5 каналах
Get PRO
квітень '24
+315
в 2 каналах
| Дата | Залучення підписників | Згадування | Канали | |
| 13 листопада | +1 | |||
| 12 листопада | +8 | |||
| 11 листопада | +5 | |||
| 10 листопада | +7 | |||
| 09 листопада | +7 | |||
| 08 листопада | 0 | |||
| 07 листопада | +2 | |||
| 06 листопада | +1 | |||
| 05 листопада | 0 | |||
| 04 листопада | +3 | |||
| 03 листопада | +1 | |||
| 02 листопада | +2 | |||
| 01 листопада | +3 |
Дописи каналу
Windows Heap Exploitation - From Heap Overflow to Arbitrary R/W
https://mrt4ntr4.github.io/Windows-Heap-Exploitation-dadadb/
| 2 |  🪟 CVE-2025-50168: Windows 11 LPE Exploit
Windows win32kbase Type Confusion Local Privilege Escalation Vulnerability (CVSS 8.8). Pwn2Own Berlin 2025 winning bug.
Blog: https://www.oobs.io/posts/four-bytes-one-lie/ | 334 |
| 3 | Android backdoor hijacks Telegram accounts, gaining complete control over them
☢️https://news.drweb.com/show/?i=15076&lng=en&c=5
🧠 t.me/Devexploit | 621 |
| 4 | Streamlining Vulnerability Research with the idalib Rust Bindings for IDA 9.2
https://hex-rays.com/blog/streamlining-vulnerability-research-idalib-rust-bindings
🧠 t.me/Devexploit | 605 |
| 5 | Windows API Arsenal
🔥 FAUT.L Reverse Engineering Reference 🔥
https://blog.fautl.com/api-list.html
🧠 t.me/Devexploit | 492 |
| 6 | Binary Exploitation 101
☢️ https://r1ru.github.io/categories/binary-exploitation-101/
🧠 t.me/Devexploit | 480 |
| 7 | Reverse Engineering for Noobs
☢️ https://aceresponder.com/blog/reversing-for-noobs
🧠 t.me/Devexploit | 724 |
| 8 | APT28 Operation Phantom Net Voxel
☢️ https://blog.sekoia.io/apt28-operation-phantom-net-voxel/
🧠 t.me/Devexploit | 583 |
| 9 | ☢️ https://blog.elmo.sg/posts/breaking-disassembly-through-symbol-resolution/
🧠 t.me/Devexploit | 484 |
| 10 | ☢️ https://cybersecuritynews.com/whatsapp-0-click-vulnerability-exploited/
🧠 t.me/Devexploit | 429 |
| 11 | ☢️ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/
🧠 t.me/Devexploit | 408 |
| 12 | Hunting Bugs in Linux Kernel With KASAN: How to Use it & What's the Benefit?
☢️ https://slavamoskvin.com/hunting-bugs-in-linux-kernel-with-kasan-how-to-use-it-whats-the-benefit/
🧠 t.me/Devexploit | 537 |
| 13 | How to Perform Clipboard Forensics: ActivitiesCache.db, Memory Forensics and Clipboard History
☢️ https://www.inversecos.com/2022/05/how-to-perform-clipboard-forensics.html?m=1
🧠 t.me/Devexploit | 578 |
| 14 | Bypassing EDR using an In-Memory PE Loader
☢️ https://g3tsyst3m.com/fileless%20techniques/Bypassing-EDR-using-an-In-Memory-PE-Loader/
🧠 t.me/Devexploit | 559 |
| 15 | Reverse engineering undocumented Windows Kernel features to work with the EDR
☢️ https://fluxsec.red/reverse-engineering-windows-11-kernel
🧠 t.me/Devexploit | 615 |
| 16 | Notepad++ DLL Hijacking Vulnerability Let Attackers Execute Malicious Code
☢️ https://cybersecuritynews.com/notepad-hijacking-vulnerability/amp/
🧠 t.me/Devexploit | 481 |
| 17 | Intro to Syscalls & Windows internals for malware development:
☢️ 1- https://medium.com/%40amitmoshel70/intro-to-syscalls-windows-
internals-for-malware-development-pt-1-b5bb0cd90c52
☢️ 2- https://medium.com/@amitmoshel70/intro-to-syscalls-windows-internals-for-malware-development-pt-2-b8d88bb10eb9
🧠 t.me/Devexploit | 593 |
| 18 | New EDR-Freeze Tool That Puts EDRs and Antivirus Into A Coma State.
☢️ https://cybersecuritynews.com/edr-freeze-tool/
■■■■□ The EDR-Freeze tool is a proof-of-concept exploit that leverages Windows' built-in components to suspend EDR and antivirus processes into a "coma" state, effectively rendering them inactive without installing any third-party drivers.
Mechanism:
1. MiniDumpWriteDump API: This function, part of the Windows DbgHelp library, is designed to create memory dumps by suspending all threads of a target process.
2. Bypassing PPL Protection: EDR and antivirus processes are typically protected by Protected Process Light (PPL). The tool utilizes WerFaultSecure.exe, a component of the Windows Error Reporting service, which can run with WinTCB level protection, allowing it to interact with these protected processes.
3. Race Condition Attack: After initiating WerFaultSecure.exe to create a memory dump, the tool monitors the target process. Upon detecting that the target process has entered a suspended state, the tool immediately suspends WerFaultSecure.exe. This prevents the completion of the memory dump, leaving the target process in a suspended state indefinitely.
Usage:
Parameters: The tool requires two parameters: the Process ID (PID) of the target process and the duration of the suspension in milliseconds.
Example: On Windows 11 24H2, the tool successfully suspended the MsMpEng.exe process of Windows Defender.
Detection and Mitigation:
Monitoring: Defenders should monitor for unusual executions of WerFaultSecure.exe, especially when targeting sensitive processes like lsass.exe or EDR agents.
Preventive Measures: Implementing tamper protection, maintaining stringent role hygiene in Windows security settings, and ensuring systems are up to date can help mitigate the risk of such attacks.
This technique offers a stealthier alternative to traditional methods like Bring Your Own Vulnerable Driver (BYOVD) attacks, as it does not require introducing vulnerable drivers onto a target system.
🧠 t.me/Devexploit | 724 |
| 19 | Enumerating Windows clipboard history in PowerShell
☢️ https://devblogs.microsoft.com/oldnewthing/20230303-00/?p=107894
🧠 t.me/Devexploit | 518 |
| 20 | ☢️ More Fun With WMI
Win32_Process has been the go to WMI class for remote command execution for years. In this post we will cover a new WMI class that functions like Win32_Process and offers further capability.
☢️ WMI_Proc_Dump.py
Dump processes over WMI with MSFT_MTProcess
☢️ mtprocess.py
Python script that uses Impacket to use the MSFT_MTProcess WMI class to execute a command. If wanting to use against a Workstation it can install the provider.
P.S. One more way to dump LSASS.
🧠 t.me/Devexploit | 496 |
