😈 [ 0xdf_, 0xdf ]
Acute from @hackthebox_eu was just a hard pure Windows box. I'll pivot between two hosts largely relying on credentials and enumeration to get domain admin.
https://t.co/p0Fhgak2dI
🔗 https://0xdf.gitlab.io/2022/07/16/htb-acute.html
🐥 [ tweet ]
Acute from @hackthebox_eu was just a hard pure Windows box. I'll pivot between two hosts largely relying on credentials and enumeration to get domain admin.
https://t.co/p0Fhgak2dI
🔗 https://0xdf.gitlab.io/2022/07/16/htb-acute.html
🐥 [ tweet ]
😈 [ ippsec, ippsec ]
#HackTheBox Acute video is now up! This was a tough Windows box with all the pivots between users. I decided to try out ConPtyShell to get a full PTY on Windows, had to do some light modifications to bypass Defender. https://t.co/hey5QSjGDr
🔗 https://youtu.be/jDYte7xNY1g
🐥 [ tweet ]
#HackTheBox Acute video is now up! This was a tough Windows box with all the pivots between users. I decided to try out ConPtyShell to get a full PTY on Windows, had to do some light modifications to bypass Defender. https://t.co/hey5QSjGDr
🔗 https://youtu.be/jDYte7xNY1g
🐥 [ tweet ]
😈 [ HuskyHacksMK, Matt | HuskyHacks ]
📝New note is up on https://t.co/DIZF98zvlm
Threat emulation for Windows Installer (MSI) -> DLL malware. Learn how to make a malicious MSI like all the cool kids!
https://t.co/6vWFQckIWE
🔗 http://notes.huskyhacks.dev
🔗 https://notes.huskyhacks.dev/notes/ms-interloper-on-the-subject-of-malicious-msis
🐥 [ tweet ]
📝New note is up on https://t.co/DIZF98zvlm
Threat emulation for Windows Installer (MSI) -> DLL malware. Learn how to make a malicious MSI like all the cool kids!
https://t.co/6vWFQckIWE
🔗 http://notes.huskyhacks.dev
🔗 https://notes.huskyhacks.dev/notes/ms-interloper-on-the-subject-of-malicious-msis
🐥 [ tweet ]
😈 [ an0n_r0, an0n ]
may be obsolete, because impacket has already included this in its examples, but added Kerberos auth support for writing msDS-AllowedToActOnBehalfOfOtherIdentity property. https://t.co/UGjU3Rt357
🔗 https://github.com/tothi/rbcd-attack
🐥 [ tweet ]
may be obsolete, because impacket has already included this in its examples, but added Kerberos auth support for writing msDS-AllowedToActOnBehalfOfOtherIdentity property. https://t.co/UGjU3Rt357
🔗 https://github.com/tothi/rbcd-attack
🐥 [ tweet ]
😈 [ campuscodi, Catalin Cimpanu ]
Pretender, a cross-platform tool to obtain a machine-in-the-middle position inside Windows networks
Blog: https://t.co/RS2REMMeA1
GitHub: https://t.co/GCXEgBsOPF
🔗 https://blog.redteam-pentesting.de/2022/introducing-pretender/
🔗 https://github.com/RedTeamPentesting/pretender
🐥 [ tweet ]
Pretender, a cross-platform tool to obtain a machine-in-the-middle position inside Windows networks
Blog: https://t.co/RS2REMMeA1
GitHub: https://t.co/GCXEgBsOPF
🔗 https://blog.redteam-pentesting.de/2022/introducing-pretender/
🔗 https://github.com/RedTeamPentesting/pretender
🐥 [ tweet ]
😈 [ LittleJoeTables, Moloch ]
For anyone that wants wants to follow along with the Sliver GUI development I've open sourced what I've completed so far. However, it's not a priority and no timeline on feature-complete: https://t.co/YcKmTL0nRi
PRs welcome :)
🔗 https://github.com/BishopFox/sliver-gui
🐥 [ tweet ]
For anyone that wants wants to follow along with the Sliver GUI development I've open sourced what I've completed so far. However, it's not a priority and no timeline on feature-complete: https://t.co/YcKmTL0nRi
PRs welcome :)
🔗 https://github.com/BishopFox/sliver-gui
🐥 [ tweet ]
😈 [ tiraniddo, James Forshaw ]
I recommended to @_dirkjan to try my NtObjectManager PS module to do an AD access check, but of course I provided no guidance. Therefore, here's a quick blog post with an overview of the checking process and how to use the Get-AccessibleDsObject command. https://t.co/ZOoJe6DHAS
🔗 https://www.tiraniddo.dev/2022/07/access-checking-active-directory.html
🐥 [ tweet ]
I recommended to @_dirkjan to try my NtObjectManager PS module to do an AD access check, but of course I provided no guidance. Therefore, here's a quick blog post with an overview of the checking process and how to use the Get-AccessibleDsObject command. https://t.co/ZOoJe6DHAS
🔗 https://www.tiraniddo.dev/2022/07/access-checking-active-directory.html
🐥 [ tweet ]
😈 [ 0gtweet, Grzegorz Tworek ]
Didn't described it precisely so far:
If you put 'mpnotify' value into the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, your exe will be launched by winlogon.exe when user logs on. After 30s the process will be terminated.
https://t.co/36luTJ3vqB
🔗 https://persistence-info.github.io/Data/mpnotify.html
🐥 [ tweet ]
Didn't described it precisely so far:
If you put 'mpnotify' value into the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, your exe will be launched by winlogon.exe when user logs on. After 30s the process will be terminated.
https://t.co/36luTJ3vqB
🔗 https://persistence-info.github.io/Data/mpnotify.html
🐥 [ tweet ]
😈 [ m3g9tr0n, Spiros Fraganastasis ]
Malware Mutation Using Reinforcement Learning and Generative Adversarial Networks https://t.co/WxPdaOEkhj
🔗 https://github.com/CyberForce/Pesidious
🐥 [ tweet ]
Malware Mutation Using Reinforcement Learning and Generative Adversarial Networks https://t.co/WxPdaOEkhj
🔗 https://github.com/CyberForce/Pesidious
🐥 [ tweet ]
👹 [ snovvcrash, sn🥶vvcr💥sh ]
[#Tooling ⚔️] Inspired by @s4ntiago_p and NanoDump I’ve fully switched to API Hashing for Windows API and syscalls resolution in DInjector. A quick re-hashing can be performed before compilation with a Python script.
🐥 [ tweet ]
[#Tooling ⚔️] Inspired by @s4ntiago_p and NanoDump I’ve fully switched to API Hashing for Windows API and syscalls resolution in DInjector. A quick re-hashing can be performed before compilation with a Python script.
🐥 [ tweet ]
😈 [ Cx01N_, Cx01N ]
This is great!
https://t.co/xkvlT03Wf1
🔗 https://github.com/NARKOZ/hacker-scripts
🐥 [ tweet ]
This is great!
https://t.co/xkvlT03Wf1
🔗 https://github.com/NARKOZ/hacker-scripts
🐥 [ tweet ]
😈 [ _nwodtuhs, Charlie Bromberg (Shutdown) ]
After 4 months of testing/peer-review and the PR being in draft, dacledit is now ready for official review and merge in Impacket 💪 This script can be used to read, write, remove, backup, restore ACEs in an object's DACL, see you soon when merged 😊
https://t.co/nQGZy1dnbR
🔗 https://github.com/SecureAuthCorp/impacket/pull/1291
🐥 [ tweet ]
After 4 months of testing/peer-review and the PR being in draft, dacledit is now ready for official review and merge in Impacket 💪 This script can be used to read, write, remove, backup, restore ACEs in an object's DACL, see you soon when merged 😊
https://t.co/nQGZy1dnbR
🔗 https://github.com/SecureAuthCorp/impacket/pull/1291
🐥 [ tweet ]
😈 [ lpha3ch0, Steve Campbell ]
My latest blog post, Pivoting for Pentesters https://t.co/9N1gxtdJXn #infosec #pentest #redteam
🔗 https://www.stevencampbell.info/Pivoting-for-pentesters/
🐥 [ tweet ]
My latest blog post, Pivoting for Pentesters https://t.co/9N1gxtdJXn #infosec #pentest #redteam
🔗 https://www.stevencampbell.info/Pivoting-for-pentesters/
🐥 [ tweet ]
😈 [ ReconOne_, ReconOne ]
Shodan Dork in Manual mode - Part 1
Now that you all have Shodan membership it's time to try Shodan Dorks 👀👇
Credits: @securitytrails
#recon #Shodan #attacksurface #bugbountytips #BugBounty #cybersecurity
🐥 [ tweet ]
Shodan Dork in Manual mode - Part 1
Now that you all have Shodan membership it's time to try Shodan Dorks 👀👇
Credits: @securitytrails
#recon #Shodan #attacksurface #bugbountytips #BugBounty #cybersecurity
🐥 [ tweet ]
😈 [ C5pider, 5pider ]
CoffeeLdr
A Beacon Object File Loader
https://t.co/vD2QlGhLov
🔗 https://github.com/Cracked5pider/CoffeeLdr
🐥 [ tweet ]
CoffeeLdr
A Beacon Object File Loader
https://t.co/vD2QlGhLov
🔗 https://github.com/Cracked5pider/CoffeeLdr
🐥 [ tweet ]
😈 [ i_bo0om, Bo0oM ]
20 years of payment processing problems
Ru: https://t.co/Xp81RFL9hQ
En: https://t.co/aDep1kdgyu
🔗 https://bo0om.ru/20-years-of-payment-processing-problems
🔗 https://bo0om.ru/20-years-of-payment-processing-problems-en
🐥 [ tweet ]
20 years of payment processing problems
Ru: https://t.co/Xp81RFL9hQ
En: https://t.co/aDep1kdgyu
🔗 https://bo0om.ru/20-years-of-payment-processing-problems
🔗 https://bo0om.ru/20-years-of-payment-processing-problems-en
🐥 [ tweet ]
😈 [ mpgn_x64, mpgn ]
I just merged one of the most craziest module in CrackMapExec called "hash_spider" from @hackerm00n 🚀
With an initial admin access, it will dump lsass recursively using BloodHound to find local admins path (adminTo) to harvest more users and find new paths until DA 🔥
🪂
🐥 [ tweet ]
I just merged one of the most craziest module in CrackMapExec called "hash_spider" from @hackerm00n 🚀
With an initial admin access, it will dump lsass recursively using BloodHound to find local admins path (adminTo) to harvest more users and find new paths until DA 🔥
🪂
🐥 [ tweet ]
😈 [ an0n_r0, an0n ]
elevated CVE-2022-30166 EoP to SYSTEM. the work was done by @tiraniddo, here I just modified their PoC for getting TGT dump, did some custom ticket conversion stuff then RBCD attack with the machine Kerberos TGT. works only if AllowTgtSessionKey (non-default) is enabled.
🐥 [ tweet ][ quote ]
elevated CVE-2022-30166 EoP to SYSTEM. the work was done by @tiraniddo, here I just modified their PoC for getting TGT dump, did some custom ticket conversion stuff then RBCD attack with the machine Kerberos TGT. works only if AllowTgtSessionKey (non-default) is enabled.
🐥 [ tweet ][ quote ]