Malware development, low-level internals, and offensive security research.
All posts mirrored from Medium · @s12deff↗
Welcome to this new Medium post, today we are looking at this technique: use a vulnerable driver’s read/write primitives to promote a usermode page to supervisor executable via PTE manipulation, then…
Welcome to this new Medium post, today we are going to explore MiniFilter driver enumeration from usermode, a reconnaissance primitive that maps every filesystem interception driver registered on a…
Welcome to this new Medium post. Today we are looking at a shellcode execution technique that abuses the Windows thread pool ( CreateThreadpoolWait) to dispatch shellcode on a worker thread.The…
Welcome to this new Medium post, in this one we will see how to steal plaintext Windows credentials at the logon screen by abusing the Credential Provider COM interface and hooking internal WinRT…
Welcome to this new Medium post, today we are going to explore Blockchain C2, a command and control channel that uses smart contracts deployed on an EVM blockchain to deliver commands to implants,…
Welcome to this new Medium post, in this one I’ll show you how to identify a driver vulnerability that allows reading and writing arbitrary physical memory, without naming the specific driver.You’ll…
Welcome to this new Medium post. In this one we will see how to perform a silent DoS against a kernel driver by nulling its DeviceObject pointer using a BYOVD kernel read/write primitive.We target…
Welcome to this new Medium post, today we are going to explore IRP Dispatch Table Overwrite, a BYOVD technique that locates a driver object by walking the Windows Object Manager namespace and blinds…
Welcome to this new Medium post, in this one we will see how to obtain a valid process handle without ever calling OpenProcess. We will use NtGetNextProcess, an undocumented NT API that lets us…
Welcome to this new Medium post, today we are going to explore how to suspend and freeze Windows processes using Job Objects, a less known primitive that lets you halt an entire process without…
When I first launched 0x12DarkSandbox, the free tier existed mostly as a taste of the product: one scan, then you were expected to buy credits. That made sense for getting the first users in, but it…
Welcome to this new Medium post, today we are looking at AES in CBC mode, how to encrypt data with the Windows Bcrypt and how to decrypt it at runtimeIf you are building a loader or dropper, you…