Necromancer @ZeroMemoryEx

Cyber Security Consultant | Security Researcher hackandhide.com Joined December 2019

Tweets

240
Followers

2K
Following

483
Likes

1K

Necromancer @ZeroMemoryEx

6 months ago

Published a blog on my previous exploit. I've also discovered a privilege escalation vulnerability affecting MSI, Lenovo, ASUS, Alienware, Huawei laptops, and more. The vulnerability has been confirmed, stay tuned for the write-up once it's patched! hackandhide.com/from-dos-to-pr…

2 33 145 9K 67

Necromancer @ZeroMemoryEx

12 months ago

It’s been a while since I posted any updates here, so here’s a recap. I’ve fixed errors and memory leaks, improved error handling, added file restriction and integrity bypass features, and implemented a driver swap for disk and memory for more detail,check github.com/ZeroMemoryEx/C…

4 26 131 10K 88

Necromancer @ZeroMemoryEx

2 years ago

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes github.com/ZeroMemoryEx/T…

5 159 483 53K 161

Necromancer @ZeroMemoryEx

2 years ago

Tired by EDRs and AVs continuously flagging your executables? This program terminates protected anti-malware processes by exploiting the GMER driver github.com/ZeroMemoryEx/B…

7 168 526 150K 208

BriPwn @BriPwn

2 years ago

In this week’s red team tip. I will show how to use @ZeroMemoryEx AMSI Killer to patch AMSI and allow Invoke-Mimikatz to run. This attack does get detected by Windows Defender, but it’s too late as memory is already patched. #hacking #redteam youtu.be/QFp3ybRKr7Q

0 1 6 2K 0

Emmanuel Fleury @perr0r

3 years ago

Lazarus-Tactic: program based on APT38 North Korea-backed hackers tactic that used in targeting security researchers using a malicious Visual Studio project file (vcxproj) to steal their 0days. github.com/ZeroMemoryEx/A…

0 28 66 8K 15

Necromancer @ZeroMemoryEx

3 years ago

New AMSI lifetime bypass, it works by searching for the first byte of each instruction to prevent updates from affecting it, Check it out. #amsi #redteam #cybersecurity github.com/ZeroMemoryEx/A…

6 190 501 59K 147

Denis Skvortcov @Denis_Skvortcov

3 years ago

Just published new blog post tinyurl.com/4ua23wzv! How can you hook systemcalls in kernel on Windows 11 22H2, how does Avast Free Antivirus use it and how you can bypass Avast’s self-defense in 10 lines of PowerShell code right now? All answers are provided in the article

3 114 270 0 77

Necromancer @ZeroMemoryEx

3 years ago

it can be very annoying for analysts to wait for the malware to do its true malicious behavior,That's why i made this program that patch the Sleep function and speed up the execution ,check it out. github.com/ZeroMemoryEx/S… #malwareanalysis #cybersecurity #malwaredetection #redteam

2 27 74 0 11

Will @BushidoToken

3 years ago

The world of Ransomware is full of surprises: LockBit allegedly paid out their first “bug bounty” to someone who highlighted decryption flaws in the LB3 ESXi variant. The flaw made it possible to bypass having to pay the ransom for a key

15 196 618 0 67

Download Image

Jonas L @jonasLyk

3 years ago

Presenting D-Generate , syscall tracing as its supposed to be! raw.githubusercontent.com/jonaslyk/temp/… usage: dg cmd.exe - displays all syscalls done by process with cmd.exe as imagefile. dg 4736 - by pid 4736 dg - just everything example of recording: raw.githubusercontent.com/jonaslyk/nt/ma…

17 241 790 0 213

Download Image

Pavel Yosifovich @zodiacon

3 years ago

Zombie Processes scorpiosoftware.net/2022/05/14/zom…

6 97 288 0 77

Connor McGarr @33y0re

3 years ago

Arbitrary read/write -> arbitrary kernel-mode API calls with HVCI and Kernel CFG enabled :) - in this case a POC to invoke ZwOpenProcess on the System process in VTL 0. I will blog on this soon!

6 77 331 0 37

Download Image

cts🌸 @gf_256

3 years ago

DirectX

4 7 192 0 6

Download Image

Justin Elze @HackingLZ

3 years ago

👀 "This is essentially a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings)." github.com/Dec0ne/KrbRela…

8 111 318 0 83

Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid

3 years ago

Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam

48 818 3K 0 741

Download Image

vx-underground @vxunderground

3 years ago

.@jaco_ZA released a video explaining his recent Red Team engagement.

24 278 1K 0 108

Download Video

Michael Maltsev @m417z

3 years ago

Check out the new blog post about my journey in implementing the technical aspects of Windhawk - implementing global injection and hooking in Windows. m417z.com/Implementing-G…