Lemon

314 posts

Lemon

Lemon

@Lemonitup

Principal Security Engineer @ Red Threat https://t.co/qGxQnY0KNq

Oklahoma, USA Katılım Kasım 2014
277 Takip Edilen877 Takipçiler
Lemon
Lemon@Lemonitup·
@offsectraining The “AI” while true; do read -p "Enter something: " user_input echo "Try Harder" done
English
0
0
20
1.4K
OffSec
OffSec@offsectraining·
Introducing... OSAI 🐺🚨 From the makers of OSCP, the OSAI brings OffSec’s offensive methodology to AI with advanced red teaming for AI environments. This certification turns AI security knowledge into legitimate capability that holds up in the real world. 🔺 Expand into one of the fastest-growing security domains 🔺 Prove hands-on capability with a practical certification 🔺 Build repeatable methodology you can use across engagements Be the first to see what #OSAI covers, who it’s for, how the certification works, and be entered in a giveaway for free access: offsec.com/courses/osai/
English
13
91
623
60.8K
Lemon
Lemon@Lemonitup·
@vxunderground 7. Just unload the filter drivers with fltmc unload. (Need admin) Bypassestamper and password protection, av still shows enabled and malware executes.
English
0
0
2
92
vx-underground
vx-underground@vxunderground·
I've decided to poke MalwareBytes with a stick. Why? I'm mildly curious how it works internally and I'm curious if I can produce malware custom tailored to evade it. Why? Because sometimes I get weird ideas and want to do weird things for literally zero reason other than "sounds kind of cool". I setup a VM for the first time in years to poke it with a stick. I didn't want to install an AV on my main machine. Yes, I will do malware analysis on my main machine but not install an AV. After installing MalwareBytes, skimming some of the files, poking random things and saying "wtf does this thing do", I've learned some mildly interesting things but nothing revolutionary. 1. They use Jenkins for continuous integration. Does this mean anything? No. 2. Based off my minimal testing, I don't see any DLLs injected into binaries when they're loaded into memory. However, the binaries I tested are well known and well established. It might inject DLLs into unknown binaries. 3. MalwareBytes main binary is written in C#.NET. It loads a secondary MalwareBytes.dll which then displays everything. It does the same stuff Microsoft Copilot does. That is how MalwareBytes has a fancy UI and stuff. 4. MalwareBytes stores very little in HKEY_CURRENT_USER making tampering from user mode kind of hard. It's just basic settings and stuff. 5. MalwareBytes has a custom protocol handler of "malwarebytes://". It looks like it uses this for interprocess communication between other MalwareBytes modules and binaries 6. MalwareBytes ships with a (basically) blank DLL called "Sample.dll". I have no idea why. 7. MalwareBytes has 2 mini filters in place which (presumably) are the main thing responsible for detecting malware. This is standard. MalwareBytes Chameleon (one of the minifilters) looks like it's meant to prevent tampering with the actual important MalwareBytes minifilter. 8. MalwareBytes Chameleon looks like it's responsible for communicating with user mode and kernel mode components. It looks like this is done so user mode components don't communicate directly with the minifilter responsible for actually detecting malware 9. I have a lot more poking to do 10. There is a binary called "assistant.exe" which loads "assistant.dll" (more .NET) stuff. It may possible to abuse this as a LOLBIN (maybe, need to poke more, kind of). assistant.exe does things like issuing commands for scanning, updating, and displaying things in the MalwareBytes UI. It accepts commands as "assistant.exe --uri malwarebytes://" 11. I have no idea how their scanning works, but it's labeled internally as Hyperscan 12. There is a thing called ProtectedHashes. I have no idea what this is. 13. There are tons of SQLite libraries, but I have no idea what it's for. Presumably, it's for known-good and known-bad file hashes, maybe? But I have no idea where this is stored. 14. I like cats
English
31
27
952
51.9K
WeaponOutfitters.com
WeaponOutfitters.com@WeaponOutfitter·
Early aughts, first time going to SHOT show, pal who founded a a rifle company told me to go to the "circle bar". I google search "circle bar" and then start looking for cirles on various casino maps, can't find shit. Probably walked around for an hour or two trying to find it.
English
13
2
208
22.9K
Lemon
Lemon@Lemonitup·
Doom on a traffic light controller.
English
0
0
1
65
Jenn
Jenn@_nextjenn·
pls
Jenn tweet media
5
2
46
5.7K
Lemon
Lemon@Lemonitup·
Denver Moore@thatdenverguyYT

Huge viral tweet went out about a guy with severe pain and after months of doctors and no answers, some guy basically says "bro, just hang from a bar" And the guy was cured YouTube advice is like this sometimes and some of you guys refuse to do it I say this with my whole heart, people who complicate youtube usually fail. They dig a hole and keep digging thinking there is some treasure chest at the bottom. The treasure chest is sitting on the grass already. They got lost in the stats and panic when CTR is 7.2 instead of 7.3 while some 14 year old in Roblox just broke 100k and doesn't even know what the word analytics means Seriously I work with a channel that just hit 300m views in a month and he doesn't look at analytics. Ever. Take a moment, think about that The more I do youtube, the less I look at the stats. And I do a LOT of YouTube. Stats tell you whether you already failed or succeeded, but you didn't need the stats to tell you that. A video that has 5% ctr right now could be 13% in the morning with triple views. A video with 50% APV could be 30% by midnight. And then 55% again in two weeks. Make good videos, put them out, then let them find the right audience. If it gets views, you did it right. If not, you missed something. You need to develop the INSTINCT for what people want. I go through so many coaching calls these days and we barely talk stats. I don't even need to see them. I can tell you pretty quickly what's happening and what you need to do about it. But Denver, can't I go into the analytics now and see where I went wrong? Sure, but you should already know before you even look. Because you are developing the instinct. You know what a good youtube video FEELS like. Either your topic sucked, your thumbnail didn't represent in an interesting way, or you still aren't able to hold a wide audience with your presentation. And those analytics you're dissecting won't even be able to tell you much and lead people astray more than on the right track with confirmation bias and theories. Don't get me wrong, stats aren't useless or anything. It's okay to test a new thumbnail and see if it hits, and I've got many extra views this way. It's okay to check retention graphs and see if there are moments you're losing a good chunk of the audience. But these are usually tiny little improvements whereas that time should be spent improving your instincts at those 3 things - finding inherently interesting topic - making or paying for a thumbnail that makes it even more interesting - enjoyable, likeable presentation (this is one you and nobody else can really do it for you) There is a reason MrBeast summed up all of his hours of podcasts and years of experience into "just make better videos" Didn't get views? Video wasn't good enough The best videos are on a topic people already care about (whether they personally know it yet or not), a pretty picture that makes it more interesting, and a good enjoyable friend to share it to them To repeat: - idea people are already interested in - pretty picture that makes it even more interesting - an enjoyable person to present it to them confidently No I don't have an acronym or some fancy graph or picture that works well on Twitter engagement, that's overcomplicating it Do those things, you'll get more views immediately So... Bro, go hang from a bar Whew this was a long one but hopefully a banger. To some, the puzzle pieces just clicked for years to come. To others, this may make no sense but hopefully at some point it will.

QME
0
0
1
28
Lisa Forte
Lisa Forte@LisaForteUK·
I think I have a got a trapped nerve in my leg - glute / high hamstring level. In a lot of discomfort and it is radiating down my leg. Stretching, rolling it all done. No change. I’ve googled but has anyone actually had this and what has helped?
English
16
0
10
2.1K
Lemon
Lemon@Lemonitup·
@vxunderground Let me Rule was my favorite because you could play ragtime music via the motherboard speaker.
Lemon tweet media
English
1
0
14
409
vx-underground
vx-underground@vxunderground·
AcidDrop vs Anti-Lamer Backdoor Which malware UI wins?
vx-underground tweet mediavx-underground tweet media
English
41
11
273
25.7K
Lemon
Lemon@Lemonitup·
@RachelTobac I was worried until I remembered I didn’t play Tennis. Still threw a few decks of cards into my bag for DEFCON!
English
1
0
2
400
Rachel Tobac
Rachel Tobac@RachelTobac·
OSINT can be so obnoxious on hard targets until I figure out that you *changed your name* bc I used an AI tool to search your face and it returns local newspaper posts from childhood w/ your baby face about magic competitions, honor roll, tennis, and a hypnosis talent show run!
English
5
10
172
9.5K
I am Jakoby
I am Jakoby@I_Am_Jakoby·
0 click NTLM hash grab! This is actually one of the craziest exploits I have ever seen Shoutout to @zeifan for the original POC He was kind enough to share his version where simply right clicking the lnk file would send over the users password hashes I did a little modification and you dont even have to click anything anymore simply navigating to the directory where the malicious lnk file is triggers it and sends your password hashes to me! This is truly one of the best exploits I have ever witnessed
English
42
145
784
74.5K
Lemon
Lemon@Lemonitup·
@awakecoding Snaplabs. Build out a default testing environment then snapshot it for easy rebuilds.
English
0
0
2
770
Marc-André Moreau
Marc-André Moreau@awakecoding·
I’m looking for on-demand virtual lab platforms that can spin up full Active Directory environments (8 vCPUs, 64GB RAM, nested virt). It needs to support complex enterprise scenarios to showcase Remote Desktop Manager with other Devolutions products. Any recommendations? 🙏
English
11
11
84
16.4K
Lemon
Lemon@Lemonitup·
@plaverty9 @techspence @jsark983 Digital signage hacking. Had a rough few years when they removed cd drives from computers and I didn’t have a kinetic outlet for demonstrating access.
English
0
0
3
108
Patrick Laverty 🎱
Patrick Laverty 🎱@plaverty9·
What is your favorite fun and non-privesc thing to exploit during a pentest @techspence, @jsark983 and anyone else? On an internal, I send the client an email from themselves over an open SMTP relay. The email body says it is from me.
English
5
0
14
1.7K
Lemon
Lemon@Lemonitup·
@deadvolvo I was in the same place when I started seeing top 1% THM on every LinkedIn headline. I found more fulfillment in building POCs like a malicious charging station or hacking hardware I bought of eBay. Those things also stand out on a resume more than CTFs.
English
1
0
1
37
Lemon retweetledi
DistrictCon
DistrictCon@DistrictCon·
❗ Most Impactful System ❗ WINNER: @Lemonitup: bypassing authentication prompts on an Intelight X-1 traffic control system 🚦 RUNNER UP: SeongJoon Cho & Dongheyon Oh, @LabsSsd: exposing security flaws in the D-Link DSR-250 VPN Router 🌐
English
1
2
5
393
Lemon
Lemon@Lemonitup·
@Uber your Safety team stopped responding to me about my driver swerving between lanes on the highway because he was trying to drive and play clash of clans. Any update?
Lemon tweet media
English
2
0
1
89
Lemon
Lemon@Lemonitup·
@techspence We have a default methodology for every assessment type of what to test and even in the event of a no findings test we still have a solid report with work to show. After that, engineers are free to hunt zero days or waste a whole day on a buffer overflow.
English
1
0
3
271
spencer
spencer@techspence·
Hey pentesters....do you follow the exact same SOP/process for each and every engagement, despite the environment? Of course I understand every environment is different but I mean procedurally...
English
13
2
40
7.1K
Lemon
Lemon@Lemonitup·
@LucasBotkin 4:20 fuel up with some green before hitting the Jiu Jitsu gym.
Lemon tweet media
English
0
0
2
144
Lucas Botkin
Lucas Botkin@LucasBotkin·
Insert Jocko quote.
Lucas Botkin tweet media
English
56
3
481
27.3K
Lemon
Lemon@Lemonitup·
@HackingLZ With enough head gasket shims this might work but the lower compression negates any advantage gained from the longer stroke.
English
0
0
1
195
Justin Elze
Justin Elze@HackingLZ·
I love the internet when people share gold like this 😂
Justin Elze tweet media
English
18
0
26
6.3K
Lemon
Lemon@Lemonitup·
@chrissanders88 Hope they configured global audit policy more than 3 years ago. Hope you have any logging. Check last login date or if ever logged on. Try the password testuser for lulz
English
0
0
4
916
Chris Sanders 🔎 🧠
Chris Sanders 🔎 🧠@chrissanders88·
Investigation Scenario 🔎 You’ve discovered a 3 year old account named “testuser” on your Windows domain. Nobody knows who created it. What do you look for to investigate whether this account has been used for any malicious activity? #InvestigationPath #DFIR #SOC
English
18
20
78
16.2K
Lemon
Lemon@Lemonitup·
@TMDFIR Absolutely! I deploy security onion on every ransomware engagement. EDR only works if you deploy it on EVERY host. NDR along with JA3 signatures are essential for identifying persistence from cobalt strike or RMM tools on host you missed deploying edr on.
English
1
2
10
681
Chris LaFleur
Chris LaFleur@TMDFIR·
Question does NDR(Network Detection and Response) go into your IR playbook or is it just EDR only?
English
8
0
9
3.6K