正在加载视频...

视频加载失败

Fancy Defender evasion? Yet another method, nearly bare hands: 1. Export CurrentControlSet to a file 2. Edit path in a file 3. Import a file as new ControlSet 4. Change "Select" values to new one 5. Reboot 6. Enjoy 😎 A side effect of my "Registry internals" session yesterday 😅

74,089 次观看 • 3 年前 •via X (Twitter)

11 条评论

Grzegorz Tworek 的头像
Grzegorz Tworek3 年前

BTW if you think about responsible disclosure, the answer is quite simple: @msftsecresponse closes immediately reports related to Defender if you do not provide "Short explanation on how an attacker could use the information to exploit another user remotely".

imag0r 的头像
imag0r3 年前

You can get around pretty much all AVs this way. Addressing it would be super expensive performance wise. There’s really no good way to stop admins from doing nasty things.

Grzegorz Tworek 的头像
Grzegorz Tworek3 年前

One RegNotifyChangeKeyValue() watching the Select key.

Daniel Mielczarek 的头像
Daniel Mielczarek3 年前

is that method work only on admin account or non-priveleged also?

Grzegorz Tworek 的头像
Grzegorz Tworek3 年前

Admin only, due to two reasons: 1. RegSaveKey() / RegRestoreKey() restrictions, 2. Permissions on HKLM\SYSTEM and HKLM\SYSTEM\Select

Advanced Persistent Dread 的头像
Advanced Persistent Dread3 年前

@UK_Daniel_Card really cool!

Advanced Persistent Dread 的头像
Advanced Persistent Dread3 年前

could we run our own program instead? e.g. nsmpeng.exe ? snd would that have additional benefits?

Grzegorz Tworek 的头像
Grzegorz Tworek3 年前

Sure. You can add your own service after restoring the key. Or just edit paths in the binary file. Whatever is easier for you.

spencer 的头像
spencer3 年前

Lol nice

Br3akp0int 的头像
Br3akp0int3 年前

@Sug4r7 this is awesome! I also have similar research in this persistence topic and I’m planning to release it later this aug.but I might release it soon because of this great research! 😊👍

Grzegorz Tworek 的头像
Grzegorz Tworek3 年前

@Sug4r7 And what about publishing your research in parts? :)

相关视频

Here's how I'm running automated content engine in 2 files 1 markdown file = my wiki 1 html file = my dashboard that's the whole stack. [ the architecture, in plain words ]: LLM wiki = a single markdown file holding my audience DNA, 15 tracked creators, every viral topic from the last 30 days HTML artifact = a single page that reads that markdown file AND can trigger my agents the artifact and the agent talk to each other directly the wiki is the shared brain [ what I actually see when I open it at 9am ]: > 5 trending topics ranked by my audience-DNA fit > 3 KOL posts worth quoting today > last week's saved tweets (so I can ride waves that are still warm) > buttons: [draft tweet] [draft QT] [schedule] [log idea] 1. I click "draft tweet" on a topic 2. the artifact pings my agent 3. agent reads the wiki, drafts in MY voice, returns it to the artifact 4. I edit, schedule, done 15 minutes from morning coffee to 3 scheduled posts [ how to build the same in one evening ]: > step 1: dump your domain knowledge into ONE markdown file (audience profile, KOL list, content rules, voice guide, anything an agent would need to do YOUR job) > step 2: ask claude to build an html artifact that reads from that file ("here's my wiki, build me a dashboard with these views") > step 3: add buttons for the actions you do daily (draft, schedule, log, score, search — your workflow, not mine) > step 4: wire each button to call your agent via tool calls (so the artifact and the agent talk directly) the moment your artifact reads your wiki AND triggers your agents.. most SaaS tools you currently pay for quietly become unnecessary dashboards I used to pay $50/month for now sit in a single html file I can rebuild in 20 minutes every "I'll build a SaaS for this" idea you had last year is a 200-line file you write in an afternoon if you want to get the same content engine, just reply "CONTENT" and will send you in DMs later we're going from buying software to owning it.

Ronin

50,083 次观看 • 3 个月前