This report was written for a job interview ( spoiler alert: I didn't get it ) and has been sitting in my notes for half a year. windows-sandbox-init was used to create this report. Executive Summary I confirmed the file is malicious. It functions as a downloader designed to fetch and execute …
Introduction Beacon Object Files (BOFs) have revolutionized the way we execute code in memory on Windows systems, particularly within the Cobalt Strike framework. As you may know, I have been working on my own C2 framework, emp3r0r , which aims to bring similar capabilities to Linux environments. In this post, I …
TL;DR The source code of this module is available in emp3r0r . Pure C Shellcode : I implemented a full ELF loader and network stack in C, using direct syscalls to avoid libc dependencies. True In-Memory : Uses mmap to manually map segments, avoiding memfd_create and disk I/O. Stealth : Randomizes ELF …
Introduction This article is not just about analysing a malware sample, it's more about sharing my malware analysis methodology in general, and the sample I used has some interesting characteristics that make it a good candidate for demonstration. The sample is from a Chinese APT group known as RedDelta. The …
TL;DR emp3r0r is a C2 framework written in pure Go. For many years, I have been building it without CGO because of annoying dependencies (glibc) that prevent the agent from running on some systems, that also ruled out the possibility of using CGO to compile agent in DLL or …
I was called to handle an incident in which a malicious IP address is accessed each time the system boots. They couldn't find out what process is making the connection. Using one of the BCC eBPF tools called tcpconnect.py , I was able to locate the malicious process that's disguised …
Unified Kernel Image Read Arch Wiki for details. You can generate a UKI via mkinitcpio , first edit its linux.preset config file: # mkinitcpio preset file for the 'linux' package #ALL_config="/etc/mkinitcpio.conf" ALL_kver="/boot/vmlinuz-linux" ALL_microcode=(/boot/*-ucode.img) PRESETS=('default' 'fallback') #default_config="/etc/mkinitcpio.conf" default_image="/boot/initramfs-linux …
背景 差不多三年前，我读了一篇关于 sshd 进程注入和密码窃取的 文章 ，然后在作者的基础上实现了一个自动化的 SSH 密码收 …
Graphics in Qemu Performance Impact of SPICE+VirGL I have been using libvirt (virt-manager) for years, until recently I tried to run Linux VMs with Qemu directly using virgl . Running a Linux VM with Qemu's SDL display is much smoother than SPICE+VirGL solution provided by virt-manager, it made me …
For Windows PCs, it's very likely that they are already configured to use secure boot. The main benefit of secure boot for desktop users is they are protected from malicious code that hijacks the boot process of Windows OS, known as "bootkit". If you want protection from physical threat (that …
Understanding Windows Console Host If you open cmd.exe or powershell.exe in Windows, you will always find conhost.exe alongside them. As a matter of fact, conhost.exe has been around for more than a decade. Every (console based) Windows program has a "console" with them, for example when …
Let's talk about hacking in Linux Unlike Windows, who is well known for keeping backward compatibility, most Linux distros simply don't care about this, it's very common that different distros use different system utilities, different libraries, even the most critial one --- C standard library. Most Linux distros are based on …
shared library injection with gdb (yes i have compiled a fully static gdb), we can easily perform the injection by invoking dlopen in target processes, since most processes on a Linux machine are linked with glibc , this will work for almost every process, including systemd according to https://magisterquis.github …
what we can do with ssh ssh to target host for remote shell access sftp to target host for FTP service ssh -D for socks proxy ssh -L / ssh -R for port mapping all these features are provided by openssh suite, which we use everyday. why not integrate them into …
Terminology Port It can be really confusing as we know "port" as in TCP/UDP context, but here in layer 2 (data link) context, a "port" is equivalent to an " interface " in Linux language. When we talk about ports of a bridge, we are talking about different interfaces that may …
Why In macOS and Linux world, users can configure their mouse scroll direction conveniently with a provided settings UI or human readable config file. In Windows it's a completely different story, you won't find anything in settings UI, and Windows doesn't use config files, instead, it uses registry (which everybody …
how do i know original post here (QQ 正在尝试读取你的浏览记录) the following content is based on QQ 9.0.4 see what qq does with procmon i think theres one thing many people tend to ignore, you can view target …
____ ___ |___ \ / _ \ ___ _ __ ___ _ __ __) |_ __| | | |_ __ / _ \ '_ ` _ \| '_ \|__ <| '__| | | | '__| | __/ | | | | | |_) |__) | | | |_| | | \___|_| |_| |_| .__/____/|_| \___/|_| | | |_| i will post further updates here, for convenience (pinned) updates emp3r0r - 0x00 : capabilities, (planned …
Process Injection In Linux Background The techniques covered in this article are part of emp3r0r project. Linux has something that other platforms don't, the procfs , as Unix people always like to say " Everything is a file ". From /proc/pid/maps we can read the process's memory mappings, and with /proc …
intro from what i have heard of, pentesters/hackers manually set up their port mapping in their target networks, some people would even use iptables please allow me to save you from those shitty works with emp3r0r when an agent lands on a host, it checks if there were internet …
TL;DR The source code of this idea is available on GitHub And the weaponized version is available in emp3r0r Use echo 'print __libc_dlopen_mode("/path/to/library.so", 2)' | gdb -p <PID> for process injection Write a shared library to inject into sshd process In the library, fork a child …
See also Weaponized shared library injection Shellcode injection 101 Emp3r0r Dynamic Linker/Loader - Make an ELF load specific libraries Intro Strictly speaking, this is not the process injection you are expecting. Abusing ld.so can help you get your shared object (library) loaded in future processes the ELF file might …
my struggle i was trying to implement proxy support in emp3r0r , but found that http2.Transport has no such option. the only option that might work is replacing DialTLS() function with a custom one i did a lot of research: x/net/http2: support http2 proxy connections the dialer hack …
TL;DR (2021-06-09) AppleSMC is a kernel module that communicates with SMC (System_Management_Controller), and the SMC is basically an Apple co-processor that has its own firmware, used to manage the upper layer system including disk encryption, etc. I was able to dig into AppleSMC 's backtrace and locate the spot …
Stop Deleting Everything! many folks like to rm -f /var/log/*tmp , which I have to say is not a right way to cover your trail, if the admin would ever think of checking login logs, an empty log will certainly catch his attention but *tmp files are all binary …
Lost Your Way? This page is intentionally left blank.
this is the setup of my AD domain: install Active Directory Domain Services (AD DS) install using server manager assuming you are using Windows Server 2012 or later, in the server manager window, click Manage -> Add roles and features DNS Server will be installed as well i dont want to …
this part is about port forwarding/mapping port forwarding is extremely useful when you need to access targets lying deep inside victim's network as this simple diagram suggests, you can use port-fwd to redirect an RDP server that cannot be reached from outside linux targets are usually either IoT devices …
switching to prompt_toolkit python's readline module sucks heres how: python's readline cannot handle ANSI color codes properly, when i try to use ANSI color code in the prompt message, history browsing (via up/down key) fucks the prompt up here's the code, it's from python's doc, i made a small …
this part is about reverse shell --> how to make your reverse shell suck less take a look at pentestmonkey's Reverse Shell Cheat Sheet , which gives you a collection of reverse shell one-liners. each of the one-liners does the same thing -- establish a TCP connection to you, then execute a shell …
su -c is convenient to use, but, when you use it in your LPE exploit, hoping it to execute your command, you will probably get su: must be run from a terminal the obvious solution is give it a "terminal" to run from there's a forkpty function provided by pty …
happy Chinese new year! the coronavirus outbreak in Wuhan keeps me from going outside, actually i have cancelled all travel plans in this holiday. what do i do at home then? get_root this module can help you get root via: kernel exploits userland LPE exploits, such as exim, sudo previously-implemented …
this is a demo of the shell feature that im working on, it supports remote file editing, and FTP-like file get/put, among other things
UPDATE: windows update thinks my computer is lacking killer software, it keeps installing the shit back... why the fuck do i need the dumb ass killer network service??? i want to ask you, my dear readers, do you want the fucking killer network service to "examine" every packet sent from …
how to disable WP when cr0 is "pinned"? you can read my previous article according to this stackoverflow question , we cannot: disable CR0's Write-Protection bits set RO page to RW i think ive found a solution: since lkm runs in ring0, why not just write to cr0 directly, why bother …
this commit makes write_cr0(read_cr0() | 0x10000) useless, next time you see a 5.x linux kernel, good luck according to this stackoverflow question , we cannot: disable CR0's Write-Protection bits set RO page to RW i think ive found a solution: since lkm runs in ring0, why not just write to …
Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code how ss/netstat fetch TCP/UDP connections lets do a strace netstat -antu : ... openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY) = 3 read(3, " sl local_address rem_address "..., 4096 …
Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code what you will learn how to hide files how to hide processes how to hide them better so they cant be bruteforced asmlinkage and related reversing …
Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code what you will learn what system calls are how to hijack them how to hook syscalls what? to make the magic work, you have to deceive …
Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code what to expect i plan to write a rootkit that runs in both kernel and user space, in which case it: requires root when using LKM …
what is ptrace ptrace() system call stands for process trace , which provides a way for debuggers such as gdb/strace to control a process (tracee). "debuggers" can be any process that sends a PTRACE_ATTACH / PTRACE_SEIZE , or receives a PTRACE_TRACEME from its child. several things to notice: a tracee's ptrace relationship …
一． 漏洞背景 Vim和Neovim是Unix类操作系统下广泛使用的文本编辑器，其中后者的开发基于前者。 Vim/Neovim中的modeline功能可以让用户在文本文件的开头或结尾使用特定代码来控制编辑器的一些行为。这个功能被限制到仅能执行特定set指令，且有沙箱隔离，但:source!指令却可以用来绕 …
中文版已发Freebuf theres no posts about this cve as far as i know, and the original advisory is just too difficult for newbies like me, so.. warm up whats user namespace lets assume you use linux, man user_namespaces will give you what you need in case …
paramiko has an auth bypass vuln (found in March 2018), ie. CVE-2018-7750 which can be leveraged to execute arbitrary command (if the ssh server implementation supports command execution) affects anything that uses paramiko for ssh implementation, we can do things on it, unauthed exploit https://github.com/jm33-m0/CVE-2018-7750 # Exploit …
有个中文版在Freebuf，需要的可以去看看 dig deeper into user space lets abuse inits the INIT a lot of script kiddies know how to write their own SysV service file or modify the existing ones, fortunate for them, SysVinit is still …
hi all, ive created new PGP key for my personal email address, and the old one 73690B57 is being deprecated ill not respond to unencrypted emails also, feel free to exchange public key in the comment section
xhost +si:localuser:root
why tmux i believe anyone who is new to tmux can be frustrated by its "ugly" user interface and weird key bindings (especially those who don't use vim very often). "why the hell is this ugly terminal tool called a productivity tool?", well, just like vim/zsh, with a little …
this transparent proxy depends on iptables, which means generally you can only use it on Linux what you are getting an always-on proxy that redirects all TCP/UDP traffic to your Shadowsocks proxy while bypassing a list of IP ranges a clean connection to foreign DNS server, bye bye DNS …
i was living near my campus for the whole last month, because of which, i barely felt anything when everyone was saying goodbye to each other. i could still go to my school for food or fun, just like before. the only difference i noticed, was that i can never …