Ap3x @Ap3xSec

C2 Redirectors: Advanced Infrastructure for Modern Red Team Operations. xbz0n.sh/blog/c2-redire… TLDR: The blog is about setting up and using different types of C2 redirectors. #c2 #Infrastructure #redirectors

@bouldersec Does this group have a Discord group?

When I'm conducting my own research on infosec topics and stumble upon interesting blogs, white papers, talks, or books, I feel both humbled and motivated, as if I'm walking in the footsteps of giants.

okay, hear me out. it's NOT hard to achieve whatever you're pursuing in life. whatever you're trying to do right now, anyone with a braincell and an internet connection can do it. the difference between them and you is that they're taking consistent action every single day. they're not just dreaming or talking about it; they're grinding, learning, and adapting. they're willing to fail, learn from those failures, and keep pushing forward. they don't let fear or doubt paralyze them. they're seeking out knowledge, connecting with mentors, and leveraging resources. success isn't reserved for the exceptionally gifted or lucky; it's for those who are relentless, resilient, and resourceful. stop overthinking, start executing, and watch how quickly things start to change. it's not about being perfect but it's about making progress, however small, every day. you have the tools, you have the capability. now, it's time to take action and make it happen. EVERYONE faces obstacles and setbacks, but the ones who succeed are those who view these challenges as opportunities to grow. they don't waste time on excuses or blame; they take ownership of their journey and stay focused on their goals. they're not afraid to step out of their comfort zones and take risks, knowing that real growth happens when you push beyond your limits. they understand that every step forward, no matter how small, brings them closer to their dreams. they're not waiting for the perfect moment; they're making the moment perfect by taking action now. they prioritize their time, cut out distractions, and stay disciplined. they're not bogged down by analysis paralysis; they make decisions, learn from the outcomes, and keep moving forward. so, if you're serious about achieving your goals, stop waiting for a miracle and start creating your own. the only thing standing between you and your success is the action you're willing to take. make today the day you start making your dreams a reality. there's a reason why I went from being a depressed, loser girl with no future ahead to someone who's actually taking action on myself, someone who moved to a new country by themselves and someone who can finally say they're making money. and all of that within 6 months. it's not because I suddenly became smarter or luckier; it's because I decided to stop making excuses and start taking control of my life. I set clear goals, broke them down into actionable steps, and committed to working on them. I faced my fears head-on, embraced the discomfort of change, and refused to let setbacks define me. I surrounded myself with positive influences, sought out mentors, and consumed knowledge like my life depended on it, and guess what...... because it did. the only person who could change my life was me, and I wasn't going to wait around for someone else to save me. I took risks, made sacrifices, and stayed focused on my vision. I learned to be patient with myself, understanding that progress takes time and that every small step forward is a victory. I stopped comparing myself to others and started competing with the only person who actually matters: myself. I found strength in my struggles and I continue to use my past as fuel to drive me forward. I celebrate my wins, no matter how small, and use them as fuel to keep going. I keep my eyes on the prize, staying disciplined and determined even when the road gets tough. you are NOT alone, you are NOT hopeless, and you are NOT stuck. there are countless people out there who've faced similar challenges and emerged stronger. you have a community of dreamers, doers, and fighters who understand what you're going through and are cheering for your success. reach out, connect, and find your tribe. share your journey, your struggles, and your triumphs. you’ll find that support and encouragement can come from the most unexpected places. life is full of ups and downs, but it’s the persistence through the downs that defines your path. stay committed to your vision, keep pushing forward, and don’t let temporary setbacks deter you from your ultimate destination. your dreams are within reach if you’re willing to work for them. so take a deep breath, gather your strength, and step boldly into your future. you have the power to change your narrative, to create a life that excites and fulfills you. believe in your potential, take consistent action, and watch as you transform into the person you’ve always aspired to be. your journey is uniquely yours, and every step you take is a testament to your resilience and determination.

Security analysis of Windows cldflt.sys driver Credits Chen Le Qi (@starlabs_sg) starlabs.sg/blog/2023/11-e… #Windows

Debugging and Intel PT-ing the secure kernel and hypervisor by @AlanSguigna . The particular demo starts at around here youtu.be/9utI4qKCWH4?t=… I look forward to he and @ivanrouzanov 's session at @reconmtl too

Stephen Sims @Steph3nSims

2 years ago

Getting Started with Debugging Hyper-V for Vulnerability Research, Part 2. x.com/i/broadcasts/1…

0 26 122 36K 63

Turns out, if you teach an entire generation of programmers to “never reinvent wheels”, you get an entire generation of programmers who are unable to invent new & better wheels, or who are incapable of maintaining the wheels that already exist

ThePrimeagen @ThePrimeagen

2 years ago

"don't recreate the wheel" this phrase in software has caused more problems than it solved

196 276 4K 513K 192

I wrote a blogpost on injecting code into a PPL process on Windows 11, without abusing any vulnerable driver. blog.slowerzs.net/posts/pplsyste…

If you are facing an EDR with PEB protection/obf which makes Ldr inaccessible & want to inject shellcode, just pass the VA of LoadLibrary (which is consistent across processes) to the shellcode via egg-hunting from your injector, enabling lib resolution without touching the PEB

Want to download VMware Fusion Pro and Workstation Pro for free? I wrote up a short guide to quickly navigate the new Broadcom support portal... mikeroysoft.com/post/download-…

blogs.vmware.com/workstation/20…

Changes on EVERY page, new chapter "Cryptocurrency cryptography" inc. PoW, algebraic hashing & Poseidon, multi-signatures, threshold signatures, zero-knowledge proofs, and more. NEW: section about Ed25519; the new Linux PRNG; NIST's PQC standards nostarch.com/serious-crypto…

Great streams coming up on the Off By One Security Channel from @FuzzySec, @haxorthematrix, @yarden_shafir, @AlanSguigna, @jstrosch, and more coming soon!! Please let me know what additional topics you'd like to see? Join our Discord Server here: discord.gg/offbyonesecuri…

George Hotz says that everyone should learn C and Assembly.

PoC Exploit Released for 0-day Windows Kernel of Privilege Vulnerability (CVE-2024-21338) : github.com/Nero22k/Exploi… github.com/hakaioffsec/CV… Details : hakaisecurity.io/cve-2024-21338…

We posted our third writeup of N-day full chain series: Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System medium.com/theori-blog/ch…

@kyREcon This is cringe. He doesn't explain what he bypassed or even a high level overview how he bypassed CS. This is a frequent thing on LinkedIn.

Watching people tweet they bypassed a certain EDR is just cringe at this point. When you ask them what did they bypass, they dont know what. So let me take you back to school... Executing OpenSource tool is not a bypass. An EDR employs several mechanisms for detection. Getting a new implant for a twitter image is not evasion. To have a proper bypass, several conditions must be met. Lets see... 1. When you say you bypassed an EDR, what did you pass? Initial connection? Post-ex? Userland unhooking of DLLs? DLL callbacks? Exception handlers? Kernel hooks? Userland ETW or Kernel ETW? Yaras? If you didnt test any of this, how do you know that you bypassed it. 2. I know EDRs which simply allow connection and monitor it to gather more intel on threats, but will kill the implant upon interaction with local env. 3. The implant must be executed in the form of an initial access like an actual RT/TA would do. 4. All EDR functionalities must be enabled including internet for ML anomalies 5. Did you interact with the implant after getting a shell? Most EDRs will kill you on the moment of interaction with local files or processes due to call-stack scanning. 6. Does your implant leave "shouting traces" of "I exist" in memory which can be traced with a simple process monitor with a memory dump? Most importantly, have you ever reversed the EDR or its modules to understand what exactly is happening in the back end? Do you even know "WHAT" is actually being detected by the EDR? On the other hand, I just woke up and I guess I chose voilence today. So time to go back to sleep 😂.