π [ mariuszbit, mgeeky | Mariusz Banach ]
- "... and then he said to sign my malware.exe with faked Microsoft cert to evade AVs/EDRs. Would you believe?"
(οΏ£yβ½οΏ£)β Ohohoho.....
Sign-Artifact.ps1 - based on @mattifestation research & implementation shamelessly borrowed here:
https://t.co/6LAVgCrOVN
π https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/red-teaming/Self-Signed%20Threat
π₯ [ tweet ]
- "... and then he said to sign my malware.exe with faked Microsoft cert to evade AVs/EDRs. Would you believe?"
(οΏ£yβ½οΏ£)β Ohohoho.....
Sign-Artifact.ps1 - based on @mattifestation research & implementation shamelessly borrowed here:
https://t.co/6LAVgCrOVN
π https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/red-teaming/Self-Signed%20Threat
π₯ [ tweet ]
π [ harmj0y, Will Schroeder ]
After an awesome back and forth with @cnotin and @SteveSyfuhs on the effects of "TokenLeakDetectDelaySecs" and "Protected Users" for mitigating token theft, I've updated the Koh README to reflect this (and updated the post to point to the README as well) https://t.co/AGViEV0stq
π https://github.com/GhostPack/Koh/blob/main/README.md#mitigations
π₯ [ tweet ]
After an awesome back and forth with @cnotin and @SteveSyfuhs on the effects of "TokenLeakDetectDelaySecs" and "Protected Users" for mitigating token theft, I've updated the Koh README to reflect this (and updated the post to point to the README as well) https://t.co/AGViEV0stq
π https://github.com/GhostPack/Koh/blob/main/README.md#mitigations
π₯ [ tweet ]
π [ ptswarm, PT SWARM ]
π₯ New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE!
Read the research: https://t.co/PJZHLRM8xq
π https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/
π₯ [ tweet ]
π₯ New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE!
Read the research: https://t.co/PJZHLRM8xq
π https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/
π₯ [ tweet ]
π [ 404death, sailay(valen) ]
I just recently found out the way
XSS <a> tag without user action
<a/autofocus/onfocus=alert(0) href>valen</a>
<a/href="#"/autofocus/onfocus=alert`valen`>you don't need user action on a tag</a>
Tested on:
https://t.co/RkGdfpNWli
https://t.co/bPvMeBlba1
π https://xss-game.appspot.com/level1/frame
π http://testphp.vulnweb.com/search.php?test=query
π₯ [ tweet ]
I just recently found out the way
XSS <a> tag without user action
<a/autofocus/onfocus=alert(0) href>valen</a>
<a/href="#"/autofocus/onfocus=alert`valen`>you don't need user action on a tag</a>
Tested on:
https://t.co/RkGdfpNWli
https://t.co/bPvMeBlba1
π https://xss-game.appspot.com/level1/frame
π http://testphp.vulnweb.com/search.php?test=query
π₯ [ tweet ]
π [ tiraniddo, James Forshaw ]
Final LSA bug from last month is now open. An interesting one which breaks common assumptions of impersonation security over the LSA's RPC interface. Me and @monoxgas will describe a way of abusing the bug at BH next month to get SYSTEM privileges. https://t.co/v523Q1EXLD
π https://bugs.chromium.org/p/project-zero/issues/detail?id=2278
π₯ [ tweet ]
Final LSA bug from last month is now open. An interesting one which breaks common assumptions of impersonation security over the LSA's RPC interface. Me and @monoxgas will describe a way of abusing the bug at BH next month to get SYSTEM privileges. https://t.co/v523Q1EXLD
π https://bugs.chromium.org/p/project-zero/issues/detail?id=2278
π₯ [ tweet ]
π [ aniqfakhrul, Aniq Fakhrul ]
Our version of PywerView is now publicly available. Python version or PowerView, remotely interacts with ldap server. Also included with mini interactive console with auto completion. Yeet! @h0j3n @imnirfn
https://t.co/c0cdk2fGPr
π https://github.com/aniqfakhrul/PywerView
π₯ [ tweet ]
Our version of PywerView is now publicly available. Python version or PowerView, remotely interacts with ldap server. Also included with mini interactive console with auto completion. Yeet! @h0j3n @imnirfn
https://t.co/c0cdk2fGPr
π https://github.com/aniqfakhrul/PywerView
π₯ [ tweet ]
π [ eric_capuano, Eric Capuano ⬑ ]
Interesting API details on how a process is launched in Windows
Specifically dig the part on Protected Processes
https://t.co/V5lWrEqKaT
π https://fourcore.io/blogs/how-a-windows-process-is-created-part-1
π₯ [ tweet ]
Interesting API details on how a process is launched in Windows
Specifically dig the part on Protected Processes
https://t.co/V5lWrEqKaT
π https://fourcore.io/blogs/how-a-windows-process-is-created-part-1
π₯ [ tweet ]
π [ aniqfakhrul, Aniq Fakhrul ]
TIL: If ldap/ldaps ports are blocked by firewall but gc port (3268) is accessible. In my case, kerberoasting with impacket can't be achieved. Simply switch ldap:// protocol to gc:// in impacket and win!
π₯ [ tweet ]
TIL: If ldap/ldaps ports are blocked by firewall but gc port (3268) is accessible. In my case, kerberoasting with impacket can't be achieved. Simply switch ldap:// protocol to gc:// in impacket and win!
π₯ [ tweet ]
This media is not supported in your browser
VIEW IN TELEGRAM
π [ citronneur, Sylvain Peyrefitte ]
Disable SSL certificate verification using #eBPF :
https://t.co/UBsT4TU43H
π https://github.com/citronneur/blindssl
π₯ [ tweet ]
Disable SSL certificate verification using #eBPF :
https://t.co/UBsT4TU43H
π https://github.com/citronneur/blindssl
π₯ [ tweet ]
π [ 0xdf_, 0xdf ]
Acute from @hackthebox_eu was just a hard pure Windows box. I'll pivot between two hosts largely relying on credentials and enumeration to get domain admin.
https://t.co/p0Fhgak2dI
π https://0xdf.gitlab.io/2022/07/16/htb-acute.html
π₯ [ tweet ]
Acute from @hackthebox_eu was just a hard pure Windows box. I'll pivot between two hosts largely relying on credentials and enumeration to get domain admin.
https://t.co/p0Fhgak2dI
π https://0xdf.gitlab.io/2022/07/16/htb-acute.html
π₯ [ tweet ]
π [ ippsec, ippsec ]
#HackTheBox Acute video is now up! This was a tough Windows box with all the pivots between users. I decided to try out ConPtyShell to get a full PTY on Windows, had to do some light modifications to bypass Defender. https://t.co/hey5QSjGDr
π https://youtu.be/jDYte7xNY1g
π₯ [ tweet ]
#HackTheBox Acute video is now up! This was a tough Windows box with all the pivots between users. I decided to try out ConPtyShell to get a full PTY on Windows, had to do some light modifications to bypass Defender. https://t.co/hey5QSjGDr
π https://youtu.be/jDYte7xNY1g
π₯ [ tweet ]
π [ HuskyHacksMK, Matt | HuskyHacks ]
πNew note is up on https://t.co/DIZF98zvlm
Threat emulation for Windows Installer (MSI) -> DLL malware. Learn how to make a malicious MSI like all the cool kids!
https://t.co/6vWFQckIWE
π http://notes.huskyhacks.dev
π https://notes.huskyhacks.dev/notes/ms-interloper-on-the-subject-of-malicious-msis
π₯ [ tweet ]
πNew note is up on https://t.co/DIZF98zvlm
Threat emulation for Windows Installer (MSI) -> DLL malware. Learn how to make a malicious MSI like all the cool kids!
https://t.co/6vWFQckIWE
π http://notes.huskyhacks.dev
π https://notes.huskyhacks.dev/notes/ms-interloper-on-the-subject-of-malicious-msis
π₯ [ tweet ]
π [ an0n_r0, an0n ]
may be obsolete, because impacket has already included this in its examples, but added Kerberos auth support for writing msDS-AllowedToActOnBehalfOfOtherIdentity property. https://t.co/UGjU3Rt357
π https://github.com/tothi/rbcd-attack
π₯ [ tweet ]
may be obsolete, because impacket has already included this in its examples, but added Kerberos auth support for writing msDS-AllowedToActOnBehalfOfOtherIdentity property. https://t.co/UGjU3Rt357
π https://github.com/tothi/rbcd-attack
π₯ [ tweet ]