😈 [ EricaZelic, malCOM ]
New UAC bypass credited to @filip_dragovic
https://t.co/yVo7xnbWJj
🔗 https://github.com/Wh04m1001/IDiagnosticProfileUAC
🐥 [ tweet ]
New UAC bypass credited to @filip_dragovic
https://t.co/yVo7xnbWJj
🔗 https://github.com/Wh04m1001/IDiagnosticProfileUAC
🐥 [ tweet ]
😈 [ ShitSecure, S3cur3Th1sSh1t ]
Just added the two new AMSI bypass PoC's via Provider Patching into my Amsi-Bypass-Powershell repo. Plus one PoC in Nim as pull request for OffensiveNim:
https://t.co/CSqnqAuUaz
https://t.co/4W8RSPuzVG
Tested both, works perfectly fine. 👌
🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
🔗 https://github.com/byt3bl33d3r/OffensiveNim/pull/51
🐥 [ tweet ]
Just added the two new AMSI bypass PoC's via Provider Patching into my Amsi-Bypass-Powershell repo. Plus one PoC in Nim as pull request for OffensiveNim:
https://t.co/CSqnqAuUaz
https://t.co/4W8RSPuzVG
Tested both, works perfectly fine. 👌
🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
🔗 https://github.com/byt3bl33d3r/OffensiveNim/pull/51
🐥 [ tweet ]
😈 [ mrd0x, mr.d0x ]
Nothing too crazy in this blog post, but thought it may be useful for some people. Enjoy!
Social engineering your way into the network.
https://t.co/uPVBiClrXc
🔗 https://mrd0x.com/social-engineering-your-way-into-the-network/
🐥 [ tweet ]
Nothing too crazy in this blog post, but thought it may be useful for some people. Enjoy!
Social engineering your way into the network.
https://t.co/uPVBiClrXc
🔗 https://mrd0x.com/social-engineering-your-way-into-the-network/
🐥 [ tweet ]
😈 [ ReconOne_, ReconOne ]
Easy trick: From Shodan to nuclei one liner 👇🔥
Credits: @pdnuclei, @PhilippeDelteil
#recontips #AttackSurface #shodan #bugbountytips #nuclei #recon
🐥 [ tweet ]
Easy trick: From Shodan to nuclei one liner 👇🔥
Credits: @pdnuclei, @PhilippeDelteil
#recontips #AttackSurface #shodan #bugbountytips #nuclei #recon
🐥 [ tweet ]
😈 [ M4yFly, Mayfly ]
GOAD v2 is out !
You can now test your AD commands and pentest skill on a multi-domain AD lab.
Have fun :)
https://t.co/Rpawi6FFl8
https://t.co/pKN8WwSDli
🔗 https://github.com/Orange-Cyberdefense/GOAD
🔗 https://mayfly277.github.io/posts/GOADv2/
🐥 [ tweet ]
GOAD v2 is out !
You can now test your AD commands and pentest skill on a multi-domain AD lab.
Have fun :)
https://t.co/Rpawi6FFl8
https://t.co/pKN8WwSDli
🔗 https://github.com/Orange-Cyberdefense/GOAD
🔗 https://mayfly277.github.io/posts/GOADv2/
🐥 [ tweet ]
😈 [ _nwodtuhs, Charlie Bromberg (Shutdown) ]
Did you know the WriteOwner ACE doesn't allow to change an object's owner arbitrarily? If userA has that privilege against userB, he can set userB's owner to itself, userA. That's it.
You'd need SeRestorePrivilege to set the owner to any other user.
Thanks @BlWasp_ for the info!
🔗 https://github.com/SecureAuthCorp/impacket/pull/1323
🐥 [ tweet ]
Did you know the WriteOwner ACE doesn't allow to change an object's owner arbitrarily? If userA has that privilege against userB, he can set userB's owner to itself, userA. That's it.
You'd need SeRestorePrivilege to set the owner to any other user.
Thanks @BlWasp_ for the info!
🔗 https://github.com/SecureAuthCorp/impacket/pull/1323
🐥 [ tweet ]
😈 [ tiraniddo, James Forshaw ]
Opened up one of my RCG bugs, you could use a Kerberos relay attack to authenticate as that user to an RDP server due to a lack of user checking in the ticket authentication process. https://t.co/MvGmjYa5sm
🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2268
🐥 [ tweet ]
Opened up one of my RCG bugs, you could use a Kerberos relay attack to authenticate as that user to an RDP server due to a lack of user checking in the ticket authentication process. https://t.co/MvGmjYa5sm
🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2268
🐥 [ tweet ]
😈 [ s4ntiago_p, S4ntiagoP ]
Ok, a few updates on nanodump:
1) implemented a cool new technique by @splinter_code where seclogon opens a handle to LSASS and then you duplicate it by winning a race condition using file locks
2) now you can call NtOpenProcess with a fake calling stack and produce fake telemetry, got it from @joehowwolf
https://t.co/nRVmSuZ9qP
🔗 https://github.com/helpsystems/nanodump/commit/c890da208511bacb09f91c68b935915821f4f0f0
🐥 [ tweet ]
Ok, a few updates on nanodump:
1) implemented a cool new technique by @splinter_code where seclogon opens a handle to LSASS and then you duplicate it by winning a race condition using file locks
2) now you can call NtOpenProcess with a fake calling stack and produce fake telemetry, got it from @joehowwolf
https://t.co/nRVmSuZ9qP
🔗 https://github.com/helpsystems/nanodump/commit/c890da208511bacb09f91c68b935915821f4f0f0
🐥 [ tweet ]
😈 [ mariuszbit, mgeeky | Mariusz Banach ]
A single slide from my Malware Development training @x33fcon .
Suprising how widespread VBA actually is. 💀
☢️ Anyone fancy trying out VBA for:
- Terminal emulator serving critical systems,
- CAD projects of military equipment,
- SCADA consoles
https://t.co/8wRuj7ZGQc
🔗 https://www.x33fcon.com/#!t/maldev.md
🐥 [ tweet ]
A single slide from my Malware Development training @x33fcon .
Suprising how widespread VBA actually is. 💀
☢️ Anyone fancy trying out VBA for:
- Terminal emulator serving critical systems,
- CAD projects of military equipment,
- SCADA consoles
https://t.co/8wRuj7ZGQc
🔗 https://www.x33fcon.com/#!t/maldev.md
🐥 [ tweet ]
This media is not supported in your browser
VIEW IN TELEGRAM
😈 [ citronneur, Sylvain Peyrefitte ]
Pamspy is a credential dumper for Linux, that use #eBPF to hook libpam ! Enjoy !
https://t.co/PwsseTe4iJ
🔗 https://github.com/citronneur/pamspy
🐥 [ tweet ]
Pamspy is a credential dumper for Linux, that use #eBPF to hook libpam ! Enjoy !
https://t.co/PwsseTe4iJ
🔗 https://github.com/citronneur/pamspy
🐥 [ tweet ]
😈 [ C5pider, 5pider ]
How I send over data to my server. Nothing big. maybe someone finds this useful for something.
https://t.co/DGyT7Ws55J
🔗 https://gist.github.com/Cracked5pider/1857e292a9fec28cba88bed80d4e509d
🐥 [ tweet ]
How I send over data to my server. Nothing big. maybe someone finds this useful for something.
https://t.co/DGyT7Ws55J
🔗 https://gist.github.com/Cracked5pider/1857e292a9fec28cba88bed80d4e509d
🐥 [ tweet ]
😈 [ NinjaParanoid, Paranoid Ninja (Brute Ratel C4) ]
A thoroughly detailed blog on Brute Ratel C4 by Palo Alto. Proper Actions have been taken to against the found licenses which were sold in the Black Market. As for existing customers, #BRc4 v1.1 release will change every aspect of IOC found in the previous releases.
🔗 https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
🐥 [ tweet ][ quote ]
A thoroughly detailed blog on Brute Ratel C4 by Palo Alto. Proper Actions have been taken to against the found licenses which were sold in the Black Market. As for existing customers, #BRc4 v1.1 release will change every aspect of IOC found in the previous releases.
🔗 https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
🐥 [ tweet ][ quote ]
😈 [ tiraniddo, James Forshaw ]
Finally I can release details about my most serious RCG bug. RCE/EoP in LSASS via CredSSP. Reachable through RDP or WinRM if configured correctly. Will try and put together a blog about it at some point😁https://t.co/ujuMXRCxNT
🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2271
🐥 [ tweet ]
Finally I can release details about my most serious RCG bug. RCE/EoP in LSASS via CredSSP. Reachable through RDP or WinRM if configured correctly. Will try and put together a blog about it at some point😁https://t.co/ujuMXRCxNT
🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2271
🐥 [ tweet ]
😈 [ SemperisTech, Semperis ]
You're familiar with the Golden Ticket attack, but what about the Diamond Ticket? Semperis Security Researcher Charlie Clark reveals the result of research into this potential #securityvulnerability. https://t.co/p7alMaSr4t
🔗 https://lnkd.in/gNYf2Gxz
🐥 [ tweet ]
You're familiar with the Golden Ticket attack, but what about the Diamond Ticket? Semperis Security Researcher Charlie Clark reveals the result of research into this potential #securityvulnerability. https://t.co/p7alMaSr4t
🔗 https://lnkd.in/gNYf2Gxz
🐥 [ tweet ]
😈 [ ippsec, ippsec ]
Really enjoyed reading the APT-29 Article from Unit 42. Decided to do a video talking about it and some light reversing at the malware. Its pretty sad that APT-29 has been doing the LNK in a ZIP TTP for 5+ years and remained succesful by swapping payloads https://t.co/D15cwzATDn
🔗 https://www.youtube.com/watch?v=a7W6rhkpVSM
🐥 [ tweet ]
Really enjoyed reading the APT-29 Article from Unit 42. Decided to do a video talking about it and some light reversing at the malware. Its pretty sad that APT-29 has been doing the LNK in a ZIP TTP for 5+ years and remained succesful by swapping payloads https://t.co/D15cwzATDn
🔗 https://www.youtube.com/watch?v=a7W6rhkpVSM
🐥 [ tweet ]
😈 [ ShitSecure, S3cur3Th1sSh1t ]
The original work author @maorkor also released an 64 bit implementation for Powershell now, worth checking out! The Providers and number of Providers are enumerated automatically here. 🔥
https://t.co/13mU1Zv6iA
🔗 https://github.com/deepinstinct/AMSI-Unchained/blob/main/ScanInterception_x64.ps1
🐥 [ tweet ][ quote ]
The original work author @maorkor also released an 64 bit implementation for Powershell now, worth checking out! The Providers and number of Providers are enumerated automatically here. 🔥
https://t.co/13mU1Zv6iA
🔗 https://github.com/deepinstinct/AMSI-Unchained/blob/main/ScanInterception_x64.ps1
🐥 [ tweet ][ quote ]
This media is not supported in your browser
VIEW IN TELEGRAM
😈 [ dani_ruiz24, daniruiz ]
🔥 Huge improvements to my custom BASH/ZSH reverse shell function.
If you have not seen it
👉 Wrapper for nc (same syntax)
👉 Arrows, Ctrl+C...
👉 Loads the default bashrc config
👉 Color works
👉 sets terminal size
👉 No need to `stty -echo raw; fg`
https://t.co/jkPGFMjpjJ
🔗 https://gist.github.com/daniruiz/c073f631d514bf38e516b62c48366efb#file-kali-shell-aliases-and-functions-sh-L59-L85
🐥 [ tweet ]
🔥 Huge improvements to my custom BASH/ZSH reverse shell function.
If you have not seen it
👉 Wrapper for nc (same syntax)
👉 Arrows, Ctrl+C...
👉 Loads the default bashrc config
👉 Color works
👉 sets terminal size
👉 No need to `stty -echo raw; fg`
https://t.co/jkPGFMjpjJ
🔗 https://gist.github.com/daniruiz/c073f631d514bf38e516b62c48366efb#file-kali-shell-aliases-and-functions-sh-L59-L85
🐥 [ tweet ]
👍1