Red Teamer, low level coding extremist and malware researcher. Windows exploit writer and bug hunter
Joined September 2017
- Tweets179
- Following532
- Followers4.8K
- Likes260
Pinned Tweet
I'm proud to release my first Google Chrome RCE derived from the most fascinating and mind bending exploit I have yet analyzed: CVE-2019-13720 Wizard Opium. This is a beautiful bug which I have crafted into an exploit bypassing ASLR, CFG and CET on Win10 github.com/forrest-orr/Wizar…
Does anyone know what mechanisms can be used to detect suspended (non-UWP) and frozen UWP app processes, and how to programmatically wake them up in a safe and persistent way where they don't just immediately freeze again?
Is the ability of a non admin user to obtain a full query handle to a System integrity process and unravel its ASLR considered a security boundary? I know a PROCESS_QUERY_INFORMATION handle on a PPL is considered a breach of a security boundary even if the owner is local admin. But what about this scenario as a non admin -> System?
I’m surprised to have recently learned that there does not seem to be a trivial way to receive notifications of suspended process launches in Windows via kernel proc notif callback, kernel ETW or EtwTi. Any ideas on how to do this? @zodiacon
Over the years I’ve been flattered to see that my tool Moneta has picked up a following in the Infosec world and I am considering reviving the project. If you are a user of Moneta, what would you improve? Which features would you add? forrest-orr.net/post/masking…
Great patch, thanks for making the pull request.
Now it no longer works against Moneta😀 github.com/forrest-orr/monet…
Very well put together research that expands on some of the memory forensics articles I wrote several years ago, it’s excellent to see improvements are still being made to malware tradecraft in this niche
My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it to blend-in within its own logic go check it out. Hope you'll enjoy the read.
ipslav.github.io/2023-12-12-…
Forrest Orr retweeted
My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it to blend-in within its own logic go check it out. Hope you'll enjoy the read.
ipslav.github.io/2023-12-12-…
Forrest Orr retweeted
CVE-2021-38001: A Brief Introduction to V8 Inline Cache and Exploitating Type Confusion y4y.space/2023/05/06/cve-202…
Forrest Orr retweeted
Today I am releasing a blog about kernel exploitation in the age of HVCI. This post addresses calling arbitrary kernel-mode APIs, to go beyond “traditional token stealing” data-only attacks, while also dealing with kernel control flow integrity.
connormcgarr.github.Io/hvci
Last summer I attended the Advanced Windows Heap Exploitation class given by @corelanc0d3r and cannot speak highly enough of his skill, dedication and enthusiasm for the topic. This is the training I recommend for learning memory corruption exploits. Truly one of a kind.
Excellent work, I think you’ve found (what is at present) the most optimal fusion of stealth techniques for evasion in memory. It doesn’t get any more cutting edge than this when it comes to the memory dimension of malware design these days
Here's my post on my YouMayPasser POC I released, as promised. Thanks to both @_ForrestOrr and @hasherezade for making such great tools, you both rule. I say "easiest way" but it was anything but easy I assure you.
arashparsa.com/bypassing-pes…
Excellent work on this. Well done!
Today I am releasing part 2 of a 3 part series on “modern” browser exploitation targeting Windows.
Part 2 addresses going from crash to achieving a read/write primitive, as well as gaining code execution while dealing with ASLR, DEP, & CFG in ChakraCore!
connormcgarr.github.io/type-…
Forrest Orr retweeted
Going to Blackhat USA this year? I’ll be teaching a 2-day training:
Day 1 - Browser internals (Firefox and Chrome)
Day 2 - Virtualisation Internals (VirtualBox and QEMU)
Come learn from real source code and debug real world targets!
blackhat.com/us-22/training/…
Forrest Orr retweeted
Already released way earlier but I'm sharing on Twitter too just because. Blog post + poc on detecting malware through return addresses. Recommend also looking at the following made by @thefLinkk
github.com/thefLink/Hunt-Sle…
arashparsa.com/catching-a-ma…
Thanks for bringing this to my attention Andrew, this would be a much more elegant way of filtering CLR JIT memory in Moneta.
- @_ForrestOrr I was reading this:
forrest-orr.net/post/masking…
In case you aren't aware, the DAC code was included in the shared code from MS:
github.com/g15ecb/shared-sou…
You can also find the latest here as .NET 5+ is fully open source:
github.com/dotnet/runtime/
My personalized Windows 10 re-creation of the HYDSEVEN exploit chain used to target Coinbase. This chain involves the use of a Firefox RCE (CVE-2019-11707) and Firefox sandbox escape (CVE-2019-11708) for shellcode execution as Medium Integrity github.com/forrest-orr/Explo…
Forrest Orr retweeted
Full moneta bypass with 0FPs! A few more tweaks and I’m hoping peseive is next! @_ForrestOrr