😈 [ DirectoryRanger, DirectoryRanger ]
SharpWSUS. CSharp tool for lateral movement through WSUS
https://t.co/0hDHe6ePZs
🔗 https://github.com/nettitude/SharpWSUS
🐥 [ tweet ]
SharpWSUS. CSharp tool for lateral movement through WSUS
https://t.co/0hDHe6ePZs
🔗 https://github.com/nettitude/SharpWSUS
🐥 [ tweet ]
😈 [ clearbluejar, clearbluejar ]
Cheers to @itm4n for inspiration, @topotam77 for PetitPotam, and @tiraniddo for NtObjectManager.
New post detailing #RPC auditing with NtObjectManager
https://t.co/7brWus4LoV
🔗 https://clearbluejar.github.io/posts/from-ntobjectmanager-to-petitpotam/
🐥 [ tweet ]
Cheers to @itm4n for inspiration, @topotam77 for PetitPotam, and @tiraniddo for NtObjectManager.
New post detailing #RPC auditing with NtObjectManager
https://t.co/7brWus4LoV
🔗 https://clearbluejar.github.io/posts/from-ntobjectmanager-to-petitpotam/
🐥 [ tweet ]
😈 [ vxunderground, vx-underground ]
We've update the VXUG Windows Malware paper collection
-Studying Next Generation Malware: NightHawks attempt as Sleep obfuscation
-About: Remote Library Injection
-KCTHIJACK - KernelCallbackTableInjection
-Sleep Obfuscation: Ekko
-Gargoyle x64: DeepSleep
https://t.co/cLyIwMexhc
🔗 https://www.vx-underground.org/windows.html
🐥 [ tweet ]
We've update the VXUG Windows Malware paper collection
-Studying Next Generation Malware: NightHawks attempt as Sleep obfuscation
-About: Remote Library Injection
-KCTHIJACK - KernelCallbackTableInjection
-Sleep Obfuscation: Ekko
-Gargoyle x64: DeepSleep
https://t.co/cLyIwMexhc
🔗 https://www.vx-underground.org/windows.html
🐥 [ tweet ]
😈 [ jsecurity101, Jonny Johnson ]
See a scheduled task using <ComHandler> in the actions tag where the principal is SYSTEM but can't modify the CLSID in HKLM?
Impersonate TrustedInstaller, change the registry value to point to your DLL and send it.
🐥 [ tweet ]
See a scheduled task using <ComHandler> in the actions tag where the principal is SYSTEM but can't modify the CLSID in HKLM?
Impersonate TrustedInstaller, change the registry value to point to your DLL and send it.
🐥 [ tweet ]
😈 [ BushidoToken, Will ]
🍻The feeling all IT workers dread: "After spending Tuesday evening drinking at a restaurant, he realised on his way home that the bag containing the drive was missing". cc @TheBeerFarmers
https://t.co/YJBHalD6L0
🔗 https://www.theguardian.com/world/2022/jun/24/japanese-city-worker-loses-usb-containing-personal-details-of-every-resident
🐥 [ tweet ]
🍻The feeling all IT workers dread: "After spending Tuesday evening drinking at a restaurant, he realised on his way home that the bag containing the drive was missing". cc @TheBeerFarmers
https://t.co/YJBHalD6L0
🔗 https://www.theguardian.com/world/2022/jun/24/japanese-city-worker-loses-usb-containing-personal-details-of-every-resident
🐥 [ tweet ]
😈 [ 0gtweet, Grzegorz Tworek ]
Want to disable the Security Event Log? Almost two years after my original research I finally had a moment to wrap it into a short video. Enjoy :) https://t.co/WnazgfXcPK
🔗 https://youtu.be/Wx7gIO71HBg
🐥 [ tweet ][ quote ]
Want to disable the Security Event Log? Almost two years after my original research I finally had a moment to wrap it into a short video. Enjoy :) https://t.co/WnazgfXcPK
🔗 https://youtu.be/Wx7gIO71HBg
🐥 [ tweet ][ quote ]
😈 [ _Wra7h, Christian W ]
Add shellcode as a bitmap to the .rsrc section using UpdateResource before spawning as suspended. Parse the header down to the sections, skip past the bitmap shenannigans and then you get your shellcode address.
https://t.co/AoZV4CINip
🔗 https://github.com/Wra7h/PEResourceInject
🐥 [ tweet ]
Add shellcode as a bitmap to the .rsrc section using UpdateResource before spawning as suspended. Parse the header down to the sections, skip past the bitmap shenannigans and then you get your shellcode address.
https://t.co/AoZV4CINip
🔗 https://github.com/Wra7h/PEResourceInject
🐥 [ tweet ]
😈 [ eloypgz, Eloy ]
I've playing with AWS security, and found the resources/perms enumeration tools quite limited, so developed https://t.co/D0QLCgTsvu with service filtering and recursion (e.g, automatically check S3 buckets you have access). It is still incomplete, but hope you find it useful.
🔗 https://github.com/zer1t0/awsenum
🐥 [ tweet ]
I've playing with AWS security, and found the resources/perms enumeration tools quite limited, so developed https://t.co/D0QLCgTsvu with service filtering and recursion (e.g, automatically check S3 buckets you have access). It is still incomplete, but hope you find it useful.
🔗 https://github.com/zer1t0/awsenum
🐥 [ tweet ]
🔥1
😈 [ 0xdf_, 0xdf ]
Phoenix from @hackthebox_eu involved working around a really slow SQL injection. I'll do some reverse engineering of a WordPress plugin to figure out just the data I need. There's also compiled shell scripts, pam modules config, and wildcard injection.
https://t.co/oAU8XOof2I
🔗 https://0xdf.gitlab.io/2022/06/25/htb-phoenix.html
🐥 [ tweet ]
Phoenix from @hackthebox_eu involved working around a really slow SQL injection. I'll do some reverse engineering of a WordPress plugin to figure out just the data I need. There's also compiled shell scripts, pam modules config, and wildcard injection.
https://t.co/oAU8XOof2I
🔗 https://0xdf.gitlab.io/2022/06/25/htb-phoenix.html
🐥 [ tweet ]
😈 [ mariuszbit, Mariusz Banach ]
☢️ I'm so excited - just issued my first blog post☢️
As promised - sharing my @WarConPL slides deck on:
https://t.co/mynQW0aXsF
Power of positive feedback made me publish them during my first day of holidays (●'◡'●)
Let me know if you like it 🔥
🔗 https://mgeeky.tech/warcon-2022-modern-initial-access-and-evasion-tactics/
🐥 [ tweet ]
☢️ I'm so excited - just issued my first blog post☢️
As promised - sharing my @WarConPL slides deck on:
https://t.co/mynQW0aXsF
Power of positive feedback made me publish them during my first day of holidays (●'◡'●)
Let me know if you like it 🔥
🔗 https://mgeeky.tech/warcon-2022-modern-initial-access-and-evasion-tactics/
🐥 [ tweet ]
👍1
😈 [ NorthwaveLabs, Northwave Labs. ]
Cobalt Strike BOF foundation for kernel exploitation using CVE-2021-21551. In its current state, as a PoC, it overwrites the beacon token with the system token (privesc).
https://t.co/JR1Vao7t9c
🔗 https://github.com/NorthwaveSecurity/kernel-mii
🐥 [ tweet ]
Cobalt Strike BOF foundation for kernel exploitation using CVE-2021-21551. In its current state, as a PoC, it overwrites the beacon token with the system token (privesc).
https://t.co/JR1Vao7t9c
🔗 https://github.com/NorthwaveSecurity/kernel-mii
🐥 [ tweet ]
😈 [ theluemmel, S4U2LuemmelSec ]
Oh holy Nimikätz / custom invoke-mimikatz
If you want the l33t shit for your next engagement you should:
Read -> https://t.co/ZCP5OP1M9e
Read -> https://t.co/8ulbUEyZJY
Use -> https://t.co/WNRJrDGGIz from @danielhbohannon
Use -> private tools from @ShitSecure by sponsoring him
🔗 https://s3cur3th1ssh1t.github.io/Bypass-AMSI-by-manual-modification-part-II/
🔗 https://s3cur3th1ssh1t.github.io/Building-a-custom-Mimikatz-binary/
🔗 https://github.com/danielbohannon/Invoke-Obfuscation
🐥 [ tweet ]
Oh holy Nimikätz / custom invoke-mimikatz
If you want the l33t shit for your next engagement you should:
Read -> https://t.co/ZCP5OP1M9e
Read -> https://t.co/8ulbUEyZJY
Use -> https://t.co/WNRJrDGGIz from @danielhbohannon
Use -> private tools from @ShitSecure by sponsoring him
🔗 https://s3cur3th1ssh1t.github.io/Bypass-AMSI-by-manual-modification-part-II/
🔗 https://s3cur3th1ssh1t.github.io/Building-a-custom-Mimikatz-binary/
🔗 https://github.com/danielbohannon/Invoke-Obfuscation
🐥 [ tweet ]
😈 [ mcohmi, Ohm-I (Oh My) ]
New tool drop. Introducing Dumpscan, a wrapper around volatility3 and some other stuff to make dumping certificates way easier. You can read about it here.
https://t.co/CAK4Y2QSJm
🔗 https://daddycocoaman.dev/posts/introducing-dumpscan/
🔗 https://github.com/daddycocoaman/dumpscan
🐥 [ tweet ]
New tool drop. Introducing Dumpscan, a wrapper around volatility3 and some other stuff to make dumping certificates way easier. You can read about it here.
https://t.co/CAK4Y2QSJm
🔗 https://daddycocoaman.dev/posts/introducing-dumpscan/
🔗 https://github.com/daddycocoaman/dumpscan
🐥 [ tweet ]
😈 [ bmcder02, Blake ]
Recently I got asked to do an overview on ETW. I tried to cover everything useful for #DFIR, including multiple ways to capture ETW, useful providers and finding existing trace sessions.
#cybersecurity
https://t.co/3IWn9w6JuQ
🔗 http://bmcder.com/blog/a-begginers-all-inclusive-guide-to-etw
🐥 [ tweet ]
Recently I got asked to do an overview on ETW. I tried to cover everything useful for #DFIR, including multiple ways to capture ETW, useful providers and finding existing trace sessions.
#cybersecurity
https://t.co/3IWn9w6JuQ
🔗 http://bmcder.com/blog/a-begginers-all-inclusive-guide-to-etw
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction #DFIR
https://t.co/8BZPvX83Ij
🔗 https://jeffreyappel.nl/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction/
🐥 [ tweet ]
Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction #DFIR
https://t.co/8BZPvX83Ij
🔗 https://jeffreyappel.nl/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction/
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
Scheduled Task Tampering
https://t.co/eJvDt166kV
🔗 https://labs.f-secure.com/blog/scheduled-task-tampering/
🐥 [ tweet ]
Scheduled Task Tampering
https://t.co/eJvDt166kV
🔗 https://labs.f-secure.com/blog/scheduled-task-tampering/
🐥 [ tweet ]
😈 [ daem0nc0re, daem0nc0re ]
Added a small PoC to PrivilegedOperations project.
This PoC is to test SeShutdownPrivilege and tries to cause BSOD.
https://t.co/TYcXE9wUte
🔗 https://github.com/daem0nc0re/PrivFu/blob/main/PrivilegedOperations/SeShutdownPrivilegePoC/SeShutdownPrivilegePoC.cs
🐥 [ tweet ]
Added a small PoC to PrivilegedOperations project.
This PoC is to test SeShutdownPrivilege and tries to cause BSOD.
https://t.co/TYcXE9wUte
🔗 https://github.com/daem0nc0re/PrivFu/blob/main/PrivilegedOperations/SeShutdownPrivilegePoC/SeShutdownPrivilegePoC.cs
🐥 [ tweet ]