@ZeroMemoryEx

Cyber Security Consultant | Security Researcher

 Morocco
hackandhide.com
Joined December 2019
  • Tweets284
  • Following529
  • Followers2K
29Media
In this week’s red team tip. I will show how to use @ZeroMemoryEx AMSI Killer to patch AMSI and allow Invoke-Mimikatz to run. This attack does get detected by Windows Defender, but it’s too late as memory is already patched. #hacking #redteam youtu.be/QFp3ybRKr7Q
1
1
6
1,919
Lazarus-Tactic: program based on APT38 North Korea-backed hackers tactic that used in targeting security researchers using a malicious Visual Studio project file (vcxproj) to steal their 0days. github.com/ZeroMemoryEx/APT3…

GitHub - ZeroMemoryEx/APT38-0day-Stealer: APT38 Tactic PoC for Stealing 0days from security...

APT38 Tactic PoC for Stealing 0days from security researchers - ZeroMemoryEx/APT38-0day-Stealer

github.com
28
2
66
7,858
Just published new blog post tinyurl.com/4ua23wzv! How can you hook systemcalls in kernel on Windows 11 22H2, how does Avast Free Antivirus use it and how you can bypass Avast’s self-defense in 10 lines of PowerShell code right now? All answers are provided in the article
3
114
3
264
The world of Ransomware is full of surprises: LockBit allegedly paid out their first “bug bounty” to someone who highlighted decryption flaws in the LB3 ESXi variant. The flaw made it possible to bypass having to pay the ransom for a key
15
185
46
602
Presenting D-Generate , syscall tracing as its supposed to be! raw.githubusercontent.com/jo… usage: dg cmd.exe - displays all syscalls done by process with cmd.exe as imagefile. dg 4736 - by pid 4736 dg - just everything example of recording: raw.githubusercontent.com/jo…
17
236
13
796
Zombie Processes scorpiosoftware.net/2022/05/…

Zombie Processes

The term “Zombie Process” in Windows is not an official one, as far as I know. Regardless, I’ll define zombie process to be a process that has exited (for whatever reason), but at…

scorpiosoftware.net
6
92
5
281
Arbitrary read/write -> arbitrary kernel-mode API calls with HVCI and Kernel CFG enabled :) - in this case a POC to invoke ZwOpenProcess on the System process in VTL 0. I will blog on this soon!
7
75
1
324
DirectX
4
6
183
👀 "This is essentially a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings)." github.com/Dec0ne/KrbRelayUp

GitHub - Dec0ne/KrbRelayUp: KrbRelayUp - a universal no-fix local privilege escalation in windows...

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings). - Dec0ne/KrbRelayUp

github.com
8
107
4
313
Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam
48
796
35
2,636
Anas retweeted
vx-underground
@vxunderground18 Apr 2022
.@jaco_ZA released a video explaining his recent Red Team engagement.
22
269
45
980
Check out the new blog post about my journey in implementing the technical aspects of Windhawk - implementing global injection and hooking in Windows. m417z.com/Implementing-Globa…

Implementing Global Injection and Hooking in Windows

A couple of weeks ago, Windhawk, the customization marketplace for Windows programs, was released. You can read the announcement for more details and for the motivation behind creating it. In this...

m417z.com
3
155
1
401
Breaking Aimware, a popular CS:GO cheat, by obfuscating CS:GO's engine.dll module github.com/mike1k/perses back.engineering/13/04/2022/

GitHub - mike1k/perses: X86 Mutation Engine with Portable Executable compatibility.

X86 Mutation Engine with Portable Executable compatibility. - mike1k/perses

github.com
17
78
4
327
Yah- trusted installer can no longer stop defender service- though its easier then in a long time to get rid of though. When we have TCB we can just ask nicely for getting the Windefend group added to our token
3
33
113
Have you ever wondered if it was possible to execute code inside of a drivers .data section? Well, I did. I created a PoC that abuses Windows' LargePageDrivers feature to copy shellcode into the beep.sys .data section and execute it. Blog post: vollragm.github.io/posts/abu…

Abusing LargePageDrivers to copy shellcode into valid kernel modules

Introduction Most people in the game hacking community write their kernel-mode drivers to get around kernel-level anti-cheats such as EasyAntiCheat. However, those anti-cheats have several methods to...

vollragm.github.io
2
161
3
376
Trying to learn security research and getting overwhelmed by all the details? I just published a guide showing my process for step-by-step analysis of a security feature: windows-internals.com/an-exe…
20
567
10
2,171
As a follow up to my blog post about SysWhispers, I'm releasing SysWhispers3, an Inceptor-friendly version of SysWhispers2 with x86/WOW64 support, egg-hunting, direct jumps, and randomized jumps to syscall/sysenter instruction. More info in the repo: github.com/klezVirus/SysWhis…

GitHub - klezVirus/SysWhispers3: SysWhispers on Steroids - AV/EDR evasion via direct system calls.

SysWhispers on Steroids - AV/EDR evasion via direct system calls. - klezVirus/SysWhispers3

github.com
7
211
2
476
That's cute! Microsoft is using animated GIFs to help explaining things about NIC driver development. docs.microsoft.com/en-us/win…
6
27
Anas retweeted
Mr. Rc
@rcx8616 Mar 2022
Windows Exploit Development Tutorials: web.archive.org/web/20200510… #infosec
4
182
2
487
Ok so I finally made a proper github repository for the persistance method, so there you go. Paper included :) github.com/NtQuerySystemInfo…
4
96
253
Load more