inbits retweeted
Introducing Havoc Professional: A Lethal Presence
We’re excited to share a first look at Havoc Professional, a next-generation, highly modular Command and Control framework, and Kaine-kit our fully Position Independent Code agent engineered for stealth!
infinitycurve.org/blog/intro…
Managed to pick up my first CVE recently, in a Netskope driver. Simple bug but learnt a lot in the process. Hopefully many more to come this year!
inbits-sec.com/posts/cve-202…
Wrote a tool a few weeks ago to obfuscate a payload in a generated CSS file. Started off my career as a frontend dev - it's been years since i've looked properly at CSS and I can't say it was a happy reunion 😂
inbits-sec.com/posts/new-too…
Started using a separate rig for maldev/lab stuff to keep it separate from the gaming one and all that's really happened is I've ended up convincing myself I need to buy a whole new set of nice peripherals
Wrote up a post on some experiments #unhooking Falcon without using VirtualProtect:
inbits-sec.com/posts/in-memo…
AES decryption using the Cryptography API: Next Generation (CNG) instead of the CryptoAPI.
gist.github.com/inb1ts/e9aaa…
Been devouring the @SEKTOR7net maldev courses over the last few weeks. Wanted to build some other foundations before hitting maldev (OSCP/doing more C/bit of RE). Loving it now I’m here.
Been playing with using cbd.exe for execution after the @SentinelOne Metador report. @mrd0x has a great overview of some of the offsec capabilities, building on Matt Graber's work. Found a few possibly useless additions that I haven't seen mentioned elsewhere.
3. Ntsd.exe is identical to cdb.exe except that it launches a new console window. It seems to be mentioned less frequently as a LOLbin that cdb.exe (it's not listed on lolbas-project.github.io/# for example). Presuming this is because the extra window is less stealthy?