# Ethical Chaos

Personal InfoSec development blog

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## In-Process Patchless AMSI Bypass

DevFeed: [In-Process Patchless AMSI Bypass](<https://devfeed.tech/articles/in-process-patchless-amsi-bypass-32633.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/>)

Author: CCob

Published: 2022-04-17T16:30:25Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Windows](<https://devfeed.tech/topics/windows.md>), [Exception](<https://devfeed.tech/topics/exception.md>), [exceptions](<https://devfeed.tech/topics/exceptions.md>), [debug](<https://devfeed.tech/topics/debug.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [breakpoint](<https://devfeed.tech/tags/breakpoint.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [c2](<https://devfeed.tech/tags/c2.md>), [context](<https://devfeed.tech/tags/context.md>), [debugger](<https://devfeed.tech/tags/debugger.md>), [edr](<https://devfeed.tech/tags/edr.md>), [exception](<https://devfeed.tech/tags/exception.md>), [exception-handling](<https://devfeed.tech/tags/exception-handling.md>), [execution](<https://devfeed.tech/tags/execution.md>), [extension](<https://devfeed.tech/tags/extension.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains an in-process, patchless AMSI bypass approach using vectored exception handling. It contrasts this technique with SharpBlock's debugger-based child-process method and describes manipulating thread context at the point an exception occurs.

### Source excerpt

Some of you may remember my patchless AMSI bypass article and how it was used inside SharpBlock to bypass AMSI on the child process that SharpBlock spawns. This is all well a good when up against client environments that are not too sensitive to the fork and run post exploitation model of operating. What about [...] The post In-Process Patchless AMSI Bypass appeared first on Ethical Chaos.

## Merging C# Assemblies using dnMerge

DevFeed: [Merging C# Assemblies using dnMerge](<https://devfeed.tech/articles/merging-c-assemblies-using-dnmerge-32632.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2021/07/04/merging-c-assemblies-using-dnmerge/>)

Author: CCob

Published: 2021-07-04T08:32:55Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [C#](<https://devfeed.tech/topics/csharp.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [.NET](<https://devfeed.tech/topics/net.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Compression](<https://devfeed.tech/topics/compression.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>)

Tags: [assembly](<https://devfeed.tech/tags/assembly.md>), [c-sharp](<https://devfeed.tech/tags/c-sharp.md>), [c2](<https://devfeed.tech/tags/c2.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [compression](<https://devfeed.tech/tags/compression.md>), [costura](<https://devfeed.tech/tags/costura.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [dnmerge](<https://devfeed.tech/tags/dnmerge.md>), [linux](<https://devfeed.tech/tags/linux.md>), [merge](<https://devfeed.tech/tags/merge.md>), [net](<https://devfeed.tech/tags/net.md>), [tooling](<https://devfeed.tech/tags/tooling.md>)

### AI overview

This developer article explains why Costura can introduce .NET Core assembly references when merging C# assemblies during Linux-based cross-compilation. It introduces dnMerge, an MSBuild plugin that merges and compresses reference assemblies while retaining Linux cross-compilation support, and describes its use of LZMA compression.

### Source excerpt

Introduction When it comes to automating builds for any project that I undertake, my goto OS is usually Linux. Generally I find the deployment of build nodes easier to deploy and manage and usually cheaper than their Windows counterparts. The problem with this of course is Windows based software generally needs cross-compiling in someway or [...] The post Merging C# Assemblies using dnMerge appeared first on Ethical Chaos.

## Attacking Smart Card Based Active Directory Networks

DevFeed: [Attacking Smart Card Based Active Directory Networks](<https://devfeed.tech/articles/attacking-smart-card-based-active-directory-networks-32631.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/10/04/attacking-smart-card-based-active-directory-networks/>)

Author: CCob

Published: 2020-10-04T19:31:42Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [active directory](<https://devfeed.tech/topics/active-directory.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [private key](<https://devfeed.tech/topics/private-key.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [kerberos](<https://devfeed.tech/topics/kerberos.md>), [public key](<https://devfeed.tech/topics/public-key.md>)

Tags: [active-directory](<https://devfeed.tech/tags/active-directory.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [pin](<https://devfeed.tech/tags/pin.md>), [pinswipe](<https://devfeed.tech/tags/pinswipe.md>), [pki](<https://devfeed.tech/tags/pki.md>), [private-key](<https://devfeed.tech/tags/private-key.md>), [public-key](<https://devfeed.tech/tags/public-key.md>), [rubeus](<https://devfeed.tech/tags/rubeus.md>), [smart-card](<https://devfeed.tech/tags/smart-card.md>), [swipe](<https://devfeed.tech/tags/swipe.md>), [weaponize](<https://devfeed.tech/tags/weaponize.md>)

### AI overview

This article examines attacks against smart-card-enforced Active Directory networks. It explains that a physical smart card is not necessarily required for smart-card logon when the corresponding private key is available, describes certificate requirements and policy-related certificate abuse, and introduces PKINIT as public-key support for Kerberos pre-authentication.

### Source excerpt

Introduction Recently I was involved in an engagement where I was attacking smart card based Active Directory networks. The fact is though, you don't need a physical smart card at all to authenticate to Active Directory that enforces smart card logon. The attributes of the certificate determine if it can be used for smart card [...] The post Attacking Smart Card Based Active Directory Networks appeared first on Ethical Chaos.

## EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls

DevFeed: [EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-2-32630.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/06/14/lets-create-an-edr-and-bypass-it-part-2/>)

Author: CCob

Published: 2020-06-14T10:47:09Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Code](<https://devfeed.tech/topics/code.md>), [API](<https://devfeed.tech/topics/api.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [boilerplate](<https://devfeed.tech/tags/boilerplate.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [code](<https://devfeed.tech/tags/code.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [process](<https://devfeed.tech/tags/process.md>), [sharpblock](<https://devfeed.tech/tags/sharpblock.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>)

### AI overview

This tutorial examines methods for bypassing an active-protection EDR, including avoiding suspicious RWX memory changes, unhooking API calls, and using direct syscall instructions. It also introduces SharpBlock and accompanying code.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part 2 I introduce SharpBlock, a method of bypassing EDR's. The post Lets Create An EDR... And Bypass It! Part 2 appeared first on Ethical Chaos.

## Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)

DevFeed: [Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-1-32629.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/05/27/lets-create-an-edr-and-bypass-it-part-1/>)

Author: CCob

Published: 2020-05-27T18:50:50Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [binaries](<https://devfeed.tech/tags/binaries.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [implementation](<https://devfeed.tech/tags/implementation.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

Part one explains how a basic EDR detects malicious files and behavior through signature detection, kernel-level file system filters, sandboxing, and dynamic analysis. It also introduces sandbox bypass concepts involving analysis time limits and disrupted control flow.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part one we cover how to create a basic EDR. The post Lets Create An EDR... And Bypass It! Part 1 appeared first on Ethical Chaos.

## SweetPotato - Local Service to SYSTEM

DevFeed: [SweetPotato - Local Service to SYSTEM](<https://devfeed.tech/articles/sweetpotato-local-service-to-system-32628.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/04/13/sweetpotato-local-service-to-system-privesc/>)

Author: CCob

Published: 2020-04-13T17:30:53Z

Content type: article

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Exploit](<https://devfeed.tech/topics/exploit.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [.NET](<https://devfeed.tech/topics/net.md>), [Security](<https://devfeed.tech/topics/security.md>), [C2](<https://devfeed.tech/topics/c2.md>)

Tags: [c-sharp](<https://devfeed.tech/tags/c-sharp.md>), [c2](<https://devfeed.tech/tags/c2.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [dcom](<https://devfeed.tech/tags/dcom.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [juicypotato](<https://devfeed.tech/tags/juicypotato.md>), [privesc](<https://devfeed.tech/tags/privesc.md>), [rottenpotato](<https://devfeed.tech/tags/rottenpotato.md>), [sweetpotato](<https://devfeed.tech/tags/sweetpotato.md>), [weaponize](<https://devfeed.tech/tags/weaponize.md>), [windows](<https://devfeed.tech/tags/windows.md>), [winrm](<https://devfeed.tech/tags/winrm.md>)

### AI overview

This article introduces SweetPotato, a C# rewrite of JuicyPotato that performs local service-account to SYSTEM privilege escalation on Windows. It adds a BITS/WinRM-based technique and can automatically select between exploit methods depending on the Windows version.

### Source excerpt

Upgraded JuicyPotato performing Local Service to SYSTEM privilege escalation on Windows 7 to the latest Windows 10 / Server 2019. The post SweetPotato - Local Service to SYSTEM appeared first on Ethical Chaos.

## Lenovo CVE-2020-8319 and CVE-2020-8324 PoC

DevFeed: [Lenovo CVE-2020-8319 and CVE-2020-8324 PoC](<https://devfeed.tech/articles/lenovo-cve-2020-8319-and-cve-2020-8324-poc-32627.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/03/26/lenovo-cve-2020-8319-and-cve-2020-8324-poc/>)

Author: CCob

Published: 2020-03-26T17:35:16Z

Content type: article

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [lenovo](<https://devfeed.tech/topics/lenovo.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [coding](<https://devfeed.tech/topics/coding.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [c-sharp](<https://devfeed.tech/tags/c-sharp.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2020-8319](<https://devfeed.tech/tags/cve-2020-8319.md>), [cve-2020-8324](<https://devfeed.tech/tags/cve-2020-8324.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [github](<https://devfeed.tech/tags/github.md>), [lenovo](<https://devfeed.tech/tags/lenovo.md>), [net](<https://devfeed.tech/tags/net.md>), [poc](<https://devfeed.tech/tags/poc.md>), [privesc](<https://devfeed.tech/tags/privesc.md>)

### AI overview

The article releases a C# proof of concept for Lenovo CVE-2020-8319 and CVE-2020-8324. It states that the vulnerabilities can enable privilege escalation from an unprivileged account to SYSTEM and recommends upgrading Lenovo Vantage's System Interface Foundation component to version 1.1.19.3 or higher.

### Source excerpt

C# PoC for Lenovo CVE-2020-8319 and CVE-2020-8324 The post Lenovo CVE-2020-8319 and CVE-2020-8324 PoC appeared first on Ethical Chaos.

## Gookies : A Chrome cookie dumper

DevFeed: [Gookies : A Chrome cookie dumper](<https://devfeed.tech/articles/gookies-a-chrome-cookie-dumper-32626.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/02/21/gookies-a-chrome-cookie-dumper/>)

Author: CCob

Published: 2020-02-21T17:56:12Z

Content type: article

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Chrome](<https://devfeed.tech/topics/chrome.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [JSON](<https://devfeed.tech/topics/json.md>), [cURL](<https://devfeed.tech/topics/curl.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [browsers](<https://devfeed.tech/tags/browsers.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [curl](<https://devfeed.tech/tags/curl.md>), [decrypt](<https://devfeed.tech/tags/decrypt.md>), [dump](<https://devfeed.tech/tags/dump.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [github](<https://devfeed.tech/tags/github.md>), [go](<https://devfeed.tech/tags/go.md>), [golang](<https://devfeed.tech/tags/golang.md>), [json](<https://devfeed.tech/tags/json.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

The article introduces Gookies, a Go-based tool that decrypts and dumps Chrome cookies. It supports multiple Chrome profiles, domain filtering, JSON output for cookie-manager import, and canonicalized cookie headers for command-line tools such as curl. The article states that Chrome 80 and later use a different cookie encryption scheme from version 79 and earlier, and that the tool currently supports Windows.

### Source excerpt

A Chrome cookie decryptor and dumping tool The post Gookies : A Chrome cookie dumper appeared first on Ethical Chaos.

## Weaponizing your favorite Go program for Cobalt Strike

DevFeed: [Weaponizing your favorite Go program for Cobalt Strike](<https://devfeed.tech/articles/weaponizing-your-favorite-go-program-for-cobalt-strike-32625.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/01/26/weaponizing-your-favorite-go-program-for-cobalt-strike/>)

Author: CCob

Published: 2020-01-26T17:40:54Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Go Language](<https://devfeed.tech/topics/go-language.md>), [CMake](<https://devfeed.tech/topics/cmake.md>), [gcc](<https://devfeed.tech/topics/gcc.md>), [Compiler](<https://devfeed.tech/topics/compiler.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [bypass](<https://devfeed.tech/tags/bypass.md>), [cmake](<https://devfeed.tech/tags/cmake.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [edr](<https://devfeed.tech/tags/edr.md>), [gcc](<https://devfeed.tech/tags/gcc.md>), [github](<https://devfeed.tech/tags/github.md>), [go](<https://devfeed.tech/tags/go.md>), [golang](<https://devfeed.tech/tags/golang.md>), [reflective-dll](<https://devfeed.tech/tags/reflective-dll.md>), [weaponize](<https://devfeed.tech/tags/weaponize.md>), [weaponizing](<https://devfeed.tech/tags/weaponizing.md>)

### AI overview

This tutorial explains how to adapt a Go program into a reflective DLL for in-memory execution within Cobalt Strike. It presents a GitHub template based on gobuster and describes its use of CMake, GCC, the Go compiler, and CGO.

### Source excerpt

How to convert a Go program to a reflective DLL for Cobalt Strike The post Weaponizing your favorite Go program for Cobalt Strike appeared first on Ethical Chaos.