ma cherie retweeted
woke up to my 2nd uk no. 1 π₯² and pylon no. 1 in australia !!!!
a million thank you's
i lov u guys
ma cherie retweeted
Nightmare Eclipse, the person who has been dropping Windows zero-days, has finally decided to share his story. He's an ex-Microsoft employee, we had dinner together, and I've known him and his story for some time.
His real name is Abdelhamid Naceri. He's a very talented and intelligent individual, and he came across as someone who'd be a real professional to work with.
"If only I didn't pour my soul into that job with countless of stupid non sleep nights, i would have gotten over it..." - Naceri
He loved Microsoft.
I wouldn't say that what he did, releasing all those zero-days, was normal, but he felt he had no other option because of the injustice Microsoft did to him.
They fired him, and you can read the vague reason they gave in the email sent to him by the Vice President of Engineering at MSRC, below.
According to Abdel's account, VP Tom Gallagher met with him after the firing to tell him they were blacklisting him from Microsoft and writing him a bad reference so he'd never be able to get a job again.
Normally you'd think, well, big deal, just find another job, right? But Abdel doesn't have a European passport, and he was only a couple of months away from getting permanent EU residence.
So instead of granting him those couple of months, Microsoft fired him for a reason that, as far as we can tell, was never made clear, then fought him in court and offered him β¬55,000 plus a year's pay to drop the case.
All while Abdel was releasing zero-days.
Abdel continued suing Microsoft for unfair termination in Germany, a fight that has cost him over $200,000.
He says Microsoft refused to reveal any details about the security breach and went another direction.
If you are reading this, and you can offer him a LEGAL job, this is his e-mail: [email protected]
ma cherie retweeted
I'm excited to see reze in this outfit in the animation, she'll look absolutely stunning
daming ganto sa pinas e buti mga di hinuli bwhahahahah
This Post is from an account that no longer exists. Learn more
ma cherie retweeted
Found http://103.229.53[.]84:8443 through @Huntio during a C2 hunt. The host had directory listing enabled, which exposed several PowerShell loaders along with chromelevator_x64.exe, package[.]zip, data[.]cab, and a few encoded payload variants.
The loaders use more than one delivery method. One pulls the payload directly, another retrieves an XOR-encoded /bin object and decodes it with key 42, while other variants make use of certutil and different Windows process execution methods. The decoded PE is then launched with ChromElevator's output arguments and pointed at a local output directory.
From there, the scripts look for generated browser artifacts such as cookies, passwords and tokens. Cookie data is additionally transformed into a format that can be imported back into a browser session, after which the collected output is compressed and exfiltrated through Telegram.
The interesting part is that the Telegram bot token and destination are hardcoded across the chain, which provides a useful pivot into the operator's surrounding infrastructure.
