Dwight Hohnstein

Research & Tradecraft

Apollo 2.0 — New Year, New Features

Introduction At the beginning of 2020, I took my first real foray into programming. Inspired by Cody Thomas’s Mythic, I…

Research & Tradecraft

1Password Secret Retrieval — Methodology and Implementation

Background and Motivation 1Password is a password manager developed by AgileBits Inc., providing a place for users to store various passwords, software licenses,…

Research & Tradecraft

Man in the Terminal

Summary By using path hijacking and modification on Unix-like machines, we can achieve pseudo-keylogging functionality by prioritizing malicious middleware binaries…

Research & Tradecraft

Apollo and Mythic: A Myth Worth Retelling

Introduction Earlier this week, I released a new Windows agent for Mythic — Apollo. Apollo is a .NET Framework agent designed to leverage the…

Research & Tradecraft

Malware Development Pt. 1: Dynamic Module Loading in Go

Introduction As a blend between offensive security engineer and developer, I find myself frustrated in attempting to adhere to the…

Research & Tradecraft

The Curious Case of QueueUserAPC

Summary Due to the nature of the .NET compiled language runtime, user asynchronous procedure calls (APCs) are processed upon the…

Research & Tradecraft

Lateral Movement — SCM and DLL Hijacking Primer

Summary As Defenders increase in maturity, the more they are able to leverage built-in utilities against attackers. PowerShell has a…