The Curious Engineer

All blogs / Security

bohops

bohops.com

A blog about cybersecurity research, education, and news

SecurityWindows internalsC# / .NETEngineering blogs

’17’18’19’20’21’22’23’24’25’26
Posts
30 from 2 Dec 2017 to 27 Nov 2023
Posting
quiet since 2023
Kind
personal blog
Feed
https://bohops.com/feed/

2023 2

  1. Abusing .NET Core CLR Diagnostic Features (+ CVE-2023-33127)
  2. No Alloc, No Problem: Leveraging Program Entry Points for Process Injection

2022 2

  1. Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion (Part 2)
  2. Unmanaged Code Execution with .NET Dynamic PInvoke

2021 4

  1. Analyzing and Detecting a VMTools Persistence Technique
  2. CVE-2021-0090: Intel Driver & Support Assistant (DSA) Elevation of Privilege (EoP)
  3. Abusing and Detecting LOLBIN Usage of .NET Development Mode Features
  4. Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion

2020 4

  1. Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
  2. Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative
  3. WS-Management COM: Another Approach for WinRM Lateral Movement
  4. Exploring Microsoft Teams Rooms (MTR) Console as a Potential Attack Vector

2019 4

  1. CVE-2019-1378: Exploiting an Access Control Privilege Escalation Vulnerability in Windows 10 Update Assistant (WUA)
  2. DotNet Core: A Vector For AWL Bypass & Defense Evasion
  3. Abusing Catalog Hygiene to Bypass Application Whitelisting
  4. COM XSL Transformation: Bypassing Microsoft Application Control Solutions (CVE-2018-8492)

2018 12

  1. Abusing the COM Registry Structure (Part 2): Hijacking & Loading Techniques
  2. Capturing NetNTLM Hashes with Office [DOT] XML Documents
  3. Abusing the COM Registry Structure: CLSID, LocalServer32, & InprocServer32
  4. Abusing DCOM For Yet Another Lateral Movement Technique
  5. DiskShadow: The Return of VSS Evasion, Persistence, and Active Directory Database Extraction
  6. Abusing Exported Functions and Exposed DCOM Interfaces for Pass-Thru Command Execution and Lateral Movement
  7. Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence (Part 2)
  8. Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence
  9. Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction
  10. VSTO: The Payload Installer That Probably Defeats Your Application Whitelisting Rules
  11. Loading Alternate Data Stream (ADS) DLL/CPL Binaries to Bypass AppLocker
  12. Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts

2017 2

  1. ClickOnce (Twice or Thrice): A Technique for Social Engineering and (Un)trusted Command Execution
  2. Trust Direction: An Enabler for Active Directory Enumeration and Trust Exploitation