konik_polanowy

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.29.md

Spoofing Call Stacks To Confuse EDRs - https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs

ShadowHound: A SharpHound Alternative Using Native PowerShell - https://blog.fndsec.net/2024/11/25/shadowhound/

From Exploits to Forensics: Unraveling the Unitronics Attack - https://claroty.com/team82/research/from-exploits-to-forensics-unraveling-the-unitronics-attack

Create your own C2 using Python- Part 1 - https://g3tsyst3m.github.io/c2/python/Create-your-own-C2-using-Python-Part-1/

Salt Typhoon: Churning Up a Storm of Consternation - https://nattothoughts.substack.com/p/salt-typhoon-churning-up-a-storm

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.27.md

Reconnaissance: Scanning and DoSing with Scapy - https://en.iguru.gr/reconnaissance-scanning-kai-dosing-scapy/

DFIR Breakdown: Kerberoasting - https://www.cybertriage.com/blog/dfir-breakdown-kerberoasting/

How to Emulate a Ransomware Attack - https://practicalsecurityanalytics.com/how-to-emulate-a-ransomware-attack/

Increase your stealth capabilities - part 1 - https://sokarepo.github.io/redteam/2024/01/04/increase-your-stealth-capabilities-part1.html

Extracting Credentials From Windows Logs - https://practicalsecurityanalytics.com/extracting-credentials-from-windows-logs/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.25.md

WebVM 2.0: A complete Linux Desktop Environment in the browser via WebAssembly - https://labs.leaningtech.com/blog/webvm-20

GoMLX: ML in Go without Python - https://eli.thegreenplace.net/2024/gomlx-ml-in-go-without-python/

Obfuscating API Patches to Bypass New Windows Defender Behavior Signatures - https://practicalsecurityanalytics.com/obfuscating-api-patches-to-bypass-new-windows-defender-behavior-signatures/

How To Use MSSQL CLR Assembly To Bypass EDR - https://blog.pyn3rd.com/2024/11/22/How-to-use-MSSQL-CLR-assembly-to-bypass-EDR/

Breaking Down Multipart Parsers: File upload validation bypass - https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.23.md

Unpatched Remote Code Execution in Gogs - https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/

A New Era of macOS Sandbox Escapes: Diving into an Overlooked Attack Surface and Uncovering 10+ New Vulnerabilities - https://jhftss.github.io/A-New-Era-of-macOS-Sandbox-Escapes/

Extracting Plaintext Credentials from Palo Alto Global Protect - https://shells.systems/extracting-plaintext-credentials-from-palo-alto-global-protect/

Helldown Ransomware: an overview of this emerging threat - https://blog.sekoia.io/helldown-ransomware-an-overview-of-this-emerging-threat/

Microsoft Bookings – Facilitating Impersonation - https://www.cyberis.com/article/microsoft-bookings-facilitating-impersonation

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.21.md

Hacking Kia: Remotely Controlling Cars With Just a License Plate - https://samcurry.net/hacking-kia

SELinux bypasses - https://klecko.github.io/posts/selinux-bypasses/

One weird trick to get the whole planet to send abuse complaints to your best friend(s) - https://delroth.net/posts/spoofed-mass-scan-abuse/

Parrot Anafi Drone Reverse Engineering - https://www.hardbreak.wiki/network-analysis/protocols/application-layer/proprietary-protocols/parrot-anafi-drone-reverse-engineering

CVE-2024-8956, CVE-2024-8957: How to Steal a 0-Day RCE (With a Little Help from an LLM) - https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.19.md

Autonomous Discovery of Critical Zero-Days - https://zeropath.com/blog/0day-discoveries

Inside Intelligence Center: Financially Motivated Chinese Threat Actor SilkSpecter Targeting Black Friday Shoppers - https://blog.eclecticiq.com/inside-intelligence-center-financially-motivated-chinese-threat-actor-silkspecter-targeting-black-friday-shoppers

UAL = Unaligned Activity Logs - https://kqlquery.com/posts/ual/

New Zero-Detection Variant of Melofee Backdoor from Winnti Strikes RHEL 7.9 - https://blog.xlab.qianxin.com/analysis_of_new_melofee_variant_en/

UEVR: An Exploration of Advanced Game Hacking Techniques - https://praydog.com/reverse-engineering/2023/07/03/uevr.html

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.17.md

Uncovering Apple Vulnerabilities: The diskarbitrationd and storagekitd Audit Story Part 1 - https://www.kandji.io/blog/macos-audit-story-part1

The 'Invisibility Cloak' - Slash-Proc Magic https://dfir.ch/posts/slash-proc/

LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign - https://blogs.blackberry.com/en/2024/11/lightspy-apt41-deploys-advanced-deepdata-framework-in-targeted-southern-asia-espionage-campaign

Cobalt Strike over external C2 – beacon home in the most obscure ways - https://www.outflank.nl/blog/2017/09/17/blogpost-cobalt-strike-over-external-c2-beacon-home-in-the-most-obscure-ways/

32 vulnerabilities in IBM Security Verify Access - https://pierrekim.github.io/blog/2024-11-01-ibm-security-verify-access-32-vulnerabilities.html

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.15.md

Solving (and Pwning) Flare-On level 10 - https://jro.sg/flareon11/solving10.html

Can't trust any VPN these days - https://blog.orhun.dev/cant-trust-any-vpn/

Cross-Process Spectre Exploitation - https://grsecurity.net/cross_process_spectre_exploitation

EDR Internals for macOS and Linux - https://www.outflank.nl/blog/2024/06/03/edr-internals-macos-linux/

Unlocking Full Shell Functionality UART RX Mitigation Bypass on TL-WR841N - https://www.iotsrg.org/blog/unlocking-full-shell-functionality-uart-rx-mitigation-bypass-on-tl-wr841n

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.13.md

Flare-On 11 Write-Up - https://gmo-cybersecurity.com/blog/flare-on-11-write-up/

Multiple Vulnerabilities in the Mazda In-Vehicle Infotainment (IVI) System - https://www.zerodayinitiative.com/blog/2024/11/7/multiple-vulnerabilities-in-the-mazda-in-vehicle-infotainment-ivi-system

Using Nix to Fuzz Test a PDF Parser (Part One) - https://mtlynch.io/nix-fuzz-testing-1/

Beyond RCE: Autonomous Code Execution in Agentic AI - https://www.securityrunners.io/post/beyond-rce-autonomous-code-execution-in-agentic-ai

BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence - https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.11.md

How Malware Can Bypass Transparency Consent and Control (CVE-2023-40424) - https://blog.kandji.io/malware-bypass-tcc

SigROP with mprotect(); - https://realest.lol/mprot.html

Autonomous Discovery of Critical Zero-Days - https://zeropath.com/blog/0day-discoveries

Exploitation of a kernel pool overflow from a restrictive chunk size (CVE-2021-31969) - https://starlabs.sg/blog/2023/11-exploitation-of-a-kernel-pool-overflow-from-a-restrictive-chunk-size-cve-2021-31969/

Hiding Linux Processes with Bind Mounts - https://righteousit.com/2024/07/24/hiding-linux-processes-with-bind-mounts/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.09.md

Practical Incident Response - Active Directory - https://nxb1t.is-a.dev/incident-response/practical_ir_ad/

Spoofing Internal Packets for Multihomed Linux Devices - https://www.anvilsecure.com/blog/spoofing-internal-packets-for-multihomed-linux-devices.html

ClickFix tactic: Revenge of detection - https://blog.sekoia.io/clickfix-tactic-revenge-of-detection/

Reverse Engineering Network Protocols - https://jhalon.github.io/reverse-engineering-protocols/

CloudGoat: New Scenario and Walkthrough (sns_secrets) - https://rhinosecuritylabs.com/research/cloudgoat-sns_secrets/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.07.md

Heap exploitation, glibc internals and nifty tricks - https://blog.quarkslab.com/heap-exploitation-glibc-internals-and-nifty-tricks.html

Reverse Engineering and Dismantling Kekz Headphones - https://nv1t.github.io/blog/kekz-headphones/

TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit - https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/

ProjectSend - Stored XSS to Account Takeover - https://nv1t.github.io/blog/projectsend-stored-xss-to-account-takeover/

Kernel Structure Validation and Its Performance Impact - https://zatoichi-engineer.github.io/2017/11/13/kernel-structure-validation.html

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.05.md

Event Log Talks a Lot: Identifying Human-operated Ransomware through Windows Event Logs https://blogs.jpcert.or.jp/en/2024/09/windows.html

VMProtect 2 - Detailed Analysis of the Virtual Machine Architecture https://blog.back.engineering/17/05/2021/

Cracking HackSys Extreme Vulnerable Driver: will this driver ever crash? https://mdanilor.github.io/posts/hevd-1/

Revisiting the User-Defined Reflective Loader Part 1: Simplifying Development https://www.cobaltstrike.com/blog/revisiting-the-udrl-part-1-simplifying-development

From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code  https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html

#informatyka

942 + 1 = 943

Tytuł: Demony Rosji

Autor: Witold Jurasz

Kategoria: inne

Wydawnictwo: nauki społeczne (psychologia, socjologia, itd.)

Ocena: 7/10

Po 24.02.2022 roku narosło na YT "ekspertów" od Rosji i militariów jak grzybów po deszczu. Jak sobie klikniesz i posłuchasz to masz emocje pomieszane z paroma faktami pod tezę. I tyle. Kasa leci, jak i zaproszenia do telewizji. Żeby zrozumieć, jak doszło do wojny na Ukrainie to trzeba, raz, że usiąść na spokojnie to dwa wiedzieć, jakie są jego składowe. I nie chodzi tu znajomość urzędów, bo tych Jurasz to sporo odwiedził. Podobnie jak kawiarni, gdzie miał kontakt z ludźmi i tym, czym nazywamy "Rosja to stan umysłu", np. jak się pchasz w kolejce to znaczy, że jesteś ważny i ochrona ci nie przeszkadza. Życie towarzyskie, rynek motoryzacyjny, stosunek do imigrantów z Kaukazu również znalazły swoje miejsce jak i polska sztuka dyplomacji, którą autor raczej negatywnie ocenia. Książka jest pisana z perspektywy tak z 15-20 lat.

Prywatny licznik: 67/200

Wygenerowano za pomocą https://bookmeter.xyz

#bookmeter

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.03.md

Analysis of CVE-2024-21310 Pool Overflow Windows Cloud Filter Driver - https://gabrieldurdiak.github.io/clfd/

Exploiting Visual Studio via dump files - CVE-2024-30052 - https://ynwarcs.github.io/exploiting-vs-dump-files

XSS Vulnerabilities in Excalidraw Affecting Meta (CVE-2024-32472) - https://elmahdi4.wordpress.com/2024/10/25/xss-vulnerabilities-in-excalidraw-affecting-meta-cve-2024-32472/

Exploiting Microsoft Kernel Applocker Driver (CVE-2024-38041) - https://csa.limited/blog/20240916-Exploiting-Microsoft-Kernel-Applocker-Driver.html

Pwn2Own: WAN-to-LAN Exploit Showcase, Part 1 - https://claroty.com/team82/research/pwn2own-wan-to-lan-exploit-showcase

#informatyka

931 + 1 = 932

Tytuł: Salamina - Plateje 480-479 p.n.e.

Autor: Grzegorz Lach

Kategoria: historia

Ocena: 7/10

"Stary" dobry HBek, który mógłby spokojnie robić za kilka pozycji. Te mapy na końcu trochę rażą, ale mnogość bitew łącznie z opisem uzbrojenia, zdrad, postaci i tego, co się działo po tytułowych bitw rekompensuje wszystko.

Prywatny licznik: 66/200

Wygenerowano za pomocą https://bookmeter.xyz

#bookmeter

930 + 1 = 931

Tytuł: Góra św. Anny - Kędzierzyn 1921

Autor: Leszek Kania

Kategoria: historia

Ocena: 7/10

Powstania śląskie odstawały od reszty naszych zrywów. Zawsze były tak z boku. Warszawskie, czy wielkopolskie jakoś tak bardziej utkwiły w naszym społeczeństwie. Szkoda, bo Korfanty odwalił kawał całkiem dobrej roboty. Podobnie jak i Francuzi, bo bez nich nie udałoby się wszystkie te przedsięwzięcia. I tak też opisuje to autor. W kontekście polityki międzynarodowej. Włosi i w szczególności Anglicy wykazywali większą sympatię i pomoc dla pokonanych całkiem niedawno Niemców. A dlaczego? Ot, co polityka. Zwracają uwagę zbrodnie niemieckie na ludności polskiej na Śląsku, po każdym powstaniu. Katownie, tortury, jak Sowieci. Do tego dochodzi nikła pomoc na początku (w związku z wojną z bolszewikami) od Rzeczpospolitej. Druga strona miała "opiekę" w postaci przemysłowców i ich pieniędzy i weteranów z obu frontów I wojny światowej. Tak więc Korfanty zasługuje na szacunek. Autor jednoznacznie wskazuje (na podstawie dokumentów),że na górze św. Anny szturmu nie było. I nawet ważniejszych jednostek też.

Prywatny licznik: 65/200

Wygenerowano za pomocą https://bookmeter.xyz

#bookmeter

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.11.01.md

Race conditions in Linux Kernel perf events - https://binarygecko.com/race-conditions-in-linux-kernel-perf-events/

Emulating Android native libraries using unidbg - https://bhamza.me/blogpost/2024/09/10/Emulating-Android-native-libraries-using-unidbg.html

Link-Write Attack: A sweet combination - https://blog.nody.cc/posts/link-write-attack/

CVE-2024-6769: Poisoning the Activation Cache to Elevate From Medium to High Integrity - https://www.fortra.com/blog/cve-2024-6769-poisoning-activation-cache-elevate-medium-high-integrity

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan - https://www.seqrite.com/blog/operation-cobalt-whisper-targets-industries-hong-kong-pakistan/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.10.30.md

LLM Hacker's Handbook - https://doublespeak.chat/#/handbook

MobSF "IPA Binary Analysis" | Step by Step - https://inesmartins.github.io/mobsf-ipa-binary-analysis-step-by-step/index.html

ZombAIs: From Prompt Injection to C2 with Claude Computer Use - https://embracethered.com/blog/posts/2024/claude-computer-use-c2-the-zombais-are-coming/

Introducing a New Vulnerability Class: False File Immutability - https://www.elastic.co/security-labs/false-file-immutability

Docker Containers Security - https://tbhaxor.com/docker-containers-security/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.10.28.md

Acquiring Malicious Browser Extension Samples on a Shoestring Budget - https://pberba.github.io/crypto/2024/09/14/malicious-browser-extension-genesis-market/

Dumping lsass using only NTAPIs by hand-crafting Minidump files - https://ricardojoserf.github.io/nativedump/

ARCrypter Ransomware Expands Its Operations From Latin America to the World - https://blogs.blackberry.com/en/2022/11/arcrypter-ransomware-expands-its-operations-from-latin-america-to-the-world

Spip Preauth RCE 2024: Part 1, The Feather - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/

A "Gau-Hack" from EuskalHack - https://gum3t.xyz/posts/a-gau-hack-from-euskalhack/

#informatyka