@halsten

Security Researcher, System Programmer and Part-Time Garbage Collector

 Austin, TX
halsten.info
Joined May 2009
  • Tweets3.6K
  • Following544
  • Followers1.3K
43Media
Mohamed Saher retweeted
Pedram Amini
@pedramamini24 May 2019
Austin hackers, let's gather for a night of lectures, libations, and BBQ on Wednesday June 5th. Thanks to our corporate sponsors tagged in the photo for fueling the evening. Limited capacity, register at: eventbrite.com/e/austin-hack… Looking forward to catching up with everyone.
2
17
2
32
Mohamed Saher retweeted
Rolf Rolles@RolfRolles18 Apr 2019
New blog entry: An Abstract Interpretation-Based Deobfuscation Plugin for Ghidra msreverseengineering.com/blo…

An Abstract Interpretation-Based Deobfuscation Plugin for Ghidra — Möbius Strip Reverse Engineering

This blog entry announces the release of an abstract interpretation-based Ghidra plugin for deobfuscation. The code can be found here (see the ‘Releases’ tab for a binary release). In view of the...

msreverseengineering.com
1
164
5
336
A #phishing email using obfuscated #JavaScript and encrypted HTML with #AES targeting #Apple #iCloud email accounts. Here's the URL if anyone wants to analyze it (hxxp://cl.ly/427897542763/asnkjksansnsfa). [1/2]
3
1
1
If you want the deobfuscated javascript, the decrypted payload and the email itself just send me a DM. [2/2]
1
Mohamed Saher retweeted
Evilcry_@Blackmond_15 Oct 2018
Translate x86_64 and ARM binaries to LLVM IR github.com/Microsoft/llvm-mc…

GitHub - microsoft/llvm-mctoll: llvm-mctoll

llvm-mctoll. Contribute to microsoft/llvm-mctoll development by creating an account on GitHub.

github.com
62
1
109
Mohamed Saher retweeted
Azeria
@Fox0x019 Nov 2017
As I was laying in bed with a cold yesterday, I felt like I should use that time to create a cute little cheatsheet on ARM assembly basics for you guys. Enjoy! 🖤 azeria-labs.com/assembly-bas…
106
1,196
60
3,718
Mohamed Saher retweeted
Rob Fuller@mubix12 Dec 2017
My Metasploitable 3 CTF Start to Finish walk-through of all the challenges including CTF setup/prep, and alternative solutions: docs.google.com/document/d/1… (Now downloadable/printable/copy allowed)

Metasploitable 3 - A Walk-through: Linux Edition

Metasploitable 3 A Walk-through: Linux Edition SPOILERS! To the prospective reader: In case you don’t fully realize what it is you are opening, this is a complete, step-by-step, walkthrough from the...

docs.google.com
17
350
8
656
Mohamed Saher retweeted
偉@_sinn3r30 Mar 2018
The world could use a full C/C++ example of MSFT's Antimalware Scan Interface (AMSI), so here's one that I used in my lab: goo.gl/72FjGr

GitHub - atxsinn3r/amsiscanner: A C/C++ implementation of Microsoft's Antimalware Scan Interface

A C/C++ implementation of Microsoft's Antimalware Scan Interface - atxsinn3r/amsiscanner

github.com
4
59
106
Mohamed Saher retweeted
偉@_sinn3r9 May 2018
Ran into this tool called PowerGUI. It packages a ps1 and DLL in a .Net binary and executes it. Almost like malware behavior, but not malware. I figured I'd share this so pentesters can play with it. Google PowerGUI Script Editor.
5
113
1
252
Mohamed Saher retweeted
Moriarty@Moriarty_Meng26 Jun 2018
OMG, look what I got :-) Simply add a registry entry value (UAC free) on windows 10 1803, then we can make our vbscript or jscript files bypass AMSI PERMANENTLY! Isn't it so easy? or is it an Easter egg Microsoft left to us? :-( @tiraniddo @bohops @subTee @Oddvarmoe @domchell
9
397
6
730
Mohamed Saher retweeted
hasherezade
@hasherezade3 Aug 2018
[DEMO] Recovering a PE with damaged headers with #PEsieve: youtube.com/watch?v=dFJcGYUF… (example: #PrincessLocker) - I am currently testing this feature, if you want to help in tests, pls check the "Latest builds": github.com/hasherezade/pe-si…

[DEMO] Recovering a PE with damaged headers with PE-sieve

Example: Princess Locker 2.0 (https://malshare.com/sample.php?actio...

youtube.com
2
87
1
172
Mohamed Saher retweeted
hackaday
@hackaday27 Sep 2018
Learn Verilog for #fpga by taking interactive exams in your browser wp.me/pk3lN-1mWS
1
21
3
88
Mohamed Saher retweeted
🔎Julia Evans🔍
@b0rk1 Oct 2018
some possible career goals jvns.ca/blog/2018/09/30/some…

Some possible career goals

jvns.ca
12
88
12
370
Just released a new #mimikatz version to support Windows 10 1803 to bypass the Credential Guard authentication chain Reminder: your passwords/keys are not in the secure world... only its storage **after** authentication! @reni_ni this version is for you 😉 github.com/gentilkiwi/mimika…
14
836
38
1,306
Mohamed Saher retweeted
Vitaly Nikolenko
@vnik528726 Sep 2018
Linux kernel userfaultfd+setxattr heap spray writeup @bevxcon cyseclabs.com/blog/linux-ker…
1
115
1
204
This report burns a lot of cool tricks, this and CoreTrust will probably make user-only sbox escape and sig bypass significantly harder! github.com/bazad/blanket

GitHub - bazad/blanket: CVE-2018-4280: Mach port replacement vulnerability in launchd on iOS 11.2.6...

CVE-2018-4280: Mach port replacement vulnerability in launchd on iOS 11.2.6 leading to sandbox escape, privilege escalation, and codesigning bypass. - bazad/blanket

github.com
11
16
Mohamed Saher retweeted
Evilcry_@Blackmond_4 Sep 2018
Abusing the COM Registry Structure (Part 2): Hijacking & Loading Techniques bohops.com/2018/08/18/abusin…

Abusing the COM Registry Structure (Part 2): Hijacking & Loading Techniques

TL;DR There are several ways that attackers can leverage COM hijacking to influence evasive loading and hidden persistence.  A few examples include CLSID (sub)key abandonment referencing, key …

bohops.com
6
7
Mohamed Saher retweeted
Alex Ionescu@aionescu2 Aug 2018
Windows 10 19H1 introduces system call entry/exit callbacks, the ability to consume real-time ETW events from kernel-mode (with an inline callback and not the usual shenanigans you do in user-mode) and an equivalent kprobe-like feature called trace points. alex-ionescu.com/?p=358
9
164
10
307
Mohamed Saher retweeted
ZeroNights@ZeroNights1 Aug 2018
ZeroNights 2018 CFP is open! (November 20-21, Saint-Petersburg, Russia) Please send your submissions 01x.cfp.zeronights.ru/zn2018…
1
64
2
65
Mohamed Saher retweeted
Alyosha Sintsov@asintsov23 Jul 2018
Finding and exploiting RCE (CVE-2018-0387) in Cisco Spark (WebEx Teams) messanger: asintsov.blogspot.com/2018/0…
42
63
Load more