av-gantimurov

List of resources for malware analysts

Books

1. Monappa K.A., "Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware" amazon.
2. Sikorski M., Honig A., "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software" amazon.
3. Ferrie P., "The "Ultimate" Anti-Debugging Reference" [free](https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf

gustavohenrique

Reverse Shell Cheat Sheet

Summary

• Reverse Shell
  • Bash TCP
  • Bash UDP
  • Socat
  • Perl
  • Python

s3rg3ys

Google Docs

• Raw Threat Intelligence by ClearskySec

GitHub

• APT_CyberCriminal_Campagin_Collections by CyberMonitor
• threat-INTel by fdiskyou
• APT_Digital_Weapon by RedDrip7
• APTNotes

Twitter

v-p-b

https://seclists.org/fulldisclosure/2019/Aug/1
https://medium.com/tenable-techblog/comodo-from-sandbox-to-system-cve-2019-3969-b6a34cc85e67
https://blog.silentsignal.eu/2019/06/24/self-defenseless-exploring-kasperskys-local-attack-surface/
https://safebreach.com/Post/BitDefender-Antivirus-Free-2020-Privilege-Escalation-to-SYSTEM
https://safebreach.com/Post/Trend-Micro-Password-Manager-Privilege-Escalation-to-SYSTEM
https://safebreach.com/Post/Check-Point-Endpoint-Security-Initial-Client-for-Windows-Privilege-Escalation-to-SYSTEM
http://rce4fun.blogspot.com/2019/08/comodo-antivirus-sandbox-race-condition.html
https://medium.com/bugbountywriteup/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968
https://posts.specterops.io/cve-2019-12757-local-privilege-escalation-in-symantec-endpoint-protection-1f7fd5c859c6
https://nafiez.github.io/security/poc/2019/11/22/POC-conference-present.html

j-a-c-k-maynard

Document infos:
- Author = Peter Kim
- CreationDate = D:20180505020009+00'00'
- Creator = calibre 2.69.0 [https://calibre-ebook.com]
- Pages = 308
- Producer = calibre 2.69.0 [https://calibre-ebook.com]
- Title = The Hacker Playbook 3: Practical Guide To Penetration Testing
- dc = {'publisher': ['Secure Planet'], 'description': {'x-default': None}, 'language': ['en'], 'creator': ['Peter Kim'], 'title': {'x-default': 'The Hacker Playbook 3: Practical Guide To Penetration Testing'}, 'date': ['2018-05-01T00:00:00+02:00'], 'subject': []}
- http://calibre-ebook.com/xmp-namespace = {'timestamp': '2018-05-03T18:05:43.134685+02:00', 'author_sort': 'Kim, Peter'}
- xap = {'Identifier': ['\n            '], 'MetadataDate': '2018-05-05T04:00:09.811485+02:00'}

khanjanny

#!/bin/bash

apt update
apt install wget curl python python3 python-pip python3-pip python-dev zip git phantomjs whatweb python-virtualenv bc locate dnsutils apache2 tree jq
pip install boto wfuzz google wafw00f truffleHog

#install golang phantomjs


#golang profile...

tessprime

So, we take a look at the binary and do some basic decompilation.

void main(void)
{
  uint switch_00;
  int switch;
  char *buf;
  undefined8 uVar1;
  FILE *stream;

kyhwana

This assumes that you're running Windows 10 Pro/Enterprise 1903 or newer and have enabled the Windows Sandbox. See https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 for how to enable this and other requirements.
Download ghidra from https://ghidra-sre.org/ and extract it to c:\sandbox\
Download the AdoptOpenJDK Windows x64 JDK from https://adoptopenjdk.net/releases.html?variant=openjdk11&jvmVariant=hotspot#x64_win and copy it to c:\sandbox\jdk.msi
Download install.cmd and copy it to c:\sandbox\
If you have any Ghidra scripts or extentions, copy these to a directory in c:\sandbox\ and they will be copied to C:\Users\WDAGUtilityAccount\downloads\ inside the VM as well.
Download the ghidra.wsb file and run!

The ghidra.wsb will run install.cmd which will copy the files from the shared folder into C:\Users\WDAGUtilityAccount\downloads\ inside the VM and then run the jdk installer (in passive mode, so once the install dialog disappears, it's done)
Your shiney new windows 1

med0x2e

 1. Download the latest release of mimikatz: https://github.com/gentilkiwi/mimikatz/releases 
 
 2. Get Mimikatz PE Loader from https://gist.github.com/pljoel/42dae5e56a86a43612bea6961cb59d1a
 
 3. use @pljoel katz.cs cs file and uncomment the building lines available on Delivery.Program.Main() & comment Exec() line of code.
 
 4. Build it to generate file.b64, copy its content and replace Package.file string available on payload.txt file.
 
 6. Make sure payloadPath var is properly set on "TestAssemblyLoader.cs"
 

icecr4ck

import idautils
import ida_range
import ida_hexrays as hr

class decryptor(hr.mop_visitor_t):

    def visit_mop(self, op, type, is_target):
        if op.t != hr.mop_f:
            return 0