ScriptBlock Smuggling allows an attacker to spoof any arbitrary message into the ScriptBlock logs while bypassing AMSI. To make things more interesting, it also does not require any reflection or memory patching to be executed. AMSI patching in particular, has started to be targeted by a lot of AV and EDR solutions so this is a major perk of the technique.

Some extremely good logic bugs will e.g. exec() attacker-supplied code or run an attacker-supplied script under a sufficiently-powerful interpreter to exploit the next bug in the chain. Other logic bugs are coupled with an external form of unsafety, such as JIT, and thus produce memory corruption effects. However, it’s much more common that exploiting a logic bug in a vulnerable program will remain bound by the constraints of the program’s source code and the programming language. That is a fundamentally different world than what is offered by memory corruption, where a much higher fraction of bugs can make the vulnerable program shed the constraints of the program and language to only remain bound by the constraints of the underlying CPU.

In this blog post, I’ll be going through some of the reasons why I believe that attacking Active Directory from Linux is a better choice than attacking from Windows; and of course some examples of how to do so. I had this realization that the majority of the time when my friends were having issues, I would direct them to port their ticket(s) to linux and use the tools there with --debug. The errors thrown here are usually much more helpful and easier to google, and not affected by the instability of Windows. I believe that the majority of the time, you can perform the same attacks on Active Directory from Linux as you would from Windows, but with the added benefit of being able to debug your issues more easily. I don’t claim that attacking from Linux is the right choice for all scenarios. It is ultimately the responsibility of the operator to decide what tools to use based on the situation at hand.

After the past several decades of humanity putting all of its collective knowledge online, we are seeing more ways to prevent us from accessing it. Not only is good information harder to find, bad information is drowning it out. There are increasing incentives to gatekeep and collect rent on important resources, and to disseminate junk that is useless at best, and harmful at worst. In all of this chaos, the real threat is the loss of useful, verified, and trusted information, for the sake of monetizing the opposite. Fortunately, there are still hackers. For every smokescreen that clouds our vision, hackers help to clear the air. For every new garden wall erected, hackers forge a path around it. For every lock placed on our own ideas and cultural artifacts, hackers craft durable picks to unshackle them. Hackers try to understand what lies beyond their perspective. Hackers focus on what is real, and what is here.

Neighbors, please join me in reading this twenty-third release of the International Journal of Proof of Concept or Get the Fuck Out, a friendly little collection of articles for ladies and gentlemen of distinguished ability and taste in the field of reverse engineering and the study of weird machines. This release is a gift to our fine friends in Washington, D.C.

HELLO, THIS IS YOUR (DEFINITELY) HUMAN EDITOR, AGA. I really like interacting with other humans just like me. Working on Issue #4 allowed to interact with so many of you. To read a lot of very nice things about the magazine and the work of the whole Pagedout Institute crew.

Hi! It’s me again, your human editor AGA. I like meeting you like this :) Look! Here we are, back with another Issue! How the time flies, it feels like yesterday Paged Out! returned with Issue #3, then we blinked twice, and found ourselves on track with Issue #5 on our hands. Magic (or it’s just how time works, one or the other, I guess).

The Decompilation Wiki is a collection of categorized information on all things decompilation. From real-world applications to cutting-edge research papers, the Decompilation Wiki has it all!

bug.directory is a searchable Obsidian vault brought to you by the exploits.club team. It’s intended to serve as a collection of vuln research, exploit development, and reverse engineering resources to help you get spun up on new projects fast. The database has been initially seeded with weekly resources collected for the exploits club newsletter. That said, the vault is open-source and thus the more contributions from the community the better.

Threat actors are known to sign their malware using stolen, or even legally acquired, code signing certificates. This threat is becoming more relevant as more and more defenses are relying on digital signatures for allowing or not execution on an endpoint. This project aims at collecting the details of the certificates that are known to be abused in the wild by malicious actors.