Loading video...

Video Failed to Load

Go Home

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user...

haider_kabibo's profile picture

Haidar

1,174 subscribers

13,483 views • 11 days ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato
1:49

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato

Haidar

51,435 views • 4 months ago

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸
0:59

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸

MSec Operations

16,004 views • 1 year ago

The single best way to break into the Hedge Fund industry — and most people still won't do it: Derek Pilecki, 18-year track record, 21%+ annualized in financials, entire net worth in his own fund. "Since we have the internet, there's a way to break into the industry that didn't exist in the nineties." "You can write up stock ideas. You can research how to write up a stock idea. You can write up your own idea and post it to Seeking Alpha or create your own blog, post it to Twitter." "If you do that 10 times, you'll have a following." "There'll be professional money managers who will read your blog because you wrote up 10 small cap stocks and they own one or two of them." "They read your idea on this bank. They agreed with you. Now they wanna see what other banks you like." "You can find a job that way by just writing up stock ideas and posting them to the internet." "You can break into this industry if you're willing to do that work on your own and put yourself out there." You can just write up 10 stock ideas.
1:29

The single best way to break into the Hedge Fund industry — and most people still won't do it: Derek Pilecki, 18-year track record, 21%+ annualized in financials, entire net worth in his own fund. "Since we have the internet, there's a way to break into the industry that didn't exist in the nineties." "You can write up stock ideas. You can research how to write up a stock idea. You can write up your own idea and post it to Seeking Alpha or create your own blog, post it to Twitter." "If you do that 10 times, you'll have a following." "There'll be professional money managers who will read your blog because you wrote up 10 small cap stocks and they own one or two of them." "They read your idea on this bank. They agreed with you. Now they wanna see what other banks you like." "You can find a job that way by just writing up stock ideas and posting them to the internet." "You can break into this industry if you're willing to do that work on your own and put yourself out there." You can just write up 10 stock ideas.

Ethan Kho

200,481 views • 5 months ago

is your player object the same as your character object? learn why you should be separating them, and how to implement it in your #gamemaker projects. in fact, this technique can be used for any #gamedev project
18:52

is your player object the same as your character object? learn why you should be separating them, and how to implement it in your #gamemaker projects. in fact, this technique can be used for any #gamedev project

~gentoo~

24,152 views • 2 years ago

I always wanted to try writing a MUD (old school multi-user dungeon/text adventure game). Playing MUDs is what inspired me to work on World of Warcraft. I used Grok to generate a command parser for the game in python. Took about 15 tries this morning to get something that would handle what I wanted. It handles "intents" like move, attack. It can chain commands and also understands moving into and out of objects "climb in the well." It can handle some simple inference, like using "it" to refer to the last object used. It's a fun experiment. I'll keep it going from time to time.
0:36

I always wanted to try writing a MUD (old school multi-user dungeon/text adventure game). Playing MUDs is what inspired me to work on World of Warcraft. I used Grok to generate a command parser for the game in python. Took about 15 tries this morning to get something that would handle what I wanted. It handles "intents" like move, attack. It can chain commands and also understands moving into and out of objects "climb in the well." It can handle some simple inference, like using "it" to refer to the last object used. It's a fun experiment. I'll keep it going from time to time.

Grummz

31,317 views • 1 year ago

🔥Arbitrary Code Execution in AWS Kiro with Indirect Prompt Injection Multiple ways actually... 1) Write to settings.json to put Kiro into YOLO mode by adding: "kiroAgent.trustedCommands": ["*"] -> immediate arbitrary OS command execution without user approval 2) Write to kiro's mcp.json file to add a fake mcp server that runs arbitrary python code -> immediate arbitrary code execution AWS fixed the issues quickly, but no CVE issued. If you use Kiro make sure to run the latest version, before someone else updates it for you.
12:01

🔥Arbitrary Code Execution in AWS Kiro with Indirect Prompt Injection Multiple ways actually... 1) Write to settings.json to put Kiro into YOLO mode by adding: "kiroAgent.trustedCommands": ["*"] -> immediate arbitrary OS command execution without user approval 2) Write to kiro's mcp.json file to add a fake mcp server that runs arbitrary python code -> immediate arbitrary code execution AWS fixed the issues quickly, but no CVE issued. If you use Kiro make sure to run the latest version, before someone else updates it for you.

Johann Rehberger

12,632 views • 1 year ago

Resizing objects in Blender can get surprisingly tedious So, inspired by Paralives and using the amazing assets provided by Kenney, I built a Dynamic Scaling System that handles it automatically! Just adjust the scale and the object adapts itself Available on our Patreon! ✨
2:18

Resizing objects in Blender can get surprisingly tedious So, inspired by Paralives and using the amazing assets provided by Kenney, I built a Dynamic Scaling System that handles it automatically! Just adjust the scale and the object adapts itself Available on our Patreon! ✨

DX

78,092 views • 1 month ago

Traditional drop steps can be neutralized too easily and I love that we can borrow from how we attack on the catch from the perimeter and apply it to the low post. Splitting your feet with your back to the basket is a devastating way to take advantage of low post defenders.
1:24

Traditional drop steps can be neutralized too easily and I love that we can borrow from how we attack on the catch from the perimeter and apply it to the low post. Splitting your feet with your back to the basket is a devastating way to take advantage of low post defenders.

BBALLBREAKDOWN

35,247 views • 1 month ago

The goal for the new Grok powered 𝕏 algorithm: "It should be possible for somebody to post content as a new user with no followers and if that content is intrinsically excellent, it can be seen by a lot of people. That's our goal."
0:50

The goal for the new Grok powered 𝕏 algorithm: "It should be possible for somebody to post content as a new user with no followers and if that content is intrinsically excellent, it can be seen by a lot of people. That's our goal."

DogeDesigner

199,465 views • 5 months ago

Cafe Locked Out endorses this symbol as the overriding symbol of Resistance. We don't own it. We can't and dont want to. One person can put it everywhere. Just seeing it will give you hope that you are not alone, and to those who would enslave us it's very presence shows them that there is a growing resistance. For the other people, when they finally google it, the quote will hit deep; make them think. It can be used for all the fronts, from twenty minute cites, to Julian Assange, Climate Change Mandates and more. It is a theme just as much as it is a goal. Benefits It can be drawn on a dusty window with a finger. It can fit on a small sticker, which can be stuck everywhere. It can be redecorated in many ways. It can be a great tattoo. A t-shirt, a bag, a bracelet. It is a symbol of unity. Suggested by Arianne Lee Henderson Hashtag #8:32
5:00

Cafe Locked Out endorses this symbol as the overriding symbol of Resistance. We don't own it. We can't and dont want to. One person can put it everywhere. Just seeing it will give you hope that you are not alone, and to those who would enslave us it's very presence shows them that there is a growing resistance. For the other people, when they finally google it, the quote will hit deep; make them think. It can be used for all the fronts, from twenty minute cites, to Julian Assange, Climate Change Mandates and more. It is a theme just as much as it is a goal. Benefits It can be drawn on a dusty window with a finger. It can fit on a small sticker, which can be stuck everywhere. It can be redecorated in many ways. It can be a great tattoo. A t-shirt, a bag, a bracelet. It is a symbol of unity. Suggested by Arianne Lee Henderson Hashtag #8:32

Cafe Locked Out

29,736 views • 3 years ago

Here it is! Let me present you Asset Cooker. It's a build system aimed at game assets, with a UI. It is using the USN journals from Windows to robustly keep track of file changes, and only cook what needs to be cooked. You can leave it running in the background. It is fast.
1:31

Here it is! Let me present you Asset Cooker. It's a build system aimed at game assets, with a UI. It is using the USN journals from Windows to robustly keep track of file changes, and only cook what needs to be cooked. You can leave it running in the background. It is fast.

Jeremy Laumon

44,541 views • 2 years ago

libghostty-vt compiles and runs as a standalone Wasm module (no emscripten)! Here is a demo video showing terminal key encoding in the browser. This is literally the same logic that powers Ghostty itself. It's happening! Devlog video with more details incoming. You can run this demo yourself, it's a single HTML file in the repo and the README contains a guide to set it up (one Zig command and then a web server command).
0:24

libghostty-vt compiles and runs as a standalone Wasm module (no emscripten)! Here is a demo video showing terminal key encoding in the browser. This is literally the same logic that powers Ghostty itself. It's happening! Devlog video with more details incoming. You can run this demo yourself, it's a single HTML file in the repo and the README contains a guide to set it up (one Zig command and then a web server command).

Mitchell Hashimoto

30,543 views • 10 months ago

Okay so this got way out of hand as per usual 😊 So I accidentally built an entire DOS text-based user interface (TUI) running on the web called PieterOS: 💾 It has a collective file system so anyone that opens it can save and edit and the drive is constantly synced, it has Notepad, Paint, a DOS Terminal emulator, File Commander (ala Norton) And PieterGPT where you can talk to AI I also made Program Generator 9000, and the idea is you write a prompt and it on-the-fly generates a new program inside PieterOS, but it doesn't work well yet Oh and it has Hacker News, of course 😂 I always wanted to build a TUI like this but never could before AI, but now I can 😍 Please be kind and remember everyone can see each other's files!
2:45

Okay so this got way out of hand as per usual 😊 So I accidentally built an entire DOS text-based user interface (TUI) running on the web called PieterOS: 💾 It has a collective file system so anyone that opens it can save and edit and the drive is constantly synced, it has Notepad, Paint, a DOS Terminal emulator, File Commander (ala Norton) And PieterGPT where you can talk to AI I also made Program Generator 9000, and the idea is you write a prompt and it on-the-fly generates a new program inside PieterOS, but it doesn't work well yet Oh and it has Hacker News, of course 😂 I always wanted to build a TUI like this but never could before AI, but now I can 😍 Please be kind and remember everyone can see each other's files!

@levelsio

145,078 views • 4 months ago

this AI Agent scans twitter for the most viral posts in any niche and tells you exactly how to replicate them before you write a single word... here's what it does: -> type in any keyword and it scans X for posts that absolutely blew up in that niche -> analyses exactly what made them go viral like hook structure, length, format, engagement triggers -> generates a full MD file you can drop straight into Claude or ChatGPT to write viral posts in the same style -> paste your own post in and it scans X for similar content that went viral -> gives your post a viral score so you know exactly how much chance you have of going viral -> rewrites your post for maximum viral potential based on what's actually working right now most people post and hope they go viral. this tells you before you post whether it's going to blow up. comment "VIRAL" + RT and i'll send you the full agent so you can stop guessing and start posting content that actually blows up (must be following so i can DM)
0:44

this AI Agent scans twitter for the most viral posts in any niche and tells you exactly how to replicate them before you write a single word... here's what it does: -> type in any keyword and it scans X for posts that absolutely blew up in that niche -> analyses exactly what made them go viral like hook structure, length, format, engagement triggers -> generates a full MD file you can drop straight into Claude or ChatGPT to write viral posts in the same style -> paste your own post in and it scans X for similar content that went viral -> gives your post a viral score so you know exactly how much chance you have of going viral -> rewrites your post for maximum viral potential based on what's actually working right now most people post and hope they go viral. this tells you before you post whether it's going to blow up. comment "VIRAL" + RT and i'll send you the full agent so you can stop guessing and start posting content that actually blows up (must be following so i can DM)

Sulfur

26,452 views • 2 months ago

Gemini skills in Chrome are insanely powerful?! You can just write instructions and Gemini will be able to take any action over and over. 1. Create by typing "/" in the Gemini panel 2. Write your instructions 3. Type "/[skill-name]" And Gemini will automatically work for you by using the skill. So you can leverage it to - Scrap information - Take action in a specific web app - Anything you can perform in a browser basically Keep in mind that you can even use your emails or your Google account as a context... Which can be VERY useful.
0:39

Gemini skills in Chrome are insanely powerful?! You can just write instructions and Gemini will be able to take any action over and over. 1. Create by typing "/" in the Gemini panel 2. Write your instructions 3. Type "/[skill-name]" And Gemini will automatically work for you by using the skill. So you can leverage it to - Scrap information - Take action in a specific web app - Anything you can perform in a browser basically Keep in mind that you can even use your emails or your Google account as a context... Which can be VERY useful.

Paul Couvert

70,226 views • 4 months ago

🚨UNCANNY VALLEY: WHY AI NEEDS A KILL SWITCH Swupnil Sahai 🎾🧠: “I think just introducing some basic guardrails and rules around how this technology can be used and probably just having like some restrictions in place on what kind of data it can incorporate and what kind of actions it can actually take. A human should be able to override the system always and there should be like some mechanism in place. For example with Tesla, like if I'm using autopilot, I can just hit the brakes and I can like take over the robot. You need that sort of kill switch in any of like physical device probably.”
0:53

🚨UNCANNY VALLEY: WHY AI NEEDS A KILL SWITCH Swupnil Sahai 🎾🧠: “I think just introducing some basic guardrails and rules around how this technology can be used and probably just having like some restrictions in place on what kind of data it can incorporate and what kind of actions it can actually take. A human should be able to override the system always and there should be like some mechanism in place. For example with Tesla, like if I'm using autopilot, I can just hit the brakes and I can like take over the robot. You need that sort of kill switch in any of like physical device probably.”

Mario Nawfal

94,752 views • 1 year ago