Professional redteamer and malware development enthusiast ! I will share some tips and experiences. Look at my work here : https://xitter.cf/t.co/cxLBvW7pcI
Joined August 2021
- Tweets751
- Following79
- Followers7.6K
- Likes672
Pinned Tweet
Hey ! I published a large part of my notes, and I hope you will find something new to learn in it. It goes from simple #OSCP notes to #Malware development (#COFFLoader, #ModuleStomping, #ReflectiveDLLInjection...).
otterhacker.github.io
I'm thrilled to announce that I've been selected to give a 40 minutes briefing at @BlackHatEvents this year.
The briefing will focus on Social Engineering and how to shift from technical exploitation to full psychological warfare !
See you in London !
#BHEU
I was tired of forgetting to timestamp my actions in RedTeam and having to manage a note file and a timeline file, so I created this small VsCode extension that adds the timestamp on every line created maintaining the timeline for me !
marketplace.visualstudio.com…
This year again I will be giving 2 workshop at @defcon.
The first one on basic malware development, a 101 Workshop to craft your first malware and learn the basics of EDR evasion.
The second one is a review of last year workshop on Instrumentation Callback !
See you there !
I published a Sharepoint and Outlook PowerShell GUI that can be used on RedTeam operation when you've found an Azure AppId with interesting privileges.
You can now use these tools to browse the SharePoint or Mailboxes through a GUI instead the GraphAPI
github.com/OtterHacker/M365P…
BitLocker attacks are known, but the barrier to entry has never been lower.
My colleague compiled & tested the known modern hardware/software attacks using, this time, <$150 of gear. A must-read if you're relying on default encryption settings.
riskinsight-wavestone.com/en…
Just redeveloped in PowerShell a standalone thick client for Sharepoint to be used with AppID and AppSecret.
You can browse, list, download the files in Sharepoint and OneDrive.
Pretty handy when you found an Azure App with SiteReadAll privilege in a network share...
Now that everyone had a chance to learn the theory, let's move on to the practical application.
All attacks explained in the article are implemented in the tool !
With AWSDoor, you can deploy persistence on AWS without breaking the prod environment 🥰
github.com/OtterHacker/AWSDo…
Got access to an AWS infrastructure during your RedTeam and you don't know how to do access persistence other than just adding an AccessKey ? 🫤
Step up your game with new TTPs ! 🫡
From IAM modification to lambda hijacking, 1001 ways to keep access !
riskinsight-wavestone.com/en…
Got access to an AWS infrastructure during your RedTeam and you don't know how to do access persistence other than just adding an AccessKey ? 🫤
Step up your game with new TTPs ! 🫡
From IAM modification to lambda hijacking, 1001 ways to keep access !
riskinsight-wavestone.com/en…
I totally forgot to upload my Defcon33 Workshop content...
If you want to learn and play with Instrumentation Callback on Windows, weaponize the Nirvana Debugging feature for syscall hijacking, process injection or sleep obfuscation, everything is here:
github.com/OtterHacker/Confe…
No excuse to used John instead of Hashcat now 😆
hashcat v7.0.0 released!
After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had.
Detailed writeup is available here: hashcat.net/forum/thread-133…
I fucking took time to write a full guide with a real life example and you lazy ass scammer don’t event take 5minutes to develop your own phishlet…
I now understand why threat actors only target hospital you don’t have the skill
This quoted post is unavailable.
Here is the article explaining the different steps to create the Evilginx phishlet !
riskinsight-wavestone.com/en…
Okta chained with Azure with auto MFA subscription for Okta and frame-buster bypass to perform Bitb !
Evilginx is really nice to setup custom phishing campaign whatever the environment is...
Phishlet available here : github.com/OtterHacker/OktaG…
What I like about creating Defcon workshop is it gives me new ideas to weaponize simple techniques.
Nirvana Hooking used in DLL sideloading to hijack memory allocation, change protection, spoof write attempts to inject shellcode without changing the legit execution flow (1/4)
Then, when the program tries to write on this section, the Nirvana hook changes the SYSRET to make the target believe that it successfully write on the section (3/4)
