FireF0X

@hFireF0X

software engineer, ex-malware analyst and other things

Russian Federation
github.com/hfiref0x
Joined March 2013
73 Photos and videos Photos and videos

Tweets

You blocked @hFireF0X

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @hFireF0X

  1. Dec 13

    Thoughts about "Process Doppelganging" and proof-of-concepts,

    6 replies 104 retweets 132 likes
  2. Nov 29

    Win32k NtUserOpenDesktop Denial Of Service (9200-17046)

    47 retweets 56 likes
  3. Nov 28

    IceID trojan downloader with embedded tiraniddo (token manipulation) and CMSTPLUA UAC bypasses, both copied from uacme together with PEB patch,

    21 retweets 35 likes
  4. Nov 21

    Collection of UAC bypasses based on <HKCU\Volatile Environment@SYSTEMROOT> registry hijack, , note: this should be somewhat fixed in Windows 10 RS3 1709, and work everywhere on 1703 and below.

    1 reply 111 retweets 158 likes
  5. Nov 13

    Good news, 17035 seems fixed shell and this method is now fully working on RS4.

    6 likes
    Show this thread
    Show this thread
  6. Nov 9

    IColorDataProxy (Color Management) undocumented COM interface represents another UAC bypass via ability to execute custom display calibrator from HKLM entry (which can be easily controlled by another MS backdoor interface ICMLuaUtil), this works from Win7 up to recent Win10 RS4).

    1 reply 41 retweets 77 likes
  7. Nov 7

    Win7 - Win10 RS3 UAC bypass using FWCPLLUA uncodumented autoelevated COM interface and enigma0x3 HKCU mscfile registry hijack , loader process PEB patch required.

    4 replies 212 retweets 281 likes
    Show this thread
    Show this thread
  8. Oct 29

    / or as result of Windows Shell API/components redesign.

    1 retweet 6 likes
    Show this thread
    Show this thread
  9. Oct 29

    Windows 10 RS4 17025 sdclt (kickoffelev exefile hkcu) uac bypass no longer works. They seems managed to fix it from the 2nd attempt. /cont

    1 reply 11 retweets 33 likes
    Show this thread
    Show this thread
  10. Retweeted
    Oct 8

    I released some part of my DMA attack tools based on Xilinx SP605 evaluation kit to public, enjoy :)

    4 replies 201 retweets 312 likes
  11. Oct 5

    So you want to say being a part of AV botnet can lead to stealing your data? Wow, rly? Windows Defender "Microsoft SpyNet" anyone?

    1 retweet 12 likes
  12. Oct 3

    *38 "Command line" of course, typo

    1 like
    Show this thread
    Show this thread
  13. Oct 3

    Short summary of UAC changes in Windows 10 RS3 (16299.15 as it suppose to be RTM). tl:dr; It is still useless, annoying piece of junk code.

    3 replies 68 retweets 88 likes
    Show this thread
    Show this thread
  14. Sep 6

    Try not to break anything if you change something. rs3 wow64 elevation bugfest

    26 retweets 41 likes
  15. Aug 25
    Replying to

    Well you can disregard above tweet as it seems another cascade of fun *bug-features* added in 16273. I'll look more when I've time.

    5 likes
  16. Aug 24

    NtLoadEnclaveData bug has been fixed in public 16273 build.

    NtLoadEnclaveData Win10 RS3 MS "feature" to load unsigned drivers via DSE bypass. Stability& quality of code reigns!
    2 replies 22 retweets 28 likes
  17. Aug 24

    UAC bypass based on wow64 logger functionality is apparently no longer works starting from win10 16273 build, everything else works as b4.

    1 reply 4 retweets 11 likes
  18. Aug 15

    CMLuaUtil interface also offers more interesting functions such as: initiate system shutdown, write access to registry (set/del values/keys)

    4 retweets 6 likes
  19. Aug 15
    Replying to

    Note: above requires PEB patch or work from inject.

    3 likes
  20. Aug 15

    Win7-Win10rs4 UAC bypass using CMSTPLUA COM interface , the magic of

    CMSTP.exe - and DLL loading from Webdav - Blogpost - Feedback welcome
    1 reply 111 retweets 151 likes

@hFireF0X hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·