正在加载视频...

视频加载失败

返回首页

Did some experiments on bypassing PPL Protection and Windows Defender, to dump LSASS. No detections so far! tasty pepperoni's PPLBlade repo: My short write-up: #adversarytactics #redteam #tacticaladversary #PPLBlade

abhijithbr's profile picture

Abhijith B R

1,058 subscribers

27,632 次观看 • 2 年前 •via X (Twitter)

科学技术新闻政治教育#adversarytactics#redteam#tacticaladversary#PPLBlade
LIVE

Anya Rossi• Live Now

Private livecam show

3 条评论

Abhijith B R 的头像
Abhijith B R2 年前

PPLBlade Could be used to simulate adversarial actions against endpoint defense measures in Windows systems.

Sam ☁️🪵 的头像
Sam ☁️🪵2 年前

@tastypepperoni Again, nice @abhijithbr ! In terms of prevention I don't see much except priv esc controls before getting admin. Detection wise, driver/image loaded? Do you see anything else?

Joe 的头像
Joe2 年前

@rsnksg @tastypepperoni

相关视频

Bypassing Windows Defender on Windows 11 with Havoc C2!!
1:02

Bypassing Windows Defender on Windows 11 with Havoc C2!!

lrdvile

161,382 次观看 • 1 年前

Disable Windows Defender + UAC Bypass, + Upgrade to SYSTEM #cybersecurity #pentesting #redteam
0:21

Disable Windows Defender + UAC Bypass, + Upgrade to SYSTEM #cybersecurity #pentesting #redteam

HackGit

37,323 次观看 • 2 年前

Bypassing Windows Defender with c++ and staged with PowerShell reverse shell.
0:38

Bypassing Windows Defender with c++ and staged with PowerShell reverse shell.

return0;

68,556 次观看 • 1 年前

Very stealthy way of dumping LSASS, is done from the kernel, doesn't matter if LSASS is LSA Protected. Once loaded, the rootkit creates a system thread (PsCreateSystemThread) for dumping LSASS, iterates over all processes gets its EPROCESS (PsLookupProcessByProcessId ), then its name (PsGetProcessImageFileName), attaches to LSASS with (KeStackAttachProcess), once attached a file on disk (C:\dump.dmp) to receive memory pages dump, then the memory dumping process starts with (ZwQueryVirtualMemory) to query each virtual memory page info, including its base address and size, then (ZwWriteFile) is used to write that page to the dump file on disk. ====== For Professional Inquiries, freelance, contact on LinkedIn or Gmail (saaad.ahla@gmail[.]com), looking forward to new opportunities.
0:28

Very stealthy way of dumping LSASS, is done from the kernel, doesn't matter if LSASS is LSA Protected. Once loaded, the rootkit creates a system thread (PsCreateSystemThread) for dumping LSASS, iterates over all processes gets its EPROCESS (PsLookupProcessByProcessId ), then its name (PsGetProcessImageFileName), attaches to LSASS with (KeStackAttachProcess), once attached a file on disk (C:\dump.dmp) to receive memory pages dump, then the memory dumping process starts with (ZwQueryVirtualMemory) to query each virtual memory page info, including its base address and size, then (ZwWriteFile) is used to write that page to the dump file on disk. ====== For Professional Inquiries, freelance, contact on LinkedIn or Gmail (saaad.ahla@gmail[.]com), looking forward to new opportunities.

d1rkmtr

22,041 次观看 • 1 年前

What is egg, tasty? Yes, but what else? And also - did it come first? Gonna start sharing some work I did on a short I recently finished!
0:32

What is egg, tasty? Yes, but what else? And also - did it come first? Gonna start sharing some work I did on a short I recently finished!

Jacob Tobin

125,290 次观看 • 3 年前

a year ago, I started sharing playful prototypes for fun some of my favorite ideas + experiments so far…
0:21

a year ago, I started sharing playful prototypes for fun some of my favorite ideas + experiments so far…

Ryan Stephen

200,717 次观看 • 1 年前

Ability revelations in UU are some of my favorite moments so far , Chikara finally found ppl worth fighting for
0:56

Ability revelations in UU are some of my favorite moments so far , Chikara finally found ppl worth fighting for

Daily Anime Post

21,614 次观看 • 6 个月前

how did so many ppl lose to this kid? 😂 3-0 my boy Orangie always good seeing you tho crazy how far we’ve come brother
0:37

how did so many ppl lose to this kid? 😂 3-0 my boy Orangie always good seeing you tho crazy how far we’ve come brother

Nate

11,175 次观看 • 1 年前

Some of the experiments I do in my physics engine end up on the absurdist side.
0:31

Some of the experiments I do in my physics engine end up on the absurdist side.

Zolden

96,892 次观看 • 2 个月前

Video up now on my youtube ! go be sexy and learn that choreography 😍♨️😋 feels so good dancing to Tasty!
0:58

Video up now on my youtube ! go be sexy and learn that choreography 😍♨️😋 feels so good dancing to Tasty!

Danielle 🤍

76,850 次观看 • 3 年前

Some ppl also wanted to know how I did the sparkly stickers so I made an awful video on how I do it
2:09

Some ppl also wanted to know how I did the sparkly stickers so I made an awful video on how I do it

kama

321,962 次观看 • 6 个月前

ok time to dump some of my insanity on yous "Keep Calm and Shitpost"
0:38

ok time to dump some of my insanity on yous "Keep Calm and Shitpost"

BlotterMonkey🐒

16,348 次观看 • 2 年前

Hacking windows using telegram bot and windows defender enabled
1:02

Hacking windows using telegram bot and windows defender enabled

Hacksparo 🥷👾

289,139 次观看 • 2 年前

As promised. Write up on implementing and optimizing conversational agents: An open source repo which is a generic WebSocket server for low-latency conversational agents: And another demo
1:18

As promised. Write up on implementing and optimizing conversational agents: An open source repo which is a generic WebSocket server for low-latency conversational agents: And another demo

Sean Moriarity

15,924 次观看 • 2 年前

yk i gotta give yunjin her flowers for standing on business and speaking up on behalf of other idols. what a shame ppl love to pretend she never did anything and treat her so terribly
1:46

yk i gotta give yunjin her flowers for standing on business and speaking up on behalf of other idols. what a shame ppl love to pretend she never did anything and treat her so terribly

🐈

124,434 次观看 • 1 年前

Some ppl are so miserable no friends no family nobody likes them.
1:30

Some ppl are so miserable no friends no family nobody likes them.

Asher

325,595 次观看 • 7 天前

🚨 CVE-2026-41089: Windows Netlogon Remote Code Execution via CLDAP Stack Buffer Overflow Published: June 1st, 2026 PoC: One crafted UDP packet to port 389 overflows a 528-byte stack buffer inside LSASS on any unpatched Windows Domain Controller. The process crashes. The DC reboots in ~60 seconds. No authentication required.
1:28

🚨 CVE-2026-41089: Windows Netlogon Remote Code Execution via CLDAP Stack Buffer Overflow Published: June 1st, 2026 PoC: One crafted UDP packet to port 389 overflows a 528-byte stack buffer inside LSASS on any unpatched Windows Domain Controller. The process crashes. The DC reboots in ~60 seconds. No authentication required.

Dark Web Informer

70,299 次观看 • 9 天前

"I write a song when my head is so stuck in a situation or messed up that I have to write it down to get it out, and I have to make something good out of something bad which is what I did with this album."
0:27

"I write a song when my head is so stuck in a situation or messed up that I have to write it down to get it out, and I have to make something good out of something bad which is what I did with this album."

Amy Winehouse

29,799 次观看 • 5 个月前