Dridex Loader Analysis
This article is a deep dive into the Dridex Loader
Read moreLockbit analysis
This article is a deep dive into the IOCP and encryption process from LockBit in depth.
Read morePentesting a banking FTP service
This articles intends to bring an exploitation scenario encountered during a common penetration test.
Read moreWhitepaper: The Lazarus Constellation - A study on North-Korean malware
In this whitepaper, Lexfo analyses Lazarus malwares, from their motives, to their detection and mitigation, through their techniques, tactics, procedures.
Read moreCVE-2017-11176: A step-by-step Linux Kernel exploitation (part 1/4)
The first article covers an in-depth CVE/bug analysis, designs an attack scenario and starts implementing a PoC in ring-0 with SystemTap. The core concept section focuses on file/socket related data structures, netlink and refcounters.
Read moreCVE-2017-11176: A step-by-step Linux Kernel exploitation (part 2/4)
In the second article, a ring-3 PoC is built by removing each SystemTap script line one-by-one. It explains how to find and tailor syscalls to force the kernel into particular code paths as well as unconditionally win the race condition. The core concept section focuses on the scheduler subsystem (task states and wait queues).
Read more