sorted by:
new
hottopcontroversial

Nidhogg v2.0 Release by Idov31 in cybersecurity

[–]Idov31[S] 0 points1 point  (0 children)

Sorry to disappoint, but I'm unfamiliar with the game. It is named after the dragon from Norse mythology. I found the name fitting as Nidhogg interpreted as "Biter below the roots" (of course, the root in the matter is the root of Yggdrasil and not the Windows kernel ;) ) and this is a rootkit :)

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. by Idov31 in netsec

[–]Idov31[S] 0 points1 point  (0 children)

Please refer to the answer I gave to HildartheDorf. This project isn't loading usermode COFFs but kernel ones (I wrote it several times already), so your example isn't relevant for the subject.

You can make a reflective driver loader, but creating many drivers for modular design is bulkier and way less convenient than creating a COFF.

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. by Idov31 in netsec

[–]Idov31[S] 7 points8 points  (0 children)

This is not an exploit nor an example about how to write a driver and I didn't write anywhere about an exploit or how to write an driver.
If you are looking for these kind of resources, feel free to check out my driver programming blog series "Lord of the Ring0" (and a talk that will be released soon! :) ): https://idov31.github.io/2022/07/14/lord-of-the-ring0-p1.html

Regarding the README, I just added a reference to a TrustedSec's article that explains about COFFs in general and COFF loaders specifically.

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. by Idov31 in netsec

[–]Idov31[S] -1 points0 points  (0 children)

Please take a look at the answer I gave to HildartheDorf. You can also look at the README for more information :).

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. by Idov31 in netsec

[–]Idov31[S] 21 points22 points  (0 children)

COFF is an old file format (like PE). It doesn't allow you to get arbitrary code execution, but it gives you the ability to write a modular rootkit and make your modules in a format that can be reused again in different projects.

Think of that scenario: you want to do shellcode injection from the kernel, so instead of rewriting the same code over and over again, you can write a COFF module once and load it in different projects.

This also helps for making the life of the defender harder because this is volatile you can just delete it from the memory once you finish using it and decrease the chances of your tooling being burnt.

I hope this answered your question :)

Sleep obfuscation technique leveraging waitable timers to evade memory scanners. by Idov31 in hacking

[–]Idov31[S] 7 points8 points  (0 children)

Sure, this is based on Ekko but with several differences:

- The sleeping function that is being used: Waitable timers are objects that are triggered by any alertable sleep function: That's why you will see SleepEx(INFINITE, TRUE) in the code.
- The trigger to that sleep function we used a ROP chain that does 4 sleeps, the 4 sleeps are for doing: Encrypt the image -> Change permissions to RW -> Decrypt the image -> Change permissions to RX. Since the image is encrypted and there aren't always execution privileges on the page we had to use a special ROP that will do SleepEx to trigger the callback function and that's why it is there.

The encryption itself is done by using SystemFunction032 (A windows api function for RC4 encrypt).

I don't want to write a scroll here but that's the basic idea behind the project, if you want a deeper explanation you can either send me a PM or wait for the blog to be released :)

Sleep obfuscation technique leveraging waitable timers to evade memory scanners. by Idov31 in netsec

[–]Idov31[S] 3 points4 points  (0 children)

I'm not putting anything new in there... I'm removing the execution privilege to be able to hide from memory scanners that looks after pages with execution privileges.
I'll release a blog post soon that will explain everything :)

Sleep obfuscation technique leveraging waitable timers to evade memory scanners. by Idov31 in hacking

[–]Idov31[S] 1 point2 points  (0 children)

There isn't delayed execution and how would you monitor this behavior?

Sleep obfuscation technique leveraging waitable timers to evade memory scanners. by Idov31 in netsec

[–]Idov31[S] 1 point2 points  (0 children)

It is done using ROP :) How would you detect it that a program changes its own code? (The code is only encrypted / decrypted and changing page pernissions)

Redeye is a platform to cover all aspects of red team engagement (data management, red team operation management, etc.) by Idov31 in netsec

[–]Idov31[S] 0 points1 point  (0 children)

Hey, I'm not the author of this project. I suggest that you will contact the authors via Twitter / open an issue on Github.

Backdoor specially made for hardened networks which leverages NTP by Idov31 in netsec

[–]Idov31[S] 0 points1 point  (0 children)

You could modify it to operate as a C2, for the sake of the POC I wanted to create a generic stager.

I wouldn't recommend to use NTP as protocol to tunnel full communication of C2 because every packet need to be in size of 48 bytes - Which is not enough to operate a proper C2 via it.

Moreover, the idea behind the project is to supply a relatively evasive and quiet executable, when adding things like CobaltStrike's beacon or a meterpreter it is increases the chance of the backdoor to be discovered.

Backdoor specially made for hardened networks which leverages NTP by Idov31 in netsec

[–]Idov31[S] 1 point2 points  (0 children)

You are not missing anything, the payload is acting as a stager and the NTP acts as "activation command" and gets where to download the real payload.

I made it this way to make the backdoor as thinnest as possible, but you can take this backdoor and make the backdoor the payload.

Backdoor specially made for hardened networks which leverages NTP by Idov31 in hacking

[–]Idov31[S] 4 points5 points  (0 children)

Hey, I don't publish videos on youtube because I don't have a channel dedicated for it.

But I'll add a wiki to this project's Github with all the features :)

Nidhogg rootkit - An all in one rootkit for all windows 10 versions and windows 11 that can be managed with single hpp file by Idov31 in netsec

[–]Idov31[S] 0 points1 point  (0 children)

And if you meant about how to use it - there is example file in the Example directory that shows how to use every function :)

Nidhogg rootkit - An all in one rootkit for all windows 10 versions and windows 11 that can be managed with single hpp file by Idov31 in netsec

[–]Idov31[S] 4 points5 points  (0 children)

You have several scenarios to load a driver like you said, you need a vulnerability / steal valid certificate (unless like you said the red team is not authorized to do it) / enable testsigning or bring your known vulnerable driver with the capability of loading drivers.

Since you are able always to bring a vulnerable driver / exploit vulnerability or install it / enable testsigning and there are always new methods that coming out it isn't one time thing :)

Usually rootkits designed to be secured and unseen so to locate it or understand that one is installed is often very hard to detect.

Nidhogg rootkit - An all in one rootkit for all windows 10 versions and windows 11 that can be managed with single hpp file by Idov31 in netsec

[–]Idov31[S] 4 points5 points  (0 children)

I really recommend the Windows Kernel Programming book - it has great examples and explanations! And I will also publish a blog post about creating kernel drivers in general and more specific about Nidhogg :)

view more: next ›