Post #38
878
PENTEST_AD.pdf35.6 MB
#pentest #AD #windows
Channel Public Channel
ＳＥ Ｓｅｃ Ｎｏｔｅ
@secnote
- Subscribers
- 2.89K
- Photos
- 141
- Videos
- 9
- Links
- 234
Showing posts older than #39 · Back to latest
Older Posts 20 shown
Post #37
877
Windows Anti-Debug techniques - OpenProcess filtering
"OBREGISTERCALLBACKS AND COUNTERMEASURES"
Debugging AV
"OBREGISTERCALLBACKS AND COUNTERMEASURES"
Post #36
736
Post #35
758
Ｓｅｃ Ｎｏｔｅ pinned «The .NET Export Portal Via XPN A while back I published a post looking at how to craft a .NET assembly which exposes managed code via DLL exports, RunDLL32 your .NET. While working on some tooling recently I revisited this topic and wanted to know just why…»
Post #32
732
Feeling overwhelmed trying to learn security research? (Analyzing the PayloadRestrictions.dll Export Address Filtering)
#research #reverse #internals
Check out the "Process of Step-by-Step" by Yarden Shafir — a great resource that breaks it down clearly.
#research #reverse #internals
Post #31
629
Forwarded from Order of Six Angles
fluxsec.red Windows 11 Alternate Syscalls Deep Dive A comprehensive technical walkthrough of Windows 11 Alternate Syscalls: allocating executable thunks, building the dispatch table, patching PspServiceDescriptorGroupTable, handling PspSyscallProviderServiceDispatchGeneric, and caching syscall arguments. Includes… Post #29
704
New blog on using CLR customizations to improve the OPSEC of your .NET execution harness. This includes a novel AMSI bypass that identified by author in 2023. By taking control of CLR assembly loads, we can load assemblies from memory with no AMSI scan.
https://github.com/passthehashbrowns/Being-A-Good-CLR-Host
Related Works and Resources
HostingCLR - Original implementation of CLR hosting
InlineExecute-Assembly - Original implementation of executing .NET assemblies as a BOF
Dealing with Failure: Failure Escalation Policy in CLR Hosts – This is the only real example I could find of offensive tradecraft using CLR Customizations when I was initially doing this research.
Hosted Pumpkin – A GitHub repository containing a proof-of-concept for implementing several CLR Customizations.
Shellcode: Loading .NET Assemblies From Memory – Donut was a great deal of help in wrangling all of the relevant data structures and definitions in C.
Customizing the Microsoft .NET Framework Common Language Runtime by Steven Pratschner – This is the definitive text on CLR Customizations. Simply a must-read if you have any interest in this area.
#redteam #net #clr #dotnet
Proof-of-concept for the AMSI bypass and an implementation of a CLR memory manager is on GitHub. We can implement custom memory routines and track all allocations made by the CLR.
https://github.com/passthehashbrowns/Being-A-Good-CLR-Host
Related Works and Resources
HostingCLR - Original implementation of CLR hosting
InlineExecute-Assembly - Original implementation of executing .NET assemblies as a BOF
Dealing with Failure: Failure Escalation Policy in CLR Hosts – This is the only real example I could find of offensive tradecraft using CLR Customizations when I was initially doing this research.
Hosted Pumpkin – A GitHub repository containing a proof-of-concept for implementing several CLR Customizations.
Shellcode: Loading .NET Assemblies From Memory – Donut was a great deal of help in wrangling all of the relevant data structures and definitions in C.
Customizing the Microsoft .NET Framework Common Language Runtime by Steven Pratschner – This is the definitive text on CLR Customizations. Simply a must-read if you have any interest in this area.
#redteam #net #clr #dotnet
- 👾 2
Post #28
711
The .NET Export Portal
Via XPN
While working on some tooling recently I revisited this topic and wanted to know just why this works in the way that it does. After all, by now we’ve all seen the COM calls required to spin up the CLR, so what makes unmanaged exports so special?
#reverse
#dotnet
Via XPN
A while back I published a post looking at how to craft a .NET assembly which exposes managed code via DLL exports, RunDLL32 your .NET.
While working on some tooling recently I revisited this topic and wanted to know just why this works in the way that it does. After all, by now we’ve all seen the COM calls required to spin up the CLR, so what makes unmanaged exports so special?
#reverse
#dotnet
Post #27
673
Post #26
683
Post #25
755
Post #24
3.45K
Reversing A Tiny Built-In Windows Kernel Module [Journey from Kernel32 to HAL]
#reverse
#windows
Methodology
#reverse
#windows
- 👾 1
Post #23
2.09K
- 👾 2
Post #22
715
Decrease Entropy of shellcode
#shellcode
#evasion
The more predictable you are, the less you get detected - hiding malicious shellcodes via Shannon encoding
#shellcode
#evasion
- 👾 1
Post #21
657
Reverse Engineering on Windows Without Symbols or Source, Part Fun (One)
Other blogs
#reverse
#windows
Other blogs
Methodology
#reverse
#windows
- 👾 3
Post #18
596
Reversing Windows Internals (Part 1) - Digging Into Handles, Callbacks & ObjectTypes
If you want to follow other parts of this tutorial or other tutorials, please visit here.
#reverse
#windows
By the lovely Sina Karvandi
If you want to follow other parts of this tutorial or other tutorials, please visit here.
Methodology
#reverse
#windows
- 👾 2
Post #17
583
Ｓｅｃ Ｎｏｔｅ How_I_ruined_my_vacation_by_reverse_engineering_WSC_es3n1n's_Blog.pdf
Another blog from es3n1n
Obfuscating native code for fun: Part 1 - Introduction
Obfuscating native code for fun: Part 1 - Introduction
- 👾 2
Post #16
617
Post #12
634