alien177

alien177

Diving in SyscallHook

Intro This short blog post is an attempt to explain the steps performed by the SyscallHook framework to hook the NtCreateFile system routine. SyscallHook SyscallHook is the framework developed by Anze Lesnik for monitoring and hooking system calls. It is based on the older InfinityHook framework. The main idea behind

Extracting IP from getaddrinfo call

Summary This short post documents tracking down the IP address location and value resolved by the getaddrinfo function call with the help of x64dbg. Tools To follow along you will need to build 32-bit WinSock server and client provided by Microsoft and x64dbg. Getaddrinfo The getaddrinfo function resolves the provided

PSScriptAnalyzer: Tokens and ASTs

Introduction Bumped into the PSScriptAnalyzer the other day and a very interesting work on detecting PowerShell scripts obfuscation using ASTs by Daniel Bohannon. So figured it might be interesting to create a small write-up about ASTs, PSScriptAnalyzer, custom PSScriptAnalyzer rules, and put all the info that's out there in one

Part I: Remcos .NET Loader

Summary Quick RE of Remcos .NET loader (e0516fbf7582151fe90b672925f75734). Static Analysis I will skip the static analysis write up since it was not very exciting. We are working with a 32 bit .NET Windows PE and you can find a couple of interesting things statically by examining the file's metadata stream

Registry: LsaSrv

Introduction Grzegorz Tworek discovered that the LsaSrv registry key could be potentially used for persistence on the host since it contains the list of DLLs that LSASS.exe automatically loads. However, it requires a little bit of work to modify its value due to its original permissions. Therefore, I figured

"/0/0"

Summary I bumped into this cool research from eWhite Hats [https://github.com/ewhitehats/InvisiblePersistence/blob/master/InvisibleRegValues_Whitepaper.pdf] the other day and figured why not to build and RE it. Might learn something in the process ¯\_(ツ)_/¯. So here we go. Compilation TL;DR version of the paper