Recent content on am0nsec
To Hold Down a Pillow means not allowing the enemy’s head to rise. In contests of strategy it is bad to be led about by the enemy. You must always be able to lead the enemy about. Obviously the enemy will also be thinking of doing this, but he cannot forestall you if you do not allow him to come out. In strategy, you must stop the enemy as he attempts to cut; you must push down his thrust,…
Table of contents Table of contents Introduction User-Mode Application Kernel-Mode Driver Example: Listing Kernel Memory Pool Tag Final Thoughts Introduction Over the last few years that I spent learning more and more about Microsoft Windows, it has been more and more apparent that studying the NT kernel is an incredibly deep and vast subject, nevertheless particularly interesting. A lot of…
Archive of https://www.contextis.com/en/blog/amsi-bypass from 12 JUN 2019 Table of contents Table of contents Introduction How AMSI Operates Enumerating AMSI Functions Finding the Function’s Address Egg Hunter Patching Final Notes Introduction AMSI stands for Anti-Malware Scan Interface and was introduced in Windows 10. The name is reasonably self-explanatory; this is an interface that…
Archive of https://www.contextis.com/en/blog/bring-your-own-.net-core-garbage-collector from 19 JUN 2020. Table of contents Table of contents Introduction .NET Core Configuration Knobs Standalone Garbage Collector Environment Variable Path Traversal Building a Custom GC Application Whitelisting Bypass Scenario Remediation Timeline Introduction This blog post explains how it is possible to abuse a…
Archive of https://www.contextis.com/en/blog/common-language-runtime-hook-for-persistence from 22 AUG 2019. Table of contents Table of contents Introduction .Net Overview Common Language Runtime Application Domain and Application Domain Manager Assembly and Global Assembly Cache Wrapping Everything Up Identifying .Net Framework-Based Application Introduction This blog post explains how it is…
Archive of https://www.contextis.com/en/blog/dynamicwrapperex-windows-api-invocation-from-windows-script-host from 01 FEB 2021. Table of contents Table of contents Introduction COM and OLE Automation Basics Leveraging OLE Automation x86_64 Standard Calling Convention Registration-Free Activation Limitations and Operational Security Considerations Example of Shellcode Execution References…
Based on the recent events. In any active conflict, one difficult part is to stay factual and prevent actions and decisions based on emotions. However, being factual does not mean encouraging the war. It is just a requirement to be able to conduct critical thinking. Violence must stop; peace must prevail. В любом активном конфликте одна трудная часть — основываться на фактах и предотвращать…
Table of contents Table of contents SSE and AVX Mutation Idea (xlate) Streaming SIMD Extensions (SSE) Advanced Vector Extensions (AVX) AVX and the new VEX Translation between Legacy SSE to AVX Example 1: Basic 2-byte VEX Encoded Instruction Example 2: Basic 3-byte VEX Encoded Instruction with 64-bit Example 3: 3-byte VEX Encoded Instruction with SIB Example 4: With Non-Destructive Operand WIB and…
The virmaking is dying. Moreover, this process is about to reach the point-of-no-return. It is shown us in decreased number of ezines per year, in groups full of zombi-members, in no new viral techs produced, in decreased number of win32 viruses, in tons of scripts viruses, which all are one like another, and in zero interest in developing viruses, on the world level. It looks much more sadly,…
The mission dictates the target, the target dictates the weapons and the weapons dictate how they’re used. – Richard “Mac” Machowicz
There are methods to observe people and undoubtedly recognise the manner how they think and their character. We say that the Self closely listen the heart, observe him, that he can be seen and understood as an image in a mirror. The one who have a disturbed heart can be quickly be the victim of others. That’s why the shinobi use this technique and can follow everywhere the heart of the adversary…
By training you will be able to freely control your own body, conquer men with your body, and with sufficient training you will be able to beat ten men with your spirit. When you have reached this point, will it not mean that you are invincible? Gorin no sho – Miyamoto, Musashi
I know that I know nothing - ipse se nihil scire id unum sciat - ἓν οἶδα ὅτι οὐδὲν οἶδα - Socrates Life is nothing more than an endless wandering, it would be foolish if not childish to think we know everything, at any point in life. Embrace the constant unknown and be skeptical to sate a untarisable desire of knowledge.
Of course, the knowledge of computer viruses is like the “Force” in Star Wars. Depending on the user of the “Force”, the knowledge can turn to good or evil. I cannot force you to stay away from the “Dark Side”, but I urge you to do so. The Art of Computer Virus Research and Defense - Péter Szőr
Нас мало — юных, окрыленных, не задохнувшихся в пыли, еще простых, еще влюбленных в улыбку детскую земли. Мы только шорох в старых парках, мы только птицы, мы живем в очарованья пятен ярких, в чередованьи звуковом. Мы только мутный цвет миндальный, мы только первопутный снег, оттенок тонкий, отзвук дальний,— но мы пришли в зловещий век. Навис он, грубый и огромный, но что нам гром его тревог? Мы…
Я вас люблю, — хоть я бешусь, Хоть это труд и стыд напрасный, И в этой глупости несчастной У ваших ног я признаюсь! Мне не к лицу и не по летам… Пора, пора мне быть умней! Но узнаю по всем приметам Болезнь любви в душе моей: Без вас мне скучно, — я зеваю; При вас мне грустно, — я терплю; И, мочи нет, сказать желаю, Мой ангел, как я вас люблю!
Red Team. This is a very interesting topic; however, nowadays it this is used and abused, as a buzzword. The cyber security industry assisted by greedy salespersons managed to corrupt the true meaning of red teaming to sell services. In general IT and technology industries like buzzwords and will do whatever they can to catch attention because it brings people and with them money. Overall, it is…
Disinformation has many faces and is not only conducted by intelligence agencies. Many different groups and organisations conduct disinformation — sometimes without even knowing it. Especially because it always depends on the point of view. For example, adepts of conspiracy theories think that they are publishing the “truth” and that everyone else lie or refuse to see the reality (e.g., 11/9,…
One of the most well-known, hacking competition is Pwn2Own in Canada, Vancouver since 2007. During this event, held twice a year, researchers exploit vulnerabilities they found or find during the event – called 0days. These 0days are then analysed by the judges and a prize is (we are talking about thousands of dollars not a KitKat and a “thank you”) provided if valid. These vulnerabilities are…
Table of contents Table of contents Abstract Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 Operand-Size Override Legacy Prefix Abstract On an Intel or AMD processor, when executing code from a 64-bit code segment (i.e., CS segment descriptor CS[L] bit = 1b and CS[D] = 0b), the 1-byte REX (i.e., Register eXtended) prefix can be used to modify operand addressing and selection. This can be for one…
0x00 Abstract Application whitelisting and blacklisting is an interesting topic because depending on how it has been configured this can drastically increase the difficulty of an attacker to gain initial code execution. With Windows XP and Windows Server 2013, Microsoft released Software Restriction Policy (SRP), which was a great idea but a massive pain to configure with little to no flexibility.…
0x00 Abstract Over the past few months I have been using Cobalt Strike (CS) quite extensively, both during Simulated Attack engagements and for R&D and offensive security projects. I subsequently used more than what I expected the famous Aggressor script engine. Throughout the different versions of CS, Raphael Mudge developed multiple features that allow operators to extend the standard…
0x00 Abstract I used to be a Java/PHP/PolymerJS developer for 2 years before joining the wonderful information security industry and developing in C/C++ and C#. I’m probably not a great programmer but a least I’m documenting my code! Trust me, well documented code will save your butt. I have subscribed to a professional GitHub account few weeks back, which gave me access to the 3000…
0x00 Abstract Allowing direct access to named or un-named executive objects to user mode and kernel mode applications would be extremely dangerous as it would interfere with, and render the duty of the executive subsystems obsolete. As a result, this would put the whole system at risk and make the management of executive objects almost impossible. Additionally, executive objects resides in kernel…
I have been working as a cyber security consultant – professionally – since 2018. Today, I am involved in Simulated Attack (SA) operations (aka Red Team operations) and the development and improvement of the capabilities of my team. Technologically, my interests are around the following topics: Windows System Internals; x86 Instruction-Set-Architecture (ISA); Malware development and…
0x00 Abstract Almost all the actions carried out by user mode applications and Windows executive subsystems (e.g. I/O Manager, Memory Manager) have to deal with Windows resources (aka objects). These actions can be related to physical objects like devices or logical objects such as processes, threads, tokens and files. For this specific reason, the Object Manager, which is a executive subsystem,…
0x00 Abstract The 12th Jun 2019 I wrote a paper about the Anti-Malware Scan Interface technology. At this time, the objective was to dig into the AMSI internals in order to, firstly, understand how the technology works and, secondly, how it is possible to bypass AMSI by carrying out an in memory module function patching. This paper will not provide more information about AMSI and the patch will be…