Record · corpus.blog/posts/01a0821a-f74f-7216-9ec5-04f4e51c6f3a

Abusing .NET Core CLR Diagnostic Features (+ CVE-2023-33127)

Bohops · published 27 November 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at bohops.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 34
Words captured: 2,976

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/dotnet

github.com

https://github.com/dotnet/runtime

github.com

https://www.mcttp.de/

mcttp.de

https://www.mcttp.de/talk-jimmy-bayne

mcttp.de

https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/uwp/dotnet-native/

learn.microsoft.com

https://dotnet.microsoft.com/en-us/download/dotnet/8.0

dotnet.microsoft.com

https://github.com/dotnet/docs/tree/51d12160b16d3a50e0f12ae75ccc9e85808411f8/docs/core/runtime-config

github.com

https://github.com/steveharter/dotnet_coreclr/blob/master/Documentation/project-docs/clr-configuration-knobs.md

github.com

https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/profiling-overview

learn.microsoft.com

https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/icorprofilercallback2-interface

learn.microsoft.com

https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/icorprofilerinfo2-interface

learn.microsoft.com

https://github.com/dotnet/diagnostics

github.com

https://web.archive.org/web/20170720041203/http:/subt0x10.blogspot.com/2017/05/subvert-clr-process-listing-with-net.html

web.archive.org

https://learn.microsoft.com/en-us/dotnet/core/diagnostics/diagnostic-port

learn.microsoft.com

https://learn.microsoft.com/en-us/dotnet/core/diagnostics/tools-overview

learn.microsoft.com

https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump

learn.microsoft.com

https://learn.microsoft.com/en-us/dotnet/core/diagnostics/microsoft-diagnostics-netcore-client

learn.microsoft.com

https://github.com/dotnet/diagnostics/blob/main/documentation/design-docs/ipc-protocol.md

github.com

https://ioninja.com/

ioninja.com

https://twitter.com/tiraniddo

twitter.com

https://github.com/tyranid/oleviewdotnet

github.com

https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html

csandker.io

https://twitter.com/0xcsandker

twitter.com

https://github.com/dotnet/runtime/blob/882c60cb16ad1c19dd25df8f05282c908fb42126/src/native/eventpipe/ds-ipc-pal-namedpipe.c

github.com

https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/termserv/session-to-session-activation-with-a-session-moniker

learn.microsoft.com

https://twitter.com/nas_bench

twitter.com

https://github.com/SigmaHQ/sigma/blob/2c24b24cf1269a4087acf04136fd2d6eaf447452/rules/windows/process_creation/proc_creation_win_lolbin_dotnet_dump.yml

github.com

https://twitter.com/Cyb3rPandaH

twitter.com

https://github.com/SigmaHQ/sigma/blob/392500131d75634d8db43b2a2de9ddeb8c9f59dc/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml

github.com

https://posts.specterops.io/telemetry-layering-89185b5348ba

posts.specterops.io

https://twitter.com/jsecurity101

twitter.com