Process hollowing: hollow a process and refill it
Start a legitimate process suspended, unmap its code and write yours. Outside stays the clean name, inside runs the malware.
notes on hacking and technology
|
main menu
user menu
topics
|
latest postsPacking and unpacking: code that reveals itself at runtimeA packer compresses or encrypts the code and rebuilds it in memory at start. Static analysis sees only the shell; you need to reach the OEP. Anti-debugging: when malware knows it is watchedIsDebuggerPresent, timing, PEB checks. Malware changes behaviour under a debugger or sandbox to escape analysis. API hooking: intercepting system callsRewriting the start of a function to divert it. Used by EDR and cheats, and by malware to hide or steal data. Rootkits: hiding beneath the system's eyeUserland or kernel, a rootkit falsifies what the system reports: processes, files and connections invisible to anyone investigating from inside. Ransomware: the mechanics of encryptionA fast symmetric key for files, a public key to protect the symmetric one. Plus backup deletion and exfiltration for double extortion. C2 and beaconing: the command channelAn implant that calls home at intervals, disguised as normal traffic. Recognizing the beacon rhythm is half of detection. AWS IAM: the privilege escalation pathsA seemingly harmless permission — iam:PassRole, CreatePolicyVersion, lambda:CreateFunction — is often a ladder to admin. Misconfigured S3 buckets: data exposed to the worldA public bucket or an over-broad policy exposes backups, dumps and secrets. It is among the most common causes of cloud data breach. Container escape: breaking out to the hostA container is not a VM. Excessive privileges, capabilities, mounts or exposed sockets turn the confinement into a bypassable obstacle. Kubernetes: abusing RBAC and service accountsA service account with too many rights, or the ability to create pods, leads from a single container to control of the cluster. Exposed Docker socket: host root in one lineWhoever talks to the docker socket commands the daemon, which runs as root. Mounting it in a container or exposing it over TCP hands over the host. |
latest posts
your IP address:
216.73.216.108
visitor #1
MOTD:
Every abstraction leaks somewhere. Here we look at where. |
topics