safe Profile
safe

@safe0x17

Followers
273
Following
61
Media
0
Statuses
17

Red Team Operator

0.0.0.0
Joined March 2024
Don't wanna be here? Send us removal request.
@safe0x17
safe
1 year
๐Ÿฆ€ Introducing ๐—ฅ๐˜‚๐˜€๐˜๐—ถ๐˜ƒ๐—ฒ๐——๐˜‚๐—บ๐—ฝโ€”LSASS memory dumper in pure Rust, using ๐—ผ๐—ป๐—น๐˜† ๐—ก๐—ง ๐—”๐—ฃ๐—œ๐˜€, creating a ๐—บ๐—ถ๐—ป๐—ถ๐—บ๐—ฎ๐—น ๐—บ๐—ถ๐—ป๐—ถ๐—ฑ๐˜‚๐—บ๐—ฝ from scratch, with no std, no CRT, and just ๐Ÿญ๐Ÿด๐—ž๐—•! https://t.co/NF3DJElS6f #redteam #CyberSecurity
Tweet card summary image
github.com
LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode (PIC), supports XOR encryption, and remote file transmission. - safedv/RustiveDump
3
96
295
@vxunderground
vx-underground
11 months
Mildly irritating things seen by malware nerds: - Person saying {thing} evades EDR and/or AV, but they've never performed against an enterprise environment with an active Blue Team (they don't know what they're talking about). Yes, your payload avoided basic analysis, but stop
11
50
736
@x86matthew
x86matthew
11 months
I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. https://t.co/KbsWfdLT3D Project: https://t.co/xJvm24qqXv
Tweet card summary image
github.com
WinVisor - A hypervisor-based emulator for Windows x64 user-mode executables using Windows Hypervisor Platform API - x86matthew/WinVisor
29
350
1K
@safe0x17
safe
1 year
๐Ÿฆ€ ๐—ฅ๐˜‚๐˜€๐˜๐—ฃ๐—ผ๐˜๐—ฎ๐˜๐—ผ: A Rust implementation of ๐—š๐—ผ๐—ฑ๐—ฃ๐—ผ๐˜๐—ฎ๐˜๐—ผ, abusing ๐—ฆ๐—ฒ๐—œ๐—บ๐—ฝ๐—ฒ๐—ฟ๐˜€๐—ผ๐—ป๐—ฎ๐˜๐—ฒ to gain SYSTEM privileges. Includes a TCP-based reverse shell and indirect NTAPI for various operations. https://t.co/ue0V34GGWu #redteam #ethicalhacking
Tweet card summary image
github.com
A Rust implementation of GodPotato โ€” abusing SeImpersonate to gain SYSTEM privileges. Includes a TCP-based reverse shell and indirect NTAPI for various operations. - safedv/RustPotato
2
80
240
@safe0x17
safe
1 year
๐Ÿฆ€ ๐—ฅ๐˜‚๐˜€๐˜๐—ฆ๐—ผ๐—น๐—ถ๐—น๐—ผ๐—พ๐˜‚๐˜†: Rust-based Internal-Monologue implementation for capturing NetNTLM hashes locally without touching LSASS. Using SSPI for NTLM negotiation and indirect NTAPIs for core operations. https://t.co/TpjfJQtMiq #redteam #ethicalhacking
Tweet card summary image
github.com
A Rust implementation of Internal-Monologue โ€” retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and indirect NTAPIs for core operations. - safedv/RustSoliloquy
0
22
106
@vxunderground
vx-underground
1 year
Interesting things that happened lately: October 31st: @safe0x17 released RustVEHSyscalls, a Rust port for LayeredSyscalls โ€” performs indirect syscalls while generating legitimate API call stack frames by abusing VEH October 30th: @FeribHellscream released a paper on forming a
6
41
210
@safe0x17
safe
1 year
๐Ÿฆ€ ๐—ฅ๐˜‚๐˜€๐˜๐—ฉ๐—˜๐—›๐—ฆ๐˜†๐˜€๐—ฐ๐—ฎ๐—น๐—น๐˜€: a Rust port of ๐—Ÿ๐—ฎ๐˜†๐—ฒ๐—ฟ๐—ฒ๐—ฑ๐—ฆ๐˜†๐˜€๐—ฐ๐—ฎ๐—น๐—น that performs indirect syscalls while generating legitimate API call stack frames by abusing VEH, bypassing user-land EDR hooks in Windows. https://t.co/KndPJrF1ZE #RedTeam #EthicalHacking
Tweet card summary image
github.com
A Rust port of LayeredSyscall โ€” performs indirect syscalls while generating legitimate API call stack frames by abusing VEH. - safedv/RustVEHSyscalls
2
39
130
@safe0x17
safe
1 year
๐Ÿฆ€ RustiveDump can now be compiled ๐—ฎ๐˜€ ๐˜€๐—ต๐—ฒ๐—น๐—น๐—ฐ๐—ผ๐—ฑ๐—ฒ (๐—ฃ๐—œ๐—–) using the ๐—ฅ๐˜‚๐˜€๐˜๐—ถ๐—ฐ๐Ÿฒ๐Ÿฐ ๐—ฑ๐—ฒ๐˜€๐—ถ๐—ด๐—ป. LSASS memory dumper using only ๐—ก๐—ง ๐—”๐—ฃ๐—œ๐˜€, supporting ๐—ซ๐—ข๐—ฅ and ๐—ฟ๐—ฒ๐—บ๐—ผ๐˜๐—ฒ ๐˜๐—ฟ๐—ฎ๐—ป๐˜€๐—บ๐—ถ๐˜€๐˜€๐—ถ๐—ผ๐—ป. #redteam #ethicalhacking https://t.co/NF3DJElkgH
Tweet card summary image
github.com
LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode (PIC), supports XOR encryption, and remote file transmission. - safedv/RustiveDump
1
22
89
@safe0x17
safe
1 year
๐Ÿš€ Just dropped Rustic64Shellโ€”64-bit position-independent reverse tcp shell for Windows, built in Rust! ๐Ÿ˜Ž https://t.co/7Egfip1ZbH #RedTeam #EthicalHacking #CyberSecurity
Tweet card summary image
github.com
A 64-bit, position-independent code reverse TCP shell for Windows โ€” built in Rust. - safedv/Rustic64Shell
0
1
4
@ebalo_LTS
Ebalo
1 year
New on Medium: Analyzing the Rustic64 Project for building #Windows #Shellcode in #Rust. ๐Ÿฆ€๐Ÿ’ป Explore #PIC shellcode creation and dive into the code architecture! Check it out here: ๐Ÿ”— https://t.co/17skxEwvJl #Cybersecurity #RustLang #MalwareDevelopment
Tweet card summary image
link.medium.com
A Hands-On Analysis of the Rustic64 Project
0
6
11
@safe0x17
safe
1 year
I'm excited to share ๐—ฅ๐˜‚๐˜€๐˜๐—ถ๐—ฐ๐Ÿฒ๐Ÿฐ. A Modern 64-bit ๐—ฃ๐—ผ๐˜€๐—ถ๐˜๐—ถ๐—ผ๐—ป-๐—œ๐—ป๐—ฑ๐—ฒ๐—ฝ๐—ฒ๐—ป๐—ฑ๐—ฒ๐—ป๐˜ Shellcode Template for ๐—ช๐—ถ๐—ป๐—ฑ๐—ผ๐˜„๐˜€, written ๐—ถ๐—ป ๐—ฅ๐˜‚๐˜€๐˜! #rustlang #CyberSecurity #redteam https://t.co/SF87YMJJrZ
Tweet card summary image
github.com
64-bit, position-independent implant template for Windows in Rust. - safedv/Rustic64
2
26
109