Kernel Karnage – Part 8 (Getting Around DSE)

When life gives you exploits, you turn them into Beacon Object Files. 1. Back to BOFs I never thought I would say this, but after spending so much time in kernel land, it’s almost as if developing …

Kernel Karnage – Part 6 (Last Call)

With the release of this blogpost, we’re past the halfway point of my internship; time flies when you’re having fun. 1. Introduction – Status Report In the course of these 6 weeks, I’ve cover…

Kernel Karnage – Part 4 (Inter(ceptor)mezzo)

To make up for the long wait between parts 2 and 3, we’re releasing another blog post this week. Part 4 is a bit smaller than the others, an intermezzo between parts 3 and 5 if you will, disc…

Gather | A better way to meet online.

Centered around fully customizable spaces, Gather makes spending time with your communities just as easy as real life.

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2

We decrypt Cobalt Strike traffic using one of 6 private keys we found. In this blog post, we will analyze a Cobalt Strike infection by looking at a full packet capture that was taken during the inf…

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1

We found 6 private keys for rogue Cobalt Strike software, enabling C2 network traffic decryption. The communication between a Cobalt Strike beacon (client) and a Cobalt Strike team server (C2) is e…

Anatomy and Disruption of Metasploit Shellcode

In April 2021 we went through the anatomy of a Cobalt Strike stager and how some of its signature evasion techniques ended up being ineffective against detection technologies. In this blog post we …