@__0kami

Security Consultant interested in Reverse Engineering, Binary Exploitation and much more. Co-founder of the Poznań Security Meetup. Coffee++

d0vine.github.io
Joined August 2016
  • Tweets248
  • Following234
  • Followers93
1Media
Krzysztof Marciniak retweeted
Alex Plaskett
@alexjplaskett31 Jul 2022
🔥 Like Windows Kernel exploitation? Your in luck! 10 items of Windows kernel exploit research from 2020/2021 🧵
4
130
3
406
Krzysztof Marciniak retweeted
b1ack0wl@b1ack0wl31 Jul 2022
I accidentally found a 0day within the latest firmware (v6_211111) for the TP-Link WR940N this afternoon and was able to dev out a quick exploit. ♥️
17
139
6
854
Krzysztof Marciniak retweeted
Cube0x0@cube0x024 Jul 2022
When you spend 2-months of your private time writing a full-featured C2 framework including C++ GUI, Backend, and a C++ PIC agent with custom functions only to end up clueless about what to do with it
62
151
6
1,077
Krzysztof Marciniak retweeted
Stephan Berger
@malmoeb25 Jul 2022
1/ In one ransomware case, the attackers started an EXE file that dropped the vulnerable GIGABYTE driver to C:\Windows\System\gdrv.sys. The TA used the vulnerable driver to load a malicious driver as a kernel driver, who hunted and killed Symantec processes. 🧵 #CyberSecurity
18
245
9
699
Krzysztof Marciniak retweeted
Nasreddine Bencherchali
@nas_bench19 Jul 2022
A new Sigma rule to detect this new UAC bypass technique and a generic one to detect DLL side loading were added to the public repo. LINK - github.com/SigmaHQ/sigma/blo…
This quoted post is unavailable.
Try viewing anyway · View on X
1
40
92
Krzysztof Marciniak retweeted
Nader Zaveri@NaderZaveri24 Jul 2022
At @Mandiant we have put together a vulnerable-by-design Azure Lab to test your red team attacking and blue team detecting capabilities. Access the lab and instructions here: github.com/mandiant/Azure_Wo… #redteam #blueteam #Azure #azureAD #Pentesting #cloud #cloudsecurity

GitHub - mandiant/Azure_Workshop

Contribute to mandiant/Azure_Workshop development by creating an account on GitHub.

github.com
9
306
6
808
Krzysztof Marciniak retweeted
Stolas@binpwn25 Jul 2022
Idk, but the happiness when I see I have code exec is so much greater then when I pop calc.
2
6
29
Krzysztof Marciniak retweeted
Ivan Kwiatkowski@JusticeRage25 Jul 2022
New blog post about an UEFI firmware bootkit! securelist.com/cosmicstrand-… Research was led by our dearly missed @_marklech_

CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit

In this report, we present a UEFI firmware rootkit that we called CosmicStrand and attribute to an unknown Chinese-speaking threat actor.

securelist.com
1
118
7
252
Krzysztof Marciniak retweeted
MDSec@MDSecLabs25 Jul 2022
In part 2 of the How I Met Your Beacon series, we look at some strategies for detecting Cobalt Strike mdsec.co.uk/2022/07/part-2-h… by @domchell
3
119
5
291
Krzysztof Marciniak retweeted
Doug Bienstock@doughsec24 Jul 2022
🎉 This is a huge feature all orgs should be using. All of my recent M365 IRs (BEC, UNC and APT) have started with the TA registering the first MFA for a dormant 😴 account. #dfir #microsoft365
Merill Fernando
@merill23 Jul 2022
Replying to @merill
A neat capability you unlock with combined registration is that you can now use conditinal access policies to control access to this page. For example you can limit MFA config to just trusted devices and locations or block access from countries where you don't have users.
1
35
4
126
Krzysztof Marciniak retweeted
Tom Stokes@tomstokes18 Jul 2022
Close-up of the edge of a 35mm film print. Every last bit of space is used for audio data: Left: Sony Dynamic Digital Sound (SDDS) Between sprocket holes: Dolby Digital Waveform pairs on the right: Analog optical sound Right dashed lines: DTS time codes
21
254
22
1,171
Krzysztof Marciniak retweeted
Karsten Hahn@struppigel25 Jul 2022
Microsoft signed rootkit #FuRootkit 🌳 Created and submitted in May, still only 4/10 \\Device\\Projector_Pro1_deviced 🧬analyze.intezer.com/analyses… 🕵️virustotal.com/gui/file/0f5e…
7
81
3
240
Krzysztof Marciniak retweeted
diversenok@diversenok_zero24 Jul 2022
Welcome the new version of Token Universe - an advanced tool for experimenting with Windows security mechanisms! 🎉🌟 It supports viewing, creating, impersonating, and modifying access tokens, spawning processes, and much more. github.com/diversenok/TokenU…

GitHub - diversenok/TokenUniverse: An advanced tool for working with access tokens and Windows...

An advanced tool for working with access tokens and Windows security policy. - diversenok/TokenUniverse

github.com
3
153
3
454
Krzysztof Marciniak retweeted
Azeria
@Fox0x0123 Jul 2022
I just found my first ever tweet (2015) and I’m not disappointed.
10
11
1
288
#Malware Code Challenge - What does it do?
16
20
4
173
Krzysztof Marciniak retweeted
Frank Boldewin
@r3c0nst26 May 2021
#VMWARE #ESXi OpenSLP heap-overflow CVE-2021-21974 walkthrough + poc straightblast.medium.com/my-… github.com/straightblast/My-…
2
102
3
240
Krzysztof Marciniak retweeted
Marco Grassi@marcograss19 May 2021
blackhat.com/us-21/briefings… me and @0xKira233 at @BlackHatEvents - @keen_lab
7
38
5
236
Krzysztof Marciniak retweeted
vessial@vessial18 May 2021
triggered Qualcomm QMI to baseband heap overflow vulnerability on my mi9 pro 5G based on checkpoint reported CVE-2020-11292 – at Zhejiang, People's Republic of China
6
52
199
Krzysztof Marciniak retweeted
Denis Skvortcov@Denis_Skvortcov18 May 2021
I’ve written my first blog post - write-up for CVE-2021-23874! How to enumerate COM-objects attack surface, explore implemented functionality and exploit it the-deniss.github.io/posts/2…

Discovering and exploiting McAfee COM-objects (CVE-2021-23874)

This post should show an approach to finding COM-object’s bugs with an example CVE-2021-23874. On the other hand, the post can be considered as a real world walkthrough with OleViewDotNet

the-deniss.github.io
8
152
6
342
Load more