Does it just copy itself into RAM or does it also copy inside the file on disk?
@markbaggett3 ай бұрын
This is a clip from a video I didn in one of the original command and control backdoors. It was the OG tool for techniques like process hollowing and other memory based hiding techniques. But it lived on disk. For more info check out the full video. Link in description.
@disko.kommando3 ай бұрын
Love the new production! Awesome.
@wesley000424 ай бұрын
Thank you for this. I haven't seen Sir Dystic since I rented a room from him back in 95 or 96.
@markbaggett4 ай бұрын
It was my pleasure to speak with him and I’m glad I could bring it to you.
@jeannel18164 ай бұрын
Awesome video !
@markbaggett4 ай бұрын
Glad you enjoyed it.
@foobarf87664 ай бұрын
11 out of 12 here that was actually fun!
@markbaggett4 ай бұрын
Thanks. It was a lot of fun making it. 11 out of 12 also seems significant. Do you have an OSINT or Law enforcement background?
@hulusewferede4664 ай бұрын
Thanks, buddy. I learned a lot in this short video. Savor.
@yash34695 ай бұрын
This is so good...
@yay-r6j6 ай бұрын
awesomeness! 💚
@markbaggett5 ай бұрын
Thank you!!
@yay-r6j5 ай бұрын
@@markbaggett likewise! thank for you touching on these topics, they're deeply fascinating and useful for aspiring researchers. lol, i probably shouldn't generalise like this because I'm speaking for myself here. it's just that in the past it wasn't as simple to come across such information, condensed into little nuggets that help answer so many questions, so I'd imagine there'll be many more folks out here who would benefit from understanding things at this level of the chain
@diogodaz6 ай бұрын
Erik, I'm a fan of your work and I have a question. Would it be possible to add specific permissions to the file in the output, preventing the current user from deleting the collection?
@markbaggett6 ай бұрын
I suggest posting this question on the Kape GitHub repository. That is where they typically handle feature requests.
@rickblaster-xu5ie6 ай бұрын
the OG cdc
@SimonLopezPsymon6 ай бұрын
Amazing video, thanks Mark !!
@markbaggett6 ай бұрын
Thank you! I appreciate it!
@Jon77636 ай бұрын
ah, good old nc.exe
@mrmookypooky7 ай бұрын
great episode friend! Thank you! :) .
@markbaggett6 ай бұрын
Thank you!
@RR-hl6zi7 ай бұрын
Your channel is a hidden gem. I hope it will gain traction at some point. But it might require an island, 50 starving InfoSec engineers, an electric car of a specific brand and a firepit. Thank you for making these videos. ❤
@markbaggett6 ай бұрын
Thanks. I appreciate it. I enjoy doing the interviews. Video editing is a new skill i'm enjoying learning. But its a lot of work. But I'll keep going for the 50 starving engineers at this point. ;)
@ryanshanahan87887 ай бұрын
Looking forward to the unedited, long form version. Thanks for doing these interviews, @Mark Baggett!
@markbaggett6 ай бұрын
Just getting back and caught up from Australia. It will be another couple of weeks.
@SimonLopezPsymon7 ай бұрын
Not a single workday goes by withouth using any Zimmermann's tool... Thanks for sharing this with us Mark !
@Timanator7 ай бұрын
Cant believe how many of these were written by Andrew lol. Great stuff!
@christophertharp77637 ай бұрын
the LEGEND
@imnobody45228 ай бұрын
Sounds like another violation of the peoples 4th amendment rights, when an over zealous officer or black hat hacker decides to use it maliciously. Show me the man I'll find you the crime.
@Timanator8 ай бұрын
Love me some Kape.
@ContagiousRepublic8 ай бұрын
Sounds like law enforcement didn't want certain cases to have forensics applied since it would point blame at police misconduct or years-old evidence destruction by police that they didn't want analyzed until the related police retired.
@noneri-pj3fc8 ай бұрын
I love this
@Liriq8 ай бұрын
Change the name, and all previous analysis becomes irrelevant. Bureaucracy at its finest. Chef's kiss.
@senior_ranger8 ай бұрын
I watched the entire video, and I have no idea what any of this is about or what it does or what it's trying to do. Not a criticism of the video; a statement of how out of touch I've become. Thirty years ago I was publishing Web sites for a major software company. Fascinating.
@ichibot-app8 ай бұрын
"Stay in your lane" - Americans have both the biggest and most fragile ego's on earth.
@SALTINBANK8 ай бұрын
Too good for the FBI : sick story ... Shady business we you think of all of this ... Sad for such an agency ...
@davel2028 ай бұрын
Sounds like encase tbh. Maybe the speed forensics advantage
@markbaggett6 ай бұрын
It’s really a completely different approach. There is no forensics image. It’s all done directly on the drive. I discuss the pros and cons of that approach in the full unedited interview if you are interested.
@lancemarchetti86738 ай бұрын
Awesome.. can't wait!
@umerkha8 ай бұрын
How is Kape a new tool?
@markbaggett6 ай бұрын
Kape is not new. It has been around for a while.
@ReligionAndMaterialismDebunked8 ай бұрын
Fellow RGB keyboard user. <3 🤝😅☺️💻👨🏽💻🤪😎⌨️
@ReligionAndMaterialismDebunked8 ай бұрын
Great stuff! Fellow ethical hackers. Hehe. Shalom. <3
@KenPryor8 ай бұрын
I've used Kape quite a bit over the last year or so and it is awesome. All of Eric's EZ tools are awesome as well. I've been able to gain so much insight so quickly with his tools and I am very grateful.
@sechvnnull15248 ай бұрын
Guy is a genius and legend in my book. I used many of his tools in my forensic classes and cant thank him enough for his contributions to the field. Although, I didn't go into forensics instead going into the offensive side, I still keep up on forensic related news and love forensics! Thank you for this interview it is awesome!
@GuyThompsonFWTX8 ай бұрын
The fact that Kape and Eric Zimmerman Tools are free, truly makes me appreciate our small community of Digital Forensics practitioners. Add in FTK Imager and Arsenal Image Mounter, and I could pretty much do everything I need to perform digital investigations.
@mogobogo18 ай бұрын
great video very informative however i would like to point out that there are terrible audio issues
@markbaggett6 ай бұрын
Thanks! Im still learning and working on how I capture interviews. I’m always trying to make it better.
@brycegalbraith63758 ай бұрын
Wow, fascinating history. Love it. Thanks for pushing through the BS Eric!
@markbaggett8 ай бұрын
I love the fact that renaming an executable works for both antivirus signature bypass AND legal precedent bypass!