Anas @ZeroMemoryEx

Cyber Security Consultant | Security Researcher hackandhide.com Joined December 2019

Tweets

274
Followers

2K
Following

509
Likes

1K

Anas @ZeroMemoryEx

2 weeks ago

@0xmadvise 🔥🔥

0 0 1 242 0

View Details

Anas @ZeroMemoryEx

3 weeks ago

@Haus3c Unfortunately, you can’t!

0 0 2 353 0

View Details

Anas @ZeroMemoryEx

3 weeks ago

@Haus3c You need to check the certificate details to see if you can use it to dump PPL processes.

0 0 3 373 0

View Details

@provocateur_io @SFNloubnan you think the U.S. doesn’t have transportation? They don’t need Al Boraq to go from LA to San Francisco in 3 hours they already have flights that take only about 1 hour and 20 minutes.

1 0 0 143 0

View Details

Anas @ZeroMemoryEx

2 months ago

@Salsa12__ what do you mean by help disable PPL/PP by manipulating links ?

2 0 1 244 0

View Details

Anas @ZeroMemoryEx

3 months ago

@banthisguy9349 @whiteintel_io found he tried to translate this from English to Korean

1 0 1 94 0

View Details

Anas @ZeroMemoryEx

3 months ago

@smakosh @yezz123 We can go even lower kfta dyal djaj : 300dh lma dyal bir : free internet : 50dh mchrok m3a bzf nas khbz karm: 10dh ( 7to f ma bach yrtab ) srdine : laknti 9rib b7ar sydo kra : camping tent

2 0 7 492 1

View Details

Anas @ZeroMemoryEx

4 months ago

@rustdesk @ESET @anydesk @TeamViewer beside that i also found that it was used by several cybercriminal groups, including BlackBasta, as early as 2022.

1 0 0 314 0

View Details

Anas @ZeroMemoryEx

4 months ago

@rustdesk @ESET @anydesk @TeamViewer No idea, but from my point of view, a threat actor can easily deploy it stealthily, while other remote desktop apps are harder due to the message box that appears when someone tries to connect.

1 0 1 2K 0

View Details

Anas @ZeroMemoryEx

4 months ago

I published a blog post explaining the features of Chaos-Rootkit and how each one works internally. hackandhide.com/chaos-rootkit-…

0 11 44 3K 26

View Details

Anas @ZeroMemoryEx

5 months ago

@0x_alibabas Thanks. didn’t try BaitAndSwitch. when I suggested a redirect policy, it wasn’t an option they said it was incompatible with their SDK. It also took a long time for them to implement a fix, so I gave up testing.

0 0 0 141 0

View Details

Anas @ZeroMemoryEx

5 months ago

I’ve released a PoC and a technical write-up for a local privilege escalation vulnerability I discovered last year and reported to Lenovo PSIRT, affecting many gaming laptop brands, including Lenovo, MSI, Thunderobot, and others. github.com/ZeroMemoryEx/C…

3 35 125 9K 53

View Details

Anas @ZeroMemoryEx

5 months ago

write up hackandhide.com/cve-2025-68921

0 1 9 718 2

View Details

Anas @ZeroMemoryEx

6 months ago

@7N7 Then calls DuplicateHandle with the DUPLICATE_CLOSE_SOURCE option which should close it in the source process allowing you to open it freely and dump everything without the user noticing.

0 0 1 77 0

View Details

Anas @ZeroMemoryEx

6 months ago

@7N7 2. The last issue was that browser processes open the cookies database file with sharing flags that prevent other processes from accessing it. To bypass that you can enumerate handles until you find the right one via NtQuerySystemInformation

1 0 1 92 0

View Details

Anas @ZeroMemoryEx

6 months ago

@7N7 If I remember correctly, if the user is already using the browser and you inject the DLL, it closes once creds are dumped. I didn’t look deeply, but I just run the browser with a new profile (since you can’t spawn two instances), headless then inject dll and pull data via RPC.

0 0 1 41 0

View Details

Anas @ZeroMemoryEx

6 months ago

@7N7 Yeah it’s a lot of effort since you have to handle both ABE and the classic one in ABE some maldevs focus on stealth while others don’t because the browser closes and users notice i can share what I did if you’re interested or you can figur it out yourself if you like challenges.

1 0 1 123 0

View Details

Anas @ZeroMemoryEx

6 months ago

@7N7 Damn, too many things waiting for you down there it almost gave me brain damage.

1 0 1 210 0

View Details

Anas @ZeroMemoryEx

6 months ago

@IntelOpsV3 @dulls I see this is how it started by phishing his friends.😭

0 0 2 246 0

View Details

Anas @ZeroMemoryEx

6 months ago

@AUZombie panel/#scripts

0 0 0 70 0

View Details

Anas @ZeroMemoryEx

6 months ago

@AUZombie This is their builder. You can see the features since it checks authentication on the client side if you set the response of /api/users to true.