Credential Guard has a shutdown mechanism inside LsaIso.exe. Signaling it causes the trustlet to gracefully unregister its Kerberos and CredMan RPC interfaces
Currently researching: can a process with kernel write in VTL0 patch the object’s DACL and signal it from usermode?
2
14
519
Kernel Shellcode Execution via PTE Manipulation and HalDispatchTable
New Medium post, today we are looking at how to promote a usermode page to supervisor executable via PTE manipulation, then redirect HalDispatchTable to execute a shellcode in ring-0
medium.com/@s12deff/kernel-s…
20
90
2,060
Executing shellcode in kernel mode using PTE manipulation + HalDispatchTable. A fun one! 😋
The idea is to use PTE manipulation to mark a usermode memory region as kernel owned and RWX, then use the HalDispatchTable to execute the shellcode from that region
Tomorrow in Medium
3
52
1,060
Kernel shellcode resources out there:
PLATINUMPICK: Windows KernelMode Shellcode Development Framework
github.com/winterknife/PLATI…
sickle-pdk: payload dev kit with a few ring 0 stubs
github.com/wetw0rk/sickle-pd…
No real generator exists for modern Windows. Guess we’ll have to build one
13
73
2,317
Enumerating MiniFilter Drivers from Usermode
New Medium post, today we are going to explore MiniFilter driver enumeration from usermode, a reconnaissance primitive that maps every filesystem interception driver registered on a Windows endpoint
medium.com/@s12deff/enumerat…
1
11
61
1,538
Post inspired by @Ox4d5a !
Windows Internals Part89: Enumerating MiniFilters from usermode
piped.video/W1bn5kTTCjU
#infosec #cybersecurity #redteam #windows
1
3
174
mimilib is a DLL that registers as an SSP so LSA loads it. It intercepts lsass.exe to log plaintext credentials on every user login. Custom SSPs can be built by writing a DLL that exports SpLsaModeInitialize, enabling you to hook into LSA and log credentials just like mimikatz
3
42
1,422
Remembering my first kernel offensive security technique quitting PPL via BYOVD to inject shellcode into the Windows Defender process
6
67
1,421
Shellcode Execution via CreateThreadpoolWait
New Medium post. Today we are looking at a shellcode execution technique that abuses the Windows thread pool (CreateThreadpoolWait) to dispatch shellcode on a worker thread
medium.com/@s12deff/shellcod…
Credits:
cocomelonc.github.io/malware…
1
19
154
3,787
New Technique Database update!
- IRP Dispatch Table Overwrite
- Suspend Processes with Job Objects
- Generate Random Encrpytion Keys
0x12darkdev.net/techniques/
1
27
1,020
Domain Failover lesson added into the Building a Custom Remote Access Trojan (RAT) course!
0x12darkdev.net/courses/buil…
2
13
698
Stealing Plaintext Windows Credentials
New Medium post, in this one we will see how to steal plaintext Windows credentials at the logon screen by abusing the Credential Provider COM interface and hooking internal methods inside CredProvDataModel.dll
medium.com/@s12deff/stealing…
2
29
121
6,674
New lesson added into the Introduction to Windows Malware Development course!
- Crashing Processes via PEB Corruption
0x12darkdev.net/courses/intr…
2
38
1,197
Just dropped LogonStealer!
Steal plaintext Windows passwords straight from the logon screen.
A rogue Credential Provider that hooks CredProvDataModel.dll inside logonui.exe to steal plaintext passwords at the Windows logon screen
github.com/S12cybersecurity/…
2
28
190
8,007
I've been working on an advanced Mythic agent for a while now. It's not just userland stuff, it also includes a lot of kernel offensive features through BYOVD
The thing is, I feel like it's too much to open source, and I'm not really sure what to do with it
6
2
108
6,113
I'll do something similar with the Technique Database. You'll be able to download curated data for each technique and use it to train your AI models or feed your own RAG system.
0x12darkdev.net/techniques/
I'm building an internal GitLab based platform where every technique pushed to a repo automatically updates a RAG system. Same goes for fine-tuning AI models. The goal is to build or adapt any model with all my offensive knowledge
7
757
I'm building an internal GitLab based platform where every technique pushed to a repo automatically updates a RAG system. Same goes for fine-tuning AI models. The goal is to build or adapt any model with all my offensive knowledge
4
26
1,575
