DUALITY was a malware project I wrote during my tenure at Aon. It is a methodology, a pipeline, and a toolset that allows for on-the-fly backdooring of DLLs. These DLLs are then able to keep each other alive after infections are lost due to program updates. They also keep an implant up at all times, acting as a low privilege DLL-only mechanism for long-term persistence on hosts. This blog post introduces the idea of DUALITY as well as its applications for persistence. In the next iteration, the DUALITY pipeline is re-used for initial access.
This blog post releases an N-day exploit for ZDI-17-836, which is a remote UAF vulnerability in HP IMC's dbman.exe. A "heap tumbling" technique is discussed as well as sharing a tool to find addresses of ROP gadget pointers-to-pointers in non-ASLR / non-rebase modules. This tool is called "EIP Meathook".
This blog post goes over the full disclosure of a Netgear WNDR3400v2 0-day vulnerability.
This post was written under Aon's Cyber Solutions blog. During a red team operation against a high-net-worth executive, we discovered and exploited a zero-day vulnerability to establish long-term persistence and further infiltrate the home network. General overview + vulnerability writeup are discussed in this post.
This post goes over the technique of "Process Hollowing" in high detail. It was written under Aon's Cyber Labs blog. The link to the code can be found here as well.
This post discusses the idea of "The Tech Mountain". While not necessarily a novel idea, it may help people early in their hacking careers to progress faster as they internalize this concept.
This post was written under Aon's Cyber Solutions blog. It focuses on the methodology utilized to bypass the CloudFlare Web Application Firewall (WAF), as part of the bigger picture of a red team operation that involved infiltrating a large organization.
This post was written under Depth Security's blog. 5 low and medium severity vulnerabilities were converted into an attack chain to exploit over 2.5 million user accounts.
This post was written under Depth Security's blog. It goes over extracting functionality from a Nessus plugin and converting it into a functional exploit.
This post was written under Depth Security's blog. It goes over a detailed scenario and methodology for how to exploit XML External Entity injection attacks.