haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho) header
haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho) profile picture

haz ๐Ÿ‡ธ๐Ÿ‡ฆ

@AzizWho

Cyber Security Researcher - OSCEยณ Personal Account

 Dhahran
linktr.ee/AzizWho
Joined January 2013
  • Tweets56
  • Following87
  • Followers2K
16Media
Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)Photo by haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)
1/7 After months of research, I found a logic flaw in EasyAntiCheat: a standard user can control which older signed EAC driver its SYSTEM service loads into the kernel. Reported almost a year ago, rejected, and still reproducible. Demo: 2022 and legacy 2017 drivers loaded and running.
14
38
3
469
109,242
more replies
6/7 Where this leads next is still an open research question. Exploring further impact requires a deeper understanding of how the older drivers initialize, interact with the current service, and which functionality remains accessible after loading.
1
8
2,409
7/7 This finding illustrates the distinction between verifying who signed a driver and verifying which driver a privileged service should load. Iโ€™m sharing the implementation and reproduction details for other researchers to examine. PoC: github.com/oh-az/EAC_rollbacโ€ฆ
GitHub - oh-az/EAC_rollback: PoC for EasyAntiCheat rollback vulnerability

GitHub - oh-az/EAC_rollback: PoC for EasyAntiCheat rollback vulnerability

PoC for EasyAntiCheat rollback vulnerability . Contribute to oh-az/EAC_rollback development by creating an account on GitHub.

github.com
2
23
2,447
ุงู„ุญู…ุฏู„ู„ู‡ ุฃู†ุฌุฒุช ุดู‡ุงุฏุฉ OSCEยณ ู…ู† @offsectraining ู…ู† ุฃุนู„ู‰ ูˆุฃุตุนุจ ุงู„ุดู‡ุงุฏุงุช ููŠ ู…ุฌุงู„ ุงู„ุฃู…ู† ุงู„ู‡ุฌูˆู…ูŠุŒ ุชุดู…ู„: OSWE โ€“ OSED โ€“ OSEP ุฑุญู„ุฉ ุทูˆูŠู„ุฉ ู…ู„ูŠุฆุฉ ุจุงู„ุชุญุฏูŠุงุช ุงู„ุชู‚ู†ูŠุฉ ูˆุงู„ุชูุงุตูŠู„ ุงู„ุนู…ูŠู‚ุฉ ูุฎูˆุฑ ุฌุฏู‹ุง ุจู‡ุฐุง ุงู„ุฅู†ุฌุงุฒ #osce3
Image from haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)
18
1
114
10,243
ุงู„ูƒุซูŠุฑ ู…ู† ุงู„ู†ุงุณ ุนู†ุฏู‡ ู…ูู‡ูˆู… ุงู† ุงู„ู…ู„ู ุงู„ุถุงุฑ ู„ุงุฒู… ูŠุชู… ุชุดุบูŠู„ู‡ (Executed) ุนุดุงู† ูŠุณุจุจ ุงู„ุถุฑุฑ ุงู„ุฎุงุต ููŠู‡ , ุงู„ูŠูˆู… ุจูˆุฑูŠูƒู… ูˆุจุดุฑุญ ูƒูŠู ู†ู‚ุฏุฑ ู†ุณุชุบู„ ุทุฑูŠู‚ุฉ ุนู…ู„ ุงู„Windows ูˆูƒูŠู ู†ู‚ุฏุฑ ู†ุณุฑู‚ ุงู„ู‡ุงุด (NTLMv2) ุงู„ุฎุงุต ุจุงู„ูŠูˆุฒุฑ ูู‚ุท ุนู† ุทุฑูŠู‚ ูุชุญู‡ ู„ู„ู…ุฌู„ุฏ ุงูˆ ุชุญู…ูŠู„ ุงู„ู…ู„ู ุจุฏูˆู† ุชุดุบูŠู„ ุงูŠ ุจุฑู†ุงู…ุฌ ุฎุงุฑุฌูŠ .. ู…ุซู„ ู…ุงู‡ูˆ ู…ูˆุถุญ ููŠ ุงู„ู…ู‚ุทุน:
9
56
444
51,654
more replies
ู‡ู†ุง ุณูˆูŠุช ุทุฑูŠู‚ุฉ ุญู„ูˆู‡ ุจุฃู† ุงู„ู…ู„ู ุฎู„ูŠุชู‡ ููŠ ูู„ุงุด ูˆุฎู„ูŠุช ุงู„ุงูŠู‚ูˆู†ู‡ ุงู„ุฎุงุตู‡ ููŠู‡ ู‡ูŠ ุตูˆุฑุฉ pdf ูƒุฐุจูŠู‡ ุŒ ูˆุณู…ูŠุช ุงู„ู…ู„ู test.pdf.library-ms ูˆู„ูƒู† ู…ุซู„ ู…ุงุฐูƒุฑุช ุณุงุจู‚ุงู‹ ุงู† explorer.exe ุฑุงุญ ูŠุฎููŠ ุงู„ุงู…ุชุฏุงุฏ ุญุชู‰ ู„ูˆ ูƒู†ุง ู…ูุนู„ูŠู† ุงุธู‡ุงุฑ ุฌู…ูŠุน ุงู„ุงู…ุชุฏุงุฏุงุช .. ู ุจูƒุฐุง ุงูˆู„ ู…ุง ู†ูุชุญ ุงู„ูู„ุงุด ุฑุงุญ ุชุชู… ุนู…ู„ูŠุฉ ุงู„ู…ุตุงุฏู‚ู‡ ู…ู† explorer ู†ูุณู‡ ุนุดุงู† ูŠุณุญุจ ุงู„ุงูŠู‚ูˆู†ู‡ ุจุฏูˆู† ุงูŠ ุนู…ู„ูŠุฉ ู…ู† ุงู„ู…ุณุชุฎุฏู…:
Image from haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)
1
4
4,233
ุงูุถู„ Mitigation ู„ู„ุชูƒู†ูŠูƒ ู‡ุฐุง ู‡ูˆ ุชุนุฏูŠู„ ุงู„Group Policy Settings ูˆุชุดุบูŠู„ ุงู„ุฎุงุตูŠุชูŠู† DisableThumbnailsOnNetworkFolders ูˆ DisableThumbnails :
Image from haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)
1
15
3,326
๐Ÿซก
โ˜ฃ KitPloit - Hacker Tools (@KitPloit) profile pictureโ˜ฃ KitPloit - Hacker Tools
@KitPloit16 Apr 2024
NoArgs - Tool Designed To Dynamically Spoof And Conceal Process Arguments While Staying Undetected dlvr.it/T5ZvVn
2
3,082
ู…ู‚ุงู„ุฉ ุฌู…ูŠู„ู‡ ุฌุฏุง ุนู† Kerberos Delegation caramellaapp.com/0xsa/gnV0Rqโ€ฆ ู„ู„ุงุณู ู…ุงุนุฑู ุญุณุงุจ ุงู„ูŠ ูƒุชุจู‡ุง ุนุดุงู† ุงุณูˆูŠ ู„ู‡ ู…ู†ุดู† ูˆู„ูƒู† ู‡ุฐุง ุฑุงุจุท ุญุณุงุจู‡ ููŠ ู„ูŠู†ูƒุฏุงู† linkedin.com/in/saeed-alzahrโ€ฆ
Kerberos Delegation | Caramella

Kerberos Delegation | Caramella

By Saeed Alzahrani ุจุณู… ุงู„ู„ู‡ ุงู„ุฑุญู…ู† ุงู„ุฑุญูŠู… .. ุงู„ู…ู‚ุงู„ุฉ ุชุดุฑุญ ูˆุงุญุฏ ู…ู† ุงู‡ู… ุงู„ู…ูุงู‡ูŠู… ููŠ ุจูŠุฆุงุช ุงู„ู€ Active Directory ูˆู‡ูˆ ู…ูู‡ูˆู…ย Kerberos Delegation ุญูŠุซ ูŠุนุชุจุฑ ุงู„ุจูˆุงุจุฉ ู„ู†ู‚ู„ ุงู„ู…ุณุชุฎุฏู…ูŠู† ูˆุงุนุทุงุฆู‡ู… ุญู‚ ุงู„ูˆุตูˆู„ ู„ู€...

caramellaapp.com
1
10
48
9,562
haz ๐Ÿ‡ธ๐Ÿ‡ฆ retweeted
Nicolas Krassas (@Dinosn) profile picture
Nicolas Krassas
@Dinosn23 Mar 2024
NoArgs: dynamically spoof and conceal process arguments while staying undetected securityonline.info/noargs-dโ€ฆ
1
22
83
10,252
I've developed a new Red-Teaming tool called NoArgs. It dynamically hooks into Windows APIs to manipulate and hide process arguments. By injecting it into a cmd process, it hides the arguments of every newly spawned processes at runtime, without leaving traces for logging applications that rely on information from the Process Environment Block (PEB). Source and detailed info: github.com/oh-az/NoArgs
Image from haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)
Image from haz ๐Ÿ‡ธ๐Ÿ‡ฆ (@AzizWho)
1
57
149
24,782
Load more