Windows of Opportunity
Exploiting race conditions in Seclogon to bypass PPL protections dump LSASS.
~/otter
Last 10 notes on ~/otter
Latest posts
Intro to Hypervisor Implants
How CPU virtualization extensions can be weaponized to build implants invisible to the host OS.
In-depth Windows Telemetry
A deep dive into ETW providers and how EDRs consume telemetry under the hood.
Gaining persistence on Windows with Time Providers
Abusing the W32Time service to load custom DLLs and persist through reboots.
Reverse engineering LSASS to decrypt DPAPI keys
Reversing how LSASS caches and decrypts DPAPI master keys in memory.
Dumping user data from Microsoft Recall
Extracting screenshots and activity data from Microsoft's unencrypted Recall database.