jm33_ng

Why?

Constrained Delegation I come from the Linux world, and AD still confuses me on a regular basis, delegation especially; these notes are my attempt to finally make sense of it.

Resource Based Constrained Delegation If you are reading this, you probably already know what RBCD is.

Linux malware sucks The gap between Windows and Linux tradecraft is insulting.

The Basics Forgive me if this post sounds too basic or detailed.

This report was written for a job interview (spoiler alert: I didn't get it) and has been sitting in my notes for half a year. windows-sandbox-init was used to create this report.

Introduction Beacon Object Files (BOFs) have revolutionized the way we execute code in memory on Windows systems, particularly within the Cobalt Strike framework.

TL;DR The source code of this module is available in emp3r0r.

Introduction This article is not just about analysing a malware sample, it's more about sharing my malware analysis methodology in general, and the sample I used has some interesting characteristics that make it a good candidate for demonstration.

TL;DR emp3r0r is a C2 framework written in pure Go.

I was called to handle an incident in which a malicious IP address is accessed each time the system boots.

Unified Kernel Image Read Arch Wiki for details.

背景 差不多三年前，我读了一篇关于 sshd 进程注入和密码窃取的文章，然后在作者的基础上实现了一个自动化的SSH 密码收割工具。

Graphics in Qemu Performance Impact of SPICE+VirGL I have been using libvirt (virt-manager) for years, until recently I tried to run Linux VMs with Qemu directly using virgl.

For Windows PCs, it's very likely that they are already configured to use secure boot.

Understanding Windows Console Host If you open cmd.exe or powershell.exe in Windows, you will always find conhost.exe alongside them.

Let's talk about hacking in Linux Unlike Windows, who is well known for keeping backward compatibility, most Linux distros simply don't care about this, it's very common that different distros use different system utilities, different libraries, even the…

shared library injection with gdb (yes i have compiled a fully static gdb), we can easily perform the injection by invoking dlopen in target processes, since most processes on a Linux machine are linked with glibc, this will work for almost every process,…

what we can do with ssh ssh to target host for remote shell access sftp to target host for FTP service ssh -D for socks proxy ssh -L/ssh -R for port mapping all these features are provided by openssh suite, which we use everyday. why not integrate them in…

Terminology Port It can be really confusing as we know "port" as in TCP/UDP context, but here in layer 2 (data link) context, a "port" is equivalent to an "interface" in Linux language.

Why In macOS and Linux world, users can configure their mouse scroll direction conveniently with a provided settings UI or human readable config file.

how do i know original post here (QQ 正在尝试读取你的浏览记录) the following content is based on QQ 9.0.4 see what qq does with procmon i think theres one thing many people tend to ignore, you can view target process's stack snapshot right inside procmon itself, you…

Process Injection In Linux Background The techniques covered in this article are part of emp3r0r project.

____ ___ |___ \ / _ \ ___ _ __ ___ _ __ __) |_ __| | | |_ __ / _ \ '_ ` _ \| '_ \|__ <| '__| | | | '__| | __/ | | | | | |_) |__) | | | |_| | | \___|_| |_| |_| .__/____/|_| \___/|_| | |

intro from what i have heard of, pentesters/hackers manually set up their port mapping in their target networks, some people would even use iptables please allow me to save you from those shitty works with emp3r0r when an agent lands on a host, it checks…

TL;DR The source code of this idea is available on GitHub And the weaponized version is available in emp3r0r Use echo 'print __libc_dlopen_mode("/path/to/library.so", 2)' | gdb -p <PID> for process injection Write a shared library to inject into sshd proc…

See also Weaponized shared library injection Shellcode injection 101 Emp3r0r Dynamic Linker/Loader - Make an ELF load specific libraries Intro Strictly speaking, this is not the process injection you are expecting.

my struggle i was trying to implement proxy support in emp3r0r, but found that http2.Transport has no such option. the only option that might work is replacing DialTLS() function with a custom one i did a lot of research: x/net/http2: support http2 proxy…

TL;DR (2021-06-09) AppleSMC is a kernel module that communicates with SMC (System_Management_Controller), and the SMC is basically an Apple co-processor that has its own firmware, used to manage the upper layer system including disk encryption, etc.

Stop Deleting Everything!

this is the setup of my AD domain: install Active Directory Domain Services (AD DS) install using server manager assuming you are using Windows Server 2012 or later, in the server manager window, click Manage -> Add roles and features DNS Server will be i…

Lost Your Way?

this part is about port forwarding/mapping port forwarding is extremely useful when you need to access targets lying deep inside victim's network as this simple diagram suggests, you can use port-fwd to redirect an RDP server that cannot be reached from o…

switching to prompt_toolkit python's readline module sucks heres how: python's readline cannot handle ANSI color codes properly, when i try to use ANSI color code in the prompt message, history browsing (via up/down key) fucks the prompt up here's the cod…

this part is about reverse shell how to make your reverse shell suck less take a look at pentestmonkey's Reverse Shell Cheat Sheet, which gives you a collection of reverse shell one-liners. each of the one-liners does the same thing -- establish a TCP con…

su -c is convenient to use, but, when you use it in your LPE exploit, hoping it to execute your command, you will probably get su: must be run from a terminal the obvious solution is give it a "terminal" to run from there's a forkpty function provided by…

happy Chinese new year!

this is a demo of the shell feature that im working on, it supports remote file editing, and FTP-like file get/put, among other things

UPDATE: windows update thinks my computer is lacking killer software, it keeps installing the shit back... why the fuck do i need the dumb ass killer network service???

this commit makes write_cr0(read_cr0() | 0x10000) useless, next time you see a 5.x linux kernel, good luck according to this stackoverflow question, we cannot: disable CR0's Write-Protection bits set RO page to RW i think ive found a solution: since lkm r…

how to disable WP when cr0 is "pinned"?

Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code how ss/netstat fetch TCP/UDP connections lets do a strace netstat -antu: ... openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY) = 3…

Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code what you will learn how to hide files how to hide processes how to hide them better so they cant be bruteforced asmlinkage a…

Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code what you will learn what system calls are how to hijack them how to hook syscalls what?

Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code what to expect i plan to write a rootkit that runs in both kernel and user space, in which case it: requires root when using…

what is ptrace ptrace() system call stands for process trace, which provides a way for debuggers such as gdb/strace to control a process (tracee).

一．

中文版已发Freebuf theres no posts about this cve as far as i know, and the original advisory is just too difficult for newbies like me, so.. warm up whats user namespace lets assume you use linux, man user_namespaces will give you what you need in case you aint

paramiko has an auth bypass vuln (found in March 2018), ie.

有个中文版在Freebuf，需要的可以去看看 dig deeper into user space lets abuse inits the INIT a lot of script kiddies know how to write their own SysV service file or modify the existing ones, fortunate for them, SysVinit is still widely supported in Linux world.