So, here's a little thread on my new open source project:

The Tradecraft Garden.

tradecraftgarden.org

It's Crystal Palace, an open-source linker and linker script specialized to writing PIC DLL loaders.

And, a corpora of DLL loaders demonstrating design patterns building tradecraft with it.

Notepad++ tabs can be found in %APPDATA%\Notepad++\backup

I'm guilty of this, and so is every sysadmin I've ever been on who has had notepad++ installed. Pasting credentials, access tokens, ssh keys, and other useful information in "temporary" tabs that they forget to delete.

See if your target is using some kind of remote connection management software, tools such as PuTTY and MobaXTerm can store credentials for hosts, and can easily be decrypted

github.com/xillwillx/Mo...

PuTTY stores creds in

HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\

Your friend(s) at the Tradecraft Garden are here for it.

RemoteMonologue: Weaponizing DCOM for NTLM authentication coercions

ibm.com/think/x-forc...

Hiding any kind of file within a favicon.ico. Could this also work as an embedded resource in a DLL? Cool trick.

github.com/RootUp/Perso...

via x.com/RandomDhiraj

Bypassing Detections with Command-line Obfuscation by x.com/Wietze

www.wietzebeukema.nl/blog/bypassi...

Tool: github.com/wietze/Invok...

H/T to @badsectorlabs.com excellent "Last Week in Security" 03-24-2025 edition.

MCP: An Introduction to Agentic Op Support by x.com/__mez0__ of @trustedsec.com

trustedsec.com/blog/mcp-an-...

This is getting some attention today. Cool shellcode trick from:

My First and Last Shellcode Loader by @dobinrutis.bsky.social at HITB 2024.

H/T x.com/Jean_Maes_19...

Finding Pastures New: An alternate approach to implant design VIA x.com/sapientflow

medium.com/@sapientflow...

A thread about 'module stomping' for allocating payload memory...

February 13, 2014 'Mask' Malware Called 'Most Advanced' Cyber-espionage Operation

www.voanews.com/a/mask-caret...

Technical write-up (quoted below):
media.kasperskycontenthub.com/wp-content/u...

Draugr - A BOF template to demonstrate callstack spoofing. Includes a POC to implement remote process injection with this capability. VIA x.com/RtlDallas

github.com/NtDallas/Dra...

The Things We Think and Do Not Say: The Future of Our Beacon Object Files (BOFs) www.netspi.com/blog/technic...

Cobalt Strike BOF for evasive .NET assembly execution https://github.com/EricEsquivel/Inline-EA

Loki C2: A complete C2 written in JavaScript contained within an Electron Application. VIA x.com/0xBoku/

securityintelligence.com/x-force/bypa...

New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...

[Blog] This ended up being a great applied research project with my co-worker Dylan Tran on weaponizing a technique for fileless DCOM lateral movement based on the original work of James Forshaw. Defensive recommendations provided.

- Blog: ibm.com/think/news/f...
- PoC: github.com/xforcered/Fo...