Print3M

Releasing EPIC [Extensible Position Independent Code] – toolkit for C/C++ shellcode building 🔥 github.com/Print3M/epic - Modularity (!) - Dead-code & payload size optimization - Global context - Minimal PIC-friendly libc & win32 included - More... #redteam #malware #security

@niebezpiecznik Dopiero 12 raz dzisiaj widzę posta typu "BREAKING!!!1! Someone just open-sourced". Claude coś dzisiaj zamulał, pewnie dlatego taki słaby wynik.

Ktoś z Was już testował?

@SEKTOR7net Wow, thank you friends! :)

DllShimmer - DLL proxy automation. The tool parses original DLLs to generate C++ projects, allowing users to insert custom code while maintaining functionality. A post by @Print3M_ Source: print3m.github.io/blog/dll-sidel… #redteam #blueteam #maldev #malwaredevelopment

i don't want TO CREATE A FUCKING MICROSOFT ACCOUNT TO SETUP WINDOWS!!!!!!!!

@ale_sp_brazil @MacmodSec I was using Godap on my engagement! Very nice looking and convenient tool. I like the feeling and detailed info about objects. Didn't know about FlashIngestor! Thanks :)

My colleague Artur @MacmodSec (co-author of Malwoverview for the last two years) has two interesting projects for those who are part of red teams and blue teams. 01. godap: A complete TUI for LDAP: github.com/Macmod/godap 02. FlashIngestor: FlashIngestor is a TUI for Active Directory collection compatible with BloodHound Community Edition: github.com/Macmod/flashin… #redteam #blueteam #cybersecurity #windows #ldap #windowsecurity #ad #activedirectory

@domchell Don't forget to check out the free ebook pdf I prepared for you in the pinned post on my profile. Cheers.

I can’t be the only one who feels like this 😂

@techspence @PyroTek3 Looks cools, thanks! :)

How to find insecure permissions in AD, without bloodhound. 1. Download ADeleg 2. Open ADeleg 3. Click view -> index view by trustees 4. Look for delegations granted to: - Authenticated Users - Domain Users - Domain computers - Everyone What delegations? - Write all properties - Create/delete child objects - Ownership of a resource - Add/delete delegations - Write attribute - Validated write - Change the owner - Change password If you want to quick and easy way, my wrapper automated this discovery for you. github.com/techspence/ADe…

Awesome real-life RedTeam infrastructure overview by @0XDbgMan 🔥🔥🔥 Juicy. 0xdbgman.github.io/posts/red-team…

### Top-Line Findings 1. **The C2 ecosystem is far less diverse than it appears.** While there are 30+ "different" frameworks, the underlying technique implementations converge on a small number of canonical code patterns, many traceable to specific open-source authors or blog posts. 2. **Three source projects account for the majority of reused code:** - **TrustedSec's COFFLoader** — the ancestor of nearly every open-source BOF loader - **PowerSploit** (by @harmj0y, @mattifestation, @obscuresec) — Get-Keystrokes, Invoke-Mimikatz, PowerView, and persistence modules are shipped verbatim by Empire, PoshC2, PowerHub, Amnesiac, and Shad0w - **Kevin Robertson's Invoke-WMIExec/Invoke-SMBExec** — the dominant PowerShell implementations for WMI and SMB lateral movement, bundled by Empire, PoshC2, PowerHub, and SilentTrinity 3. **A single detection rule can catch multiple frameworks.** Because many C2s share identical implementation code: - One detection for the PowerSploit `Get-Keystrokes` GetAsyncKeyState polling loop catches Empire, PoshC2, and any framework that bundles PowerSploit - One detection for the TrustedSec COFFLoader relocation pattern catches Apollo, Loki, Sliver (extension), and derivatives - One detection for the .NET `ManagementScope` WMI pattern catches Apollo, Covenant, NimboC2, SilentTrinity, and DeimoC2 4. **Genuinely novel frameworks are rare.** Of the 30 analyzed: - **4 frameworks** (Sliver, Havoc, Realm, TripleCross) demonstrate significant code originality - **6 frameworks** show moderate originality (Wyrm, AdaptixC2, Emp3r0r, Merlin, NimPlant, GC2) - **20 frameworks** rely heavily on shared code from the three source projects above, or implement techniques using the same well-known recipes 5. **HTTP C2 communications show the most behavioral convergence.** Three jitter formula families, shared User-Agent strings (the IE11 UA appears in Empire, Nuages, and Covenant), and common URL path patterns create fingerprinting opportunities.

@mrgretzky I just love to code and I'm tired of this imposed AI-FOMO feeling attacking me from everywhere.

I wanted to remind everyone that the current business model for LLMs is unsustainable. This is why OpenAI announced it would add ads to GPT output. A move Sam Altman said would be made only as a desperate measure if they don't figure out a better way to make money. LLM models, rather than becoming cheaper to maintain, require increasingly more power for the smallest improvement gains. What is now considered to be rather cheap, throwing $200 a month or more to vibe code a web app from scratch, may become super expensive and out of reach for casual users, in the near future. We're in a phase where tech companies use aggressive price dumping to get everyone addicted, before they start raising prices to cover the costs of the newly built data centres. And they're running out of time as the hype wanes and investors want to see the returns of their investments. Just please keep that in mind the next time you try to convince people that manual software development is dead. Stay off the hype wave and look at the numbers. It's unsustainable in its current form. Disclaimer: Yes, I'm just another scared software developer trying to cope. Have a great day!😉

Might be interesting for you: @hasherezade @gynvael @vxunderground @curi0usJack @mrgretzky @mrd0x @C5pider @ShitSecure @mariuszbit @MateuszChrobok @domchell @Octoberfest73 @mrexodia @5mukx

Do you know you can create a custom Google search with limited scope? I collected 230+ high-quality IT security sources (blogs, etc.) and created Google Hack Search 🔥 github.com/Print3M/Google… No AI, no marketing, no bullshit. Old internet. Pure hacking. #redteam #infosec

Demo:

Direct link: cse.google.com/cse?cx=5386f5d…

Highly recommend this summary. Not only because there's my research included... but mostly;)))))

@Octoberfest73 I would say malware development is 80% of just a desktop software development and 20% of juicy things. I guess people like to write 80% of the code in a language they consider "more convenient to work with".

IRT writing windows malware/tooling, what do people see in / like about doing so in languages like Rust? From where I stand it feels like it only makes it harder to interact with APIs/low level windows stuff, another layer of abstraction to have to work through compared to C

@awesomekling Bro, it's going to be outdated from day 1...

What if we just don’t put AI in the browser? 🤔

@_RastaMouse @_xpn_ This 100%. Every side-project, every blog post.

@_xpn_ I get this for literally every blog idea I've ever had.

Anyone else get a feeling immediately after you find a vuln.. Almost like someone is looking over your shoulder and is gonna steal it before you have chance to disclose? One for the therapy couch I think xD

Good lord, Signal is down...