Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection...

MSecOps's profile picture

MSec Operations

1,868 subscribers

16,165 Aufrufe • vor 1 Jahr •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Kommentare

Keine Kommentare verfügbar

Kommentare vom Original-Post werden hier angezeigt

Ähnliche Videos

How do you create your payloads in 2025? At MSec Operations we prefer to use DLL sideloading for EDR evasion. This technique allows our malicious code to run within a signed, legitimate executable. Combining this technique with other useful techniques will provide stable execution to fly under the radar. 🛸 The following video demonstrates the use of #RustPack to create such a payload in just a few seconds. The command line usage shows that our input payload is a simple unmodified Apollo C2 executable. We want to clone all the exported functions from the original Windows wininet.dll to create our own library with the same name. The execution of the payload will be delayed by ~5 seconds in this case, without using the Win32 sleep function, but by performing random calculations. ⏲️ Hardware breakpoints are used to bypass the Antimalware Scan Interface (AMSI). Without an AMSI bypass, Apollo would be flagged as a C# assembly when loaded. 🎓 Our payload will only fire on a domain joined system, this basically prevents it from running in e.g. sandbox environments. 🤠 Last but not least, in this example, the encrypted payload itself is stored in a separate file on the target system and not even in the same folder as our malicious DLL. Anyone analysing just the DLL will never be able to find out what the payload is. Automatic sample submissions for cloud analysis usually only upload the executable or DLL, emulators won't see the real payload either. 🤠 Tired of creating such payloads yourself? With #RustPack it's really easy, and payloads always look completely different, even if the same payload is packed twice to avoid signature-based detection Contact us via info[at] for more information! 👍
1:15

How do you create your payloads in 2025? At MSec Operations we prefer to use DLL sideloading for EDR evasion. This technique allows our malicious code to run within a signed, legitimate executable. Combining this technique with other useful techniques will provide stable execution to fly under the radar. 🛸 The following video demonstrates the use of #RustPack to create such a payload in just a few seconds. The command line usage shows that our input payload is a simple unmodified Apollo C2 executable. We want to clone all the exported functions from the original Windows wininet.dll to create our own library with the same name. The execution of the payload will be delayed by ~5 seconds in this case, without using the Win32 sleep function, but by performing random calculations. ⏲️ Hardware breakpoints are used to bypass the Antimalware Scan Interface (AMSI). Without an AMSI bypass, Apollo would be flagged as a C# assembly when loaded. 🎓 Our payload will only fire on a domain joined system, this basically prevents it from running in e.g. sandbox environments. 🤠 Last but not least, in this example, the encrypted payload itself is stored in a separate file on the target system and not even in the same folder as our malicious DLL. Anyone analysing just the DLL will never be able to find out what the payload is. Automatic sample submissions for cloud analysis usually only upload the executable or DLL, emulators won't see the real payload either. 🤠 Tired of creating such payloads yourself? With #RustPack it's really easy, and payloads always look completely different, even if the same payload is packed twice to avoid signature-based detection Contact us via info[at] for more information! 👍

MSec Operations

26,047 Aufrufe • vor 1 Jahr

Tools such as from Impacket are usually flagged for lateral movement due to the pre-built service executable that is dropped on the remote system. However, some vendors also flag Impacket based on its behaviour. With RustPack, you can easily create service executables that won't be detected by signatures or behaviour-based detection. 😎 In this demo video, an unsigned service executable is generated. This will only fire the payload on a system with the hostname 'Win11' — environmental keying will prevent the payload from showing up in a sandbox or cloud analysis. To avoid Impacket detection, we drop and execute the binary via the recently released Titanis protocol library from TrustedSec: The result is an Adaptix C2 connection in the SYSTEM context. 🫡 #Pentest #RedTeam #Malware #OST
0:38

Tools such as from Impacket are usually flagged for lateral movement due to the pre-built service executable that is dropped on the remote system. However, some vendors also flag Impacket based on its behaviour. With RustPack, you can easily create service executables that won't be detected by signatures or behaviour-based detection. 😎 In this demo video, an unsigned service executable is generated. This will only fire the payload on a system with the hostname 'Win11' — environmental keying will prevent the payload from showing up in a sandbox or cloud analysis. To avoid Impacket detection, we drop and execute the binary via the recently released Titanis protocol library from TrustedSec: The result is an Adaptix C2 connection in the SYSTEM context. 🫡 #Pentest #RedTeam #Malware #OST

MSec Operations

70,949 Aufrufe • vor 1 Jahr

In one of our previous videos we demonstrated how to generate sideloading binaries by cloning the exports of an existing DLL to forward them - . However, using Microsoft DLLs and Microsoft-signed binaries is not the best OPsec, as it's easy for EDR vendors to create a detection rule for e.g. "version.dll" being loaded from a non-System32 directory. 🧐 We therefore recommend using third party signed executables that attempt to load their own DLL. This is much harder to track/map on the endpoint. If you know which functions are imported from your signed binary (see import table), you can also generate a sideloading DLL for persistence or initial access use cases. Bring your own third-party signed binary and voila - you're trusted! In this example, we sideload into java.exe, which is signed by Oracle. It attempts to load several DLLs - including jli.dll as shown in the video. #RustPack can easily create such DLLs with custom export functions - anti-debugging features, sandbox evasion, signature evasion and anti-emulation can be easily added. 🔥🔥 Userland hooks are bypassed by default options and you can enable custom AMSI/ETW bypasses for the process on top. If you want to use it for persistence, you can of course still clone the original DLL exports as we did in the previous video and forward them accordingly. 👍 Interested in buying RustPack? Contact us at info[at] ! #RedTeam #Pentest #OST #Maldev #Malware #Havoc
0:29

In one of our previous videos we demonstrated how to generate sideloading binaries by cloning the exports of an existing DLL to forward them - . However, using Microsoft DLLs and Microsoft-signed binaries is not the best OPsec, as it's easy for EDR vendors to create a detection rule for e.g. "version.dll" being loaded from a non-System32 directory. 🧐 We therefore recommend using third party signed executables that attempt to load their own DLL. This is much harder to track/map on the endpoint. If you know which functions are imported from your signed binary (see import table), you can also generate a sideloading DLL for persistence or initial access use cases. Bring your own third-party signed binary and voila - you're trusted! In this example, we sideload into java.exe, which is signed by Oracle. It attempts to load several DLLs - including jli.dll as shown in the video. #RustPack can easily create such DLLs with custom export functions - anti-debugging features, sandbox evasion, signature evasion and anti-emulation can be easily added. 🔥🔥 Userland hooks are bypassed by default options and you can enable custom AMSI/ETW bypasses for the process on top. If you want to use it for persistence, you can of course still clone the original DLL exports as we did in the previous video and forward them accordingly. 👍 Interested in buying RustPack? Contact us at info[at] ! #RedTeam #Pentest #OST #Maldev #Malware #Havoc

MSec Operations

10,686 Aufrufe • vor 1 Jahr

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM. In that post, I mentioned that there are other COM objects that can be used in the same way. I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized. Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun. The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass. A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator). The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.
0:55

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM. In that post, I mentioned that there are other COM objects that can be used in the same way. I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized. Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun. The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass. A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator). The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.

Haidar

13,816 Aufrufe • vor 2 Monaten

Building a RAG system that works with real-life documents is crazy hard. Why is nobody talking about this? (I'll show you what a complex document looks like in the attached video. Good luck with the 10-line code demos if you want to deal with this.) All I see online are "how to talk to a PDF" demos that won't take you far. If you think that's all you need, you won't like what happens when you try. In the video below, I'll show you what it takes to build a system that processes huge numbers of documents without losing accuracy. There are a few tricks here that I'm sure will impress you. The magic is happening in three phases: • In the way we process the documents • In the way we chunk the content • In the way we augment and store the chunks This is all built-in in GroundX, EyeLevel.AI's out-of-the-box RAG system. You can use it as a SaaS or install it in your own Kubernetes cluster and run it locally. If you have seen any other RAG system doing what I do in the attached video, please, let me know. I'd love to check them out. Disclaimer: I work with the team at EyeLevel. My advice is to take any document you have lying around, go to their site, create an account, and try them out. Here is their website:
10:11

Building a RAG system that works with real-life documents is crazy hard. Why is nobody talking about this? (I'll show you what a complex document looks like in the attached video. Good luck with the 10-line code demos if you want to deal with this.) All I see online are "how to talk to a PDF" demos that won't take you far. If you think that's all you need, you won't like what happens when you try. In the video below, I'll show you what it takes to build a system that processes huge numbers of documents without losing accuracy. There are a few tricks here that I'm sure will impress you. The magic is happening in three phases: • In the way we process the documents • In the way we chunk the content • In the way we augment and store the chunks This is all built-in in GroundX, EyeLevel.AI's out-of-the-box RAG system. You can use it as a SaaS or install it in your own Kubernetes cluster and run it locally. If you have seen any other RAG system doing what I do in the attached video, please, let me know. I'd love to check them out. Disclaimer: I work with the team at EyeLevel. My advice is to take any document you have lying around, go to their site, create an account, and try them out. Here is their website:

Santiago

75,788 Aufrufe • vor 2 Jahren

What do you think Fabian Hinz? Houthi ballistic missile fell near civilians in Raghwan, Marib, and appears to be a Burkan-3 or Zulfiqar. According to the DIA, the Houthis first launched the Burkan-3 in 2019 and displayed an identical system under the Zulfiqar name in 2021. The DIA assesses a demonstrated range of 1,200 km with a 250 kg payload and says the system is consistent with Iran’s Qiam or Rezvan MRBM. You can find the full guide of Houthi arsenal here:
1:00

What do you think Fabian Hinz? Houthi ballistic missile fell near civilians in Raghwan, Marib, and appears to be a Burkan-3 or Zulfiqar. According to the DIA, the Houthis first launched the Burkan-3 in 2019 and displayed an identical system under the Zulfiqar name in 2021. The DIA assesses a demonstrated range of 1,200 km with a 250 kg payload and says the system is consistent with Iran’s Qiam or Rezvan MRBM. You can find the full guide of Houthi arsenal here:

Basha باشا

179,361 Aufrufe • vor 2 Monaten

As America votes today, I'll leave you with this quote from my recent conversation with Tucker Carlson: "With the rise of AI, there is no person who can stand with a straight face and say that our voting system is invulnerable to hacking. "So you really have one choice: Are you going to persist with that vulnerable voting system, or are you going to revert to the only unhackable system, which is paper or thumbprint? "And if you're not doing that, then you're not doing it for a reason, because you want it to be hacked." Full interview: #ElectionIntegrity
2:19

As America votes today, I'll leave you with this quote from my recent conversation with Tucker Carlson: "With the rise of AI, there is no person who can stand with a straight face and say that our voting system is invulnerable to hacking. "So you really have one choice: Are you going to persist with that vulnerable voting system, or are you going to revert to the only unhackable system, which is paper or thumbprint? "And if you're not doing that, then you're not doing it for a reason, because you want it to be hacked." Full interview: #ElectionIntegrity

Chris Martenson

18,821 Aufrufe • vor 9 Tagen

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato
1:49

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato

Haidar

51,713 Aufrufe • vor 6 Monaten

What if you had a little goblin in your ear telling you horrible things about yourself, negatively bringing you down all the time? Seems silly right? Well, what if he did that in a catchy song with music playing as well? This is what millions of people are doing when they're listening to mainstream music with its themes of degeneracy, negativity, and other low-energy, fear-based programming. Understand the system that is your subconscious mind and how it will take in everything that it listens to. You have to curate your information diet such that you're only feeding yourself what you want more of in your life. Music is one of the most powerful tools that can affect us. We decide whether we use that tool positively or negatively.
1:27

What if you had a little goblin in your ear telling you horrible things about yourself, negatively bringing you down all the time? Seems silly right? Well, what if he did that in a catchy song with music playing as well? This is what millions of people are doing when they're listening to mainstream music with its themes of degeneracy, negativity, and other low-energy, fear-based programming. Understand the system that is your subconscious mind and how it will take in everything that it listens to. You have to curate your information diet such that you're only feeding yourself what you want more of in your life. Music is one of the most powerful tools that can affect us. We decide whether we use that tool positively or negatively.

⚡️🌞 Sol Brah 🌞🐬

13,619 Aufrufe • vor 1 Monat

Testing Opus 5.5 Medium: "What I want you to do is create a library that is the basis for how Unreal Engine Works for lighting and nanites. I want you to use WebGPU in Rust. We need to create really clean code/system /goal can unreal quality in the browser." 1 hour 20 minutes in total
1:23

Testing Opus 5.5 Medium: "What I want you to do is create a library that is the basis for how Unreal Engine Works for lighting and nanites. I want you to use WebGPU in Rust. We need to create really clean code/system /goal can unreal quality in the browser." 1 hour 20 minutes in total

SamG

15,524 Aufrufe • vor 6 Tagen

smolvm has hit stable release: v1.0.0! You can now fork smolvm. It means you can fork to create virtual machines off of an existing one in less than 100ms, with all the processes cloned and running. smolvm is the first to have this feature + cross platform compatibility (macOS and linux natively). Here's a demo of a counter continuing on a forked clone while I only started it on the original!
0:46

smolvm has hit stable release: v1.0.0! You can now fork smolvm. It means you can fork to create virtual machines off of an existing one in less than 100ms, with all the processes cloned and running. smolvm is the first to have this feature + cross platform compatibility (macOS and linux natively). Here's a demo of a counter continuing on a forked clone while I only started it on the original!

BinBin

56,255 Aufrufe • vor 5 Monaten

GM Fam ... ☕️, As announced, today is the day when I am opening all my galleries to you for a short time. The main gallery, Boring Cinema and the room with the future artist portals will also be accessible at any time later. Starting from the main gallery, you can first enter one and then several portals to reach the respective areas. We recommend accessing the galleries via a PC or Mac using the Chrome browser (updated). Many thanks to ᴏɴᴄʏʙᴇʀ for making it possible to create galleries in this form in the first place! The teaser (🔊 ON) gives you a little insight into what you can expect. Have a great Friday and a wonderful weekend, everyone! ... hope you enjoy it. 🫂
5:41

GM Fam ... ☕️, As announced, today is the day when I am opening all my galleries to you for a short time. The main gallery, Boring Cinema and the room with the future artist portals will also be accessible at any time later. Starting from the main gallery, you can first enter one and then several portals to reach the respective areas. We recommend accessing the galleries via a PC or Mac using the Chrome browser (updated). Many thanks to ᴏɴᴄʏʙᴇʀ for making it possible to create galleries in this form in the first place! The teaser (🔊 ON) gives you a little insight into what you can expect. Have a great Friday and a wonderful weekend, everyone! ... hope you enjoy it. 🫂

Cologne_Dude 🈴 🍌 🦍

64,695 Aufrufe • vor 1 Jahr

Giant Rocket. Small Payloads. Big Science What exactly is a secondary payload? And how can something about the size of a small microwave help advance science in space? Tune in to this edition of Nerdy Words to learn about secondary payloads and CubeSats and how they can make a big impact.
1:01

Giant Rocket. Small Payloads. Big Science What exactly is a secondary payload? And how can something about the size of a small microwave help advance science in space? Tune in to this edition of Nerdy Words to learn about secondary payloads and CubeSats and how they can make a big impact.

NASA Marshall

20,683 Aufrufe • vor 1 Monat

Import any website to canvas from Chrome. The new Chrome Extension takes any part of any website and drops it onto your canvas with the layout, the photos and the type still attached. This is in addition to the built-in browser, you can also use. Available today.
1:27

Import any website to canvas from Chrome. The new Chrome Extension takes any part of any website and drops it onto your canvas with the layout, the photos and the type still attached. This is in addition to the built-in browser, you can also use. Available today.

pen.dev

115,995 Aufrufe • vor 2 Monaten

This is how we streamline AI implementation across 26 companies in a PE portfolio. Each company has 10 departments, and each department has 10 workflows. If you do them one at a time, you need "50,000 forward deployed engineers across three years." Our method is to group the companies by system of record. For finance, the 5 companies on NetSuite are one group. The 4 companies on Dynamics are a different group. Then you find what NetSuite can do and what it cannot do. You build only for the gaps. In one group, the processes are still different. The 5 NetSuite companies used 12, 9, 15, 18 and 13 steps for their finance process. The target is 6 steps, with agents at specific points. You will not often make all 5 exactly equal. You can come close if you map each process with the stakeholders before you change it. A single company or 26, sort the work by its system before you build.
7:02

This is how we streamline AI implementation across 26 companies in a PE portfolio. Each company has 10 departments, and each department has 10 workflows. If you do them one at a time, you need "50,000 forward deployed engineers across three years." Our method is to group the companies by system of record. For finance, the 5 companies on NetSuite are one group. The 4 companies on Dynamics are a different group. Then you find what NetSuite can do and what it cannot do. You build only for the gaps. In one group, the processes are still different. The 5 NetSuite companies used 12, 9, 15, 18 and 13 steps for their finance process. The target is 6 steps, with agents at specific points. You will not often make all 5 exactly equal. You can come close if you map each process with the stakeholders before you change it. A single company or 26, sort the work by its system before you build.

The Startup Ideas Podcast (SIP) 🧃

17,379 Aufrufe • vor 1 Monat

yesterday i showed claude code using codex's computer use, today i got some more fucking fire for you claude can also drive codex's official chrome extension, and it controls chromium browsers beautifully all in the background, without the "allow" popup chrome devtools mcp throws at you every time a new agent connects it even handles more than one browser: each install of the extension gets its own instance id, so claude knows which is which i have helium as my main and chrome for work, and claude code now uses both first, install the chrome plugin in the codex app and add openai's chatgpt extension to your chromium browser (or all of them, if you have a few) then give this to your claude: "Set up Codex's Chrome extension for you on my Mac. I've installed the Chrome plugin in the Codex app and the extension. Use Codex's computer use MCP server as user MCP "codex-cu": keep it if it's already registered, otherwise copy the "cua_repl" entry from ~/.codex/plugins/cache/openai-bundled/unified-computer-use/ /.mcp.json. Its browser side rejects calls without Codex turn metadata, so put a small stdio proxy in front that adds _meta["x-codex-turn-metadata"] (session_id and turn_id as a JSON string) to every tools/call. Add a Stop hook that tells this session's proxy to call the hidden turn_ended tool and start a new turn_id, so your tabs get released without touching other sessions. Test it by opening a tab straight at a URL in each browser with cua.createBrowserTab(browserId, url). Browsers can all report as "Chrome", so if I have several, ask me which test tab showed up in which browser." got more than one browser and ok with it touching your claude.md? give it this too: "Write each browser's name and metadata.extensionInstanceId into my global CLAUDE.md, with a note to pick browsers by that id and open tabs straight at a URL."
0:39

yesterday i showed claude code using codex's computer use, today i got some more fucking fire for you claude can also drive codex's official chrome extension, and it controls chromium browsers beautifully all in the background, without the "allow" popup chrome devtools mcp throws at you every time a new agent connects it even handles more than one browser: each install of the extension gets its own instance id, so claude knows which is which i have helium as my main and chrome for work, and claude code now uses both first, install the chrome plugin in the codex app and add openai's chatgpt extension to your chromium browser (or all of them, if you have a few) then give this to your claude: "Set up Codex's Chrome extension for you on my Mac. I've installed the Chrome plugin in the Codex app and the extension. Use Codex's computer use MCP server as user MCP "codex-cu": keep it if it's already registered, otherwise copy the "cua_repl" entry from ~/.codex/plugins/cache/openai-bundled/unified-computer-use/ /.mcp.json. Its browser side rejects calls without Codex turn metadata, so put a small stdio proxy in front that adds _meta["x-codex-turn-metadata"] (session_id and turn_id as a JSON string) to every tools/call. Add a Stop hook that tells this session's proxy to call the hidden turn_ended tool and start a new turn_id, so your tabs get released without touching other sessions. Test it by opening a tab straight at a URL in each browser with cua.createBrowserTab(browserId, url). Browsers can all report as "Chrome", so if I have several, ask me which test tab showed up in which browser." got more than one browser and ok with it touching your claude.md? give it this too: "Write each browser's name and metadata.extensionInstanceId into my global CLAUDE.md, with a note to pick browsers by that id and open tabs straight at a URL."

🥔🥔🥔

73,991 Aufrufe • vor 1 Monat