citronneur · HackerTrans

Submissions

Show HN: Applying yara rules on Time Travel Debugging traces

github.com

3 pointsby citronneur3 anni fa0 comments

Time Travel Debugging IDA plugin v1.1.0

github.com

1 pointsby citronneur3 anni fa1 comments

Show HN: Reverse eBPF Using Ida Pro

github.com

3 pointsby citronneur4 anni fa0 comments

Show HN: Credentials dumper for Linux using eBPF

github.com

235 pointsby citronneur4 anni fa50 comments

Show HN: Load Any Beacon Object File Using Powershell

github.com

2 pointsby citronneur5 anni fa0 comments

Show HN: Mstsc.js a Pure JavaScript Remote Desktop Client

lc.cx

2 pointsby citronneur11 anni fa0 comments

Show HN: Remote Desktop Protocol in Node.js

lc.cx

140 pointsby citronneur11 anni fa28 comments

RDPY 1.3.0: Remote Desktop Protocol in Python Now Support NLA Authentication

github.com

3 pointsby citronneur11 anni fa0 comments

RDPY 1.2.2: RDP tools in python (client, honeypot, MITM proxy)

github.com

4 pointsby citronneur11 anni fa0 comments

Show HN: Guitar Tuner in HTML 5 and WebAudio API

github.com

1 pointsby citronneur12 anni fa0 comments

Show HN: RDPY–MITM Proxy, Honeypot, Play with Microsoft Remote Desktop Protocol

lc.cx

15 pointsby citronneur12 anni fa1 comments

Show HN: RDPY – Microsoft Remote Desktop Protocol in Python

github.com

6 pointsby citronneur12 anni fa1 comments

comments

citronneur

3 anni fadiscuss

ttddbg 1.1.0 is out with new tracing feature ! Based on #IDA database, arguments and return value are pretty-printed !

citronneur

4 anni fadiscuss

Impressive works, It allows you to knock on 80 and 443 ports without drivers!

citronneur

4 anni fadiscuss

I made a little fix, if you want to retry

citronneur

4 anni fadiscuss

Lateral movement for example

citronneur

4 anni fadiscuss

You have also https://github.com/pathtofile/bad-bpf or https://github.com/Gui774ume/ebpfkit which are good references also

citronneur

4 anni fadiscuss

You need uretprobe but also need to read an arg by ref so no I don't think so... But thanks for the tip

citronneur

4 anni fadiscuss

Thanks I will check that!

citronneur

4 anni fadiscuss

Thanks!

citronneur

4 anni fadiscuss

thanks !

citronneur

4 anni fadiscuss

Yes we also use for https://github.com/airbus-cert/dirtypipe-ebpf_detection which is a dirtypipe detection program!

citronneur

4 anni fadiscuss

Exactly, we have to found the address to hook on the system, so we need the path of the currently use of libpam by other process

citronneur

11 anni fadiscuss

Planned in next release

citronneur

11 anni fadiscuss

An exemple of node-rdpjs -> https://github.com/citronneur/mstsc.js