1 hour agoBlack Hat Arsenal 2023Hey all, just wanted to say I got accepted to present at Black Hat Arsenal again this year so if you attend Black Hat come stop by and say hello! https://www.blackhat.com/us-23/arsenal/schedule/index.html#glyph---an-architecture-independent-binary-analysis-tool-for-fingerprinting-functions-through-nlp-33622Cyberops1 min readCyberops1 min read
May 29Hyper-V Entire Host Disk AccessSo I quickly wanted to cover a quick little issue I came across over the past week. If a general user with non-administrative privileges has an administrator open Hyper-V Manager for them to access/manage/create a VM, process inheritance can lead to entire disk access. …Hyper V3 min readHyper V3 min read
Dec 23, 2022HTTP Covert Channels — Hiding C2 and exfiltration in plain sightI put together a quick little demo of covert channels over HTTP and why they can be not exactly easy to pick out when viewing network traffic. This is obviously a toy example and should not be taken as the end all to covert channels, an expert in the field…Obfuscation3 min readObfuscation3 min read
Dec 23, 2022Self Mutating Code: Obfuscation Fun — PART 02In part 01 of this blog post, I covered how you can utilize a function overwrite with shellcode to obfuscate code to make reverse engineering more difficult and to hide capabilities from anti-virus applications. In this addition, part 02, I will be covering additional capabilities utilizing network communications to send…C Plus Plus Language5 min readC Plus Plus Language5 min read
Dec 23, 2022Self Mutating Code: Obfuscation Fun — PART 01Reverse engineering code can be complicated enough, but what can make things really weird is when the instructions you see in code being called do not execute as you expect. …Coding4 min readCoding4 min read
Dec 22, 2022Reversing A Malicious Office Document — Part 02In Part 01 we tore apart a new Emotet variant’s malicious Office document dropper file, this time in part 02, lets take a look at the binary that’s downloaded by that Office document. File MD5 — ee15dbb42e1c2d8f5b3e2a8558994d54 The first thing I started with when analyzing this file was checking its…Malware Analysis4 min readMalware Analysis4 min read
Dec 22, 2022Reversing A Malicious Office Document — Part 01So as I mentioned, I was going to tear apart a document for fun and go over it on here. I like looking at malicious Office documents, for one, they still play a large part in infections mostly as droppers, as it was reported 43% of infections in 2020 were…Malware Analysis5 min readMalware Analysis5 min read
Dec 22, 2022Wavlink Quantum D4G Zero Day — Part 04Today’s post will be covering a combination of two vulnerabilities, resulting in an admin credential dump. Before we get into it, as always this material is for educational purposes and awareness, no unethical behavior with this information is encouraged. For the first part of this let us cover once again…IoT2 min readIoT2 min read
Dec 22, 2022Wavlink Quantum D4G Zero Day — Part 03So, here we are again with yet another fun zero-day found, and this time I wrote a little Python script to show a proof of concept for this exploit which will be provided. I am going to try to make this post short and sweet just to get to the…IoT3 min readIoT3 min read
Dec 22, 2022Wavlink Quantum D4G Zero Day — Part 02So I have started releasing zero days for the Wavlink Quantum D4G, as I mentioned in part one of this series, I attempted to contact the vendor with issues, and while they communicated with me, it seems they just kind of ignored the issues and stopped communications. So here we…Reverse Engineering3 min readReverse Engineering3 min read
