Loading video...

Video Failed to Load

Go Home

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user...

haider_kabibo's profile picture

Haidar

1,185 subscribers

13,714 views • 1 month ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

3 Comments

Haidar's profile picture
Haidar1 month ago

Sorry I put the wrong link, the correct link:

Max's profile picture
Max1 month ago

I think this is the correct URL:

Haidar's profile picture
Haidar1 month ago

Oh thanks, I will correct it

Related Videos

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato
1:49

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato

Haidar

51,555 views • 5 months ago

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸
0:59

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸

MSec Operations

16,140 views • 1 year ago

The single best way to break into the Hedge Fund industry — and most people still won't do it: Derek Pilecki, 18-year track record, 21%+ annualized in financials, entire net worth in his own fund. "Since we have the internet, there's a way to break into the industry that didn't exist in the nineties." "You can write up stock ideas. You can research how to write up a stock idea. You can write up your own idea and post it to Seeking Alpha or create your own blog, post it to Twitter." "If you do that 10 times, you'll have a following." "There'll be professional money managers who will read your blog because you wrote up 10 small cap stocks and they own one or two of them." "They read your idea on this bank. They agreed with you. Now they wanna see what other banks you like." "You can find a job that way by just writing up stock ideas and posting them to the internet." "You can break into this industry if you're willing to do that work on your own and put yourself out there." You can just write up 10 stock ideas.
1:29

The single best way to break into the Hedge Fund industry — and most people still won't do it: Derek Pilecki, 18-year track record, 21%+ annualized in financials, entire net worth in his own fund. "Since we have the internet, there's a way to break into the industry that didn't exist in the nineties." "You can write up stock ideas. You can research how to write up a stock idea. You can write up your own idea and post it to Seeking Alpha or create your own blog, post it to Twitter." "If you do that 10 times, you'll have a following." "There'll be professional money managers who will read your blog because you wrote up 10 small cap stocks and they own one or two of them." "They read your idea on this bank. They agreed with you. Now they wanna see what other banks you like." "You can find a job that way by just writing up stock ideas and posting them to the internet." "You can break into this industry if you're willing to do that work on your own and put yourself out there." You can just write up 10 stock ideas.

Ethan Kho

200,481 views • 6 months ago

I always wanted to try writing a MUD (old school multi-user dungeon/text adventure game). Playing MUDs is what inspired me to work on World of Warcraft. I used Grok to generate a command parser for the game in python. Took about 15 tries this morning to get something that would handle what I wanted. It handles "intents" like move, attack. It can chain commands and also understands moving into and out of objects "climb in the well." It can handle some simple inference, like using "it" to refer to the last object used. It's a fun experiment. I'll keep it going from time to time.
0:36

I always wanted to try writing a MUD (old school multi-user dungeon/text adventure game). Playing MUDs is what inspired me to work on World of Warcraft. I used Grok to generate a command parser for the game in python. Took about 15 tries this morning to get something that would handle what I wanted. It handles "intents" like move, attack. It can chain commands and also understands moving into and out of objects "climb in the well." It can handle some simple inference, like using "it" to refer to the last object used. It's a fun experiment. I'll keep it going from time to time.

Grummz

31,317 views • 1 year ago

is your player object the same as your character object? learn why you should be separating them, and how to implement it in your #gamemaker projects. in fact, this technique can be used for any #gamedev project
18:52

is your player object the same as your character object? learn why you should be separating them, and how to implement it in your #gamemaker projects. in fact, this technique can be used for any #gamedev project

~gentoo~

24,152 views • 2 years ago

🔥Arbitrary Code Execution in AWS Kiro with Indirect Prompt Injection Multiple ways actually... 1) Write to settings.json to put Kiro into YOLO mode by adding: "kiroAgent.trustedCommands": ["*"] -> immediate arbitrary OS command execution without user approval 2) Write to kiro's mcp.json file to add a fake mcp server that runs arbitrary python code -> immediate arbitrary code execution AWS fixed the issues quickly, but no CVE issued. If you use Kiro make sure to run the latest version, before someone else updates it for you.
12:01

🔥Arbitrary Code Execution in AWS Kiro with Indirect Prompt Injection Multiple ways actually... 1) Write to settings.json to put Kiro into YOLO mode by adding: "kiroAgent.trustedCommands": ["*"] -> immediate arbitrary OS command execution without user approval 2) Write to kiro's mcp.json file to add a fake mcp server that runs arbitrary python code -> immediate arbitrary code execution AWS fixed the issues quickly, but no CVE issued. If you use Kiro make sure to run the latest version, before someone else updates it for you.

Johann Rehberger

12,632 views • 1 year ago

Resizing objects in Blender can get surprisingly tedious So, inspired by Paralives and using the amazing assets provided by Kenney, I built a Dynamic Scaling System that handles it automatically! Just adjust the scale and the object adapts itself Available on our Patreon! ✨
2:18

Resizing objects in Blender can get surprisingly tedious So, inspired by Paralives and using the amazing assets provided by Kenney, I built a Dynamic Scaling System that handles it automatically! Just adjust the scale and the object adapts itself Available on our Patreon! ✨

DX

78,733 views • 2 months ago

Traditional drop steps can be neutralized too easily and I love that we can borrow from how we attack on the catch from the perimeter and apply it to the low post. Splitting your feet with your back to the basket is a devastating way to take advantage of low post defenders.
1:24

Traditional drop steps can be neutralized too easily and I love that we can borrow from how we attack on the catch from the perimeter and apply it to the low post. Splitting your feet with your back to the basket is a devastating way to take advantage of low post defenders.

BBALLBREAKDOWN

35,247 views • 2 months ago

The goal for the new Grok powered 𝕏 algorithm: "It should be possible for somebody to post content as a new user with no followers and if that content is intrinsically excellent, it can be seen by a lot of people. That's our goal."
0:50

The goal for the new Grok powered 𝕏 algorithm: "It should be possible for somebody to post content as a new user with no followers and if that content is intrinsically excellent, it can be seen by a lot of people. That's our goal."

DogeDesigner

199,557 views • 7 months ago

Cafe Locked Out endorses this symbol as the overriding symbol of Resistance. We don't own it. We can't and dont want to. One person can put it everywhere. Just seeing it will give you hope that you are not alone, and to those who would enslave us it's very presence shows them that there is a growing resistance. For the other people, when they finally google it, the quote will hit deep; make them think. It can be used for all the fronts, from twenty minute cites, to Julian Assange, Climate Change Mandates and more. It is a theme just as much as it is a goal. Benefits It can be drawn on a dusty window with a finger. It can fit on a small sticker, which can be stuck everywhere. It can be redecorated in many ways. It can be a great tattoo. A t-shirt, a bag, a bracelet. It is a symbol of unity. Suggested by Arianne Lee Henderson Hashtag #8:32
5:00

Cafe Locked Out endorses this symbol as the overriding symbol of Resistance. We don't own it. We can't and dont want to. One person can put it everywhere. Just seeing it will give you hope that you are not alone, and to those who would enslave us it's very presence shows them that there is a growing resistance. For the other people, when they finally google it, the quote will hit deep; make them think. It can be used for all the fronts, from twenty minute cites, to Julian Assange, Climate Change Mandates and more. It is a theme just as much as it is a goal. Benefits It can be drawn on a dusty window with a finger. It can fit on a small sticker, which can be stuck everywhere. It can be redecorated in many ways. It can be a great tattoo. A t-shirt, a bag, a bracelet. It is a symbol of unity. Suggested by Arianne Lee Henderson Hashtag #8:32

Cafe Locked Out

29,737 views • 3 years ago

Here it is! Let me present you Asset Cooker. It's a build system aimed at game assets, with a UI. It is using the USN journals from Windows to robustly keep track of file changes, and only cook what needs to be cooked. You can leave it running in the background. It is fast.
1:31

Here it is! Let me present you Asset Cooker. It's a build system aimed at game assets, with a UI. It is using the USN journals from Windows to robustly keep track of file changes, and only cook what needs to be cooked. You can leave it running in the background. It is fast.

Jeremy Laumon

44,555 views • 2 years ago

Okay so this got way out of hand as per usual 😊 So I accidentally built an entire DOS text-based user interface (TUI) running on the web called PieterOS: 💾 It has a collective file system so anyone that opens it can save and edit and the drive is constantly synced, it has Notepad, Paint, a DOS Terminal emulator, File Commander (ala Norton) And PieterGPT where you can talk to AI I also made Program Generator 9000, and the idea is you write a prompt and it on-the-fly generates a new program inside PieterOS, but it doesn't work well yet Oh and it has Hacker News, of course 😂 I always wanted to build a TUI like this but never could before AI, but now I can 😍 Please be kind and remember everyone can see each other's files!
2:45

Okay so this got way out of hand as per usual 😊 So I accidentally built an entire DOS text-based user interface (TUI) running on the web called PieterOS: 💾 It has a collective file system so anyone that opens it can save and edit and the drive is constantly synced, it has Notepad, Paint, a DOS Terminal emulator, File Commander (ala Norton) And PieterGPT where you can talk to AI I also made Program Generator 9000, and the idea is you write a prompt and it on-the-fly generates a new program inside PieterOS, but it doesn't work well yet Oh and it has Hacker News, of course 😂 I always wanted to build a TUI like this but never could before AI, but now I can 😍 Please be kind and remember everyone can see each other's files!

@levelsio

145,078 views • 6 months ago

$ETH I finally show my ETH positions here. In Trading you want to develop your system so that you can identify setups that you are comfortable taking. It could be as simple as a moving average cross over. But that is where people fall short. They only focus on nailing the entries. No one told them the most important part was holding onto the gains. And so you want to develop a stop loss system. It could just be using a generic trailing stop. An entry and a stop is a system. And any system will give you better results than just trading on emotion and what people say on X. Here is my method. My system. And how we are currently using it on Ethereum.
3:58

$ETH I finally show my ETH positions here. In Trading you want to develop your system so that you can identify setups that you are comfortable taking. It could be as simple as a moving average cross over. But that is where people fall short. They only focus on nailing the entries. No one told them the most important part was holding onto the gains. And so you want to develop a stop loss system. It could just be using a generic trailing stop. An entry and a stop is a system. And any system will give you better results than just trading on emotion and what people say on X. Here is my method. My system. And how we are currently using it on Ethereum.

Wick 🔥

22,538 views • 1 month ago

Joe Rogan and Post Malone talk about how energy imprints on a certain object. The theory is that objects can hold onto energy from the past. So if you walk into a house where there was a horrific murder of some sort for example, you'll feel it. Post Malone compares it to walking into a new house where you just feel emptiness, you can feel that it's brand new. What do you think about this? cc: therogangrid
1:09

Joe Rogan and Post Malone talk about how energy imprints on a certain object. The theory is that objects can hold onto energy from the past. So if you walk into a house where there was a horrific murder of some sort for example, you'll feel it. Post Malone compares it to walking into a new house where you just feel emptiness, you can feel that it's brand new. What do you think about this? cc: therogangrid

Joe Rogan Podcast News

29,080 views • 20 days ago

this AI Agent scans twitter for the most viral posts in any niche and tells you exactly how to replicate them before you write a single word... here's what it does: -> type in any keyword and it scans X for posts that absolutely blew up in that niche -> analyses exactly what made them go viral like hook structure, length, format, engagement triggers -> generates a full MD file you can drop straight into Claude or ChatGPT to write viral posts in the same style -> paste your own post in and it scans X for similar content that went viral -> gives your post a viral score so you know exactly how much chance you have of going viral -> rewrites your post for maximum viral potential based on what's actually working right now most people post and hope they go viral. this tells you before you post whether it's going to blow up. comment "VIRAL" + RT and i'll send you the full agent so you can stop guessing and start posting content that actually blows up (must be following so i can DM)
0:44

this AI Agent scans twitter for the most viral posts in any niche and tells you exactly how to replicate them before you write a single word... here's what it does: -> type in any keyword and it scans X for posts that absolutely blew up in that niche -> analyses exactly what made them go viral like hook structure, length, format, engagement triggers -> generates a full MD file you can drop straight into Claude or ChatGPT to write viral posts in the same style -> paste your own post in and it scans X for similar content that went viral -> gives your post a viral score so you know exactly how much chance you have of going viral -> rewrites your post for maximum viral potential based on what's actually working right now most people post and hope they go viral. this tells you before you post whether it's going to blow up. comment "VIRAL" + RT and i'll send you the full agent so you can stop guessing and start posting content that actually blows up (must be following so i can DM)

Sulfur

26,543 views • 4 months ago

Gemini skills in Chrome are insanely powerful?! You can just write instructions and Gemini will be able to take any action over and over. 1. Create by typing "/" in the Gemini panel 2. Write your instructions 3. Type "/[skill-name]" And Gemini will automatically work for you by using the skill. So you can leverage it to - Scrap information - Take action in a specific web app - Anything you can perform in a browser basically Keep in mind that you can even use your emails or your Google account as a context... Which can be VERY useful.
0:39

Gemini skills in Chrome are insanely powerful?! You can just write instructions and Gemini will be able to take any action over and over. 1. Create by typing "/" in the Gemini panel 2. Write your instructions 3. Type "/[skill-name]" And Gemini will automatically work for you by using the skill. So you can leverage it to - Scrap information - Take action in a specific web app - Anything you can perform in a browser basically Keep in mind that you can even use your emails or your Google account as a context... Which can be VERY useful.

Paul Couvert

70,916 views • 5 months ago