Pinned
Step right up! 📢 We’re serving up a Windows kernel exploit that never goes stale. 🍿 Forget patches, this forever-day is popping off and it's here to stay. Grab a bucket and watch the show! elastic.co/security-labs/…
Gabriel Landau
1,427 posts
Gabriel Landau
@GabrielLandau
Maryland, USA
Joined November 2009
- Brand new Win10 laptop. Attempt to install Chrome. Almost get owned with my very first action. Why is this still happening in 2018, @bing? Please explain.
00:00 - Evade AV by deleting your payload before running it. Introducing Process Ghosting 👻:
- Antivirus getting in your way? Put it in a sandbox, and go about your day. elastic.github.io/security-resea…
- Introducing a new Windows vulnerability class: False File Immutability. 👉 Bonus: a kernel exploit to load unsigned drivers.
- Forget vulnerable drivers - Admin is all you need Article 👉 elastic.co/security-labs/… 👇 Demo - enable sound 🔊
00:00 - Watch me drop some still-unpatched Windows exploits at BlackHat: ✅ Bypass LSASS RunAsPPL ✅ Modify kernel memory 💥 Zero vulnerable drivers Article: tiny.cc/FVDX Article #2: tiny.cc/KillingPPLFault Code: github.com/gabriellandau/… Talk: 👇 youtu.be/5xteW8Tm410
- Friendly reminder that these 476-day kernel and PPL exploits still work on fully-patched 23H2. Happy January pwnage! #NotASecurityBoundary
Watch me drop some still-unpatched Windows exploits at BlackHat: ✅ Bypass LSASS RunAsPPL ✅ Modify kernel memory 💥 Zero vulnerable drivers Article: tiny.cc/FVDX Article #2: tiny.cc/KillingPPLFault Code: github.com/gabriellandau/… Talk: 👇 youtu.be/5xteW8Tm410 - Microsoft won't fix this Windows LPE, but I'll show you how to detect and block it:
- The reports of PPLdump's death are greatly exaggerated. Just BYOVDLL - ntdll in this case 😉
The July 2022 update of Windows 10/11 killed PPLdump 💀😢 Find out how in this blog post... 👉 itm4n.github.io/the-end-of-ppl… - Thanks to everyone who attended my Black Hat Asia talk! You can find the slides here:
- Thanks to everyone who attended my @reconmtl and @BlueHatIL talks! The exploit and slides are here: github.com/gabriellandau/… If you took any photos during either of the talks, please share them here. Also, please don't hesitate to stop me to say hi!
- > Elastic has pushed the defensive industry forward with their anomalous call stack detection logic that is a formidable challenge for modern red team operations. Thanks for the shout-out! We have plans to make your jobs even harder. 🙂
