Security person who likes writing code
Joined August 2020
- Tweets489
- Following210
- Followers935
- Likes1.5K
Pinned Tweet
I'm finally releasing a project that I've been working on for a little while now. Here's Boflink, a linker for Beacon Object Files. github.com/MEhrn00/boflink
Supporting blog post about it. blog.cybershenanigans.space/…
Best $11 I've spent
colbaitstroke.com/
This quoted post is unavailable.
Matt Ehrnschwender retweeted
Open sourced my implementation of the Cobalt Strike UDC2 spec so more open source C2s can benefit from existing CS tooling
Adaptix PoC included with drop in support for existing UDC2s :D
github.com/CodeXTF2/OpenUDC2
Matt Ehrnschwender retweeted
We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
praetorian.com/blog/wasmforg…
#wasm #malware #sliver
Matt Ehrnschwender retweeted
Some interesting new "Agent account model" APIs/structures in the current Canary build (28020).
Not exported anywhere yet - looks like the new "IsoEnvBroker.dll" calls 4 of them via NdrClientCall3 (RPC) to LSARPC:
- 146 (LsarCreateAgentAccount)
- 147 (LsarRetrieveAgentLogonCredential)
- 148 (LsarEnumerateAgentAccounts)
- 149 (LsarDeleteAgentAccount)
Got a "Hello World" PE file down to 620 bytes using regular tooling without handcrafting it. Could probably get it a little bit smaller by swapping out DLL imports for syscalls
gist.github.com/MEhrn00/d77b…
Matt Ehrnschwender retweeted
Had some fun making this credential dumper BOF implementing the Silent Harvest mechanism from @haider_kabibo . Thanks to him as well as @R0h1rr1m for his SilentNimvest implementation of the research!
github.com/Octoberfest7/Sile…
Matt Ehrnschwender retweeted
wiretap-rs is a Rust port of Wiretap, a transparent, VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.
github.com/0xTriboulet/wiret…
Oh... well that's not good
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
I keep on forgetting how much of a joke C development is on Windows. They want to use wide strings for everything but can't even write a 'wprintf' function that works correctly. glibc on Linux and MinGW's ANSI stdio are right but ucrt is just broken
The notepad vulnerability reminds me of this post on how you can embed file:// URIs in OSC8 escape sequences xitter.cf/taviso/status/19456503…. Attempting to use procmon from sysinternals does not work through
This is one of the nice things I am aiming for with boflink. Removing the BOF specifics from the source code (DFR, restricted to a single TU) makes the code cleaner and allows access to higher level features like alloc::Vec and external libraries
Yet another sick contribution from one of the most cracked devs I have the privilege of knowing
github.com/joaoviictorti/rus…
Matt Ehrnschwender retweeted
I'm really proud of what Shane and I did here. I'm biased, but from the results I've seen, this is a hugely scalable way to improve offsec models.
It took a ton of engineering work to get it working, but the results speak for itself.
We fine-tuned an 8B model to pop a GOAD domain…using only synthetic training data. No real networks. No frontier model distillation. Just a world model that simulates AD environments and generates realistic pentesting trajectories.
See how @shncldwll and @0xdab0 did it: dreadnode.io/blog/worlds-a-s…
Matt Ehrnschwender retweeted
May I present to you; a full copy of doom, running inside of a Rollercoaster Tycoon 1 save game exploit ✨
Thanks for everyone that came to check out our @DistrictCon Junkyard talk! We had a lot of fun putting it together. (check the thread for slides / exploit)
Matt Ehrnschwender retweeted
AI-slopped a functional C2 for an app's Lua plugin (no stdlib Lua) in about 24hrs~
had to use the app-specific network libs provided to accomplish a transport.
Functions: change sleep, run more Lua in mem, module output, exit/uninstall - most of what u need on a longhaul persist
Pushed up a few small fixes for boflink. Currently working on some other improvements which should make writing BOFs in higher level languages like C++/Rust/Zig a lot more feasible without needing to add various different compiler/source code tricks github.com/MEhrn00/boflink/r…
Matt Ehrnschwender retweeted
if anyone is too lazy to learn to use @M_alphaaa 's boflink and doesnt want to fight MSVC to stop using funny sections in your bofs, heres a drop in replacement for the TrustedSec BOF template that uses boflink (standalone) in the makefile
github.com/CodeXTF2/bof_temp…
Matt Ehrnschwender retweeted
stop using ubuntu 24.04 to host your kernel pwn challenges lmao
kqx.io/post/qemu-nday/
