π [ NinjaParanoid, Paranoid Ninja (Brute Ratel C4) ]
Going forward Brute Ratel will focus only on evasions and Red Team and not the purple team counterpart. Anything that does not contribute to Red Team will be Open Sourced. The PowerShell loader which was used in BRc4 is now added here:
https://t.co/PLbYVX93X9
π https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit
π₯ [ tweet ]
Going forward Brute Ratel will focus only on evasions and Red Team and not the purple team counterpart. Anything that does not contribute to Red Team will be Open Sourced. The PowerShell loader which was used in BRc4 is now added here:
https://t.co/PLbYVX93X9
π https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit
π₯ [ tweet ]
Offensive Xwitter
π [ adamsvoboda, Adam Svoboda ] Want to dump LSASS but dealing with MDE/ATP and ASR rules? Learn how to extract a list of whitelisted exclusion paths from Defender's signature update files in this blog post: https://t.co/08Uo0UpQcm π https://adamsvoboda.net/extractingβ¦
π [ HackingLZ, Justin Elze ]
The original research has been out over a year now and flew under the radar. This might be useful for people wanting to look at Defender ASR rules/other things. All credit goes to others im just trying to get these semi structured https://t.co/c8J2rBDJKH
π https://github.com/HackingLZ/ExtractedDefender
π₯ [ tweet ]
The original research has been out over a year now and flew under the radar. This might be useful for people wanting to look at Defender ASR rules/other things. All credit goes to others im just trying to get these semi structured https://t.co/c8J2rBDJKH
π https://github.com/HackingLZ/ExtractedDefender
π₯ [ tweet ]
π [ SecurePeacock, Christopher Peacock π¦ ]
Pentests and adversary emulation are not the same...
π₯ [ tweet ]
Pentests and adversary emulation are not the same...
π₯ [ tweet ]
ΠΠΏΡΡΡ ΠΏΠ΅Π½ΡΠ΅ΡΡΠ΅ΡΠΎΠ² ΠΎΠ±ΠΈΠΆΠ°ΡΡβ¦π₯1π’1
π [ praetorianlabs, Praetorian ]
Praetorian has developed and is releasing an open source tool ADFSRelay and NTLMParse, which can be used for performing relaying attacks targeting ADFS and analyzing NTLM messages respectively.
https://t.co/Zzxb5cUDsa
π https://www.praetorian.com/blog/relaying-to-adfs-attacks/
π₯ [ tweet ]
Praetorian has developed and is releasing an open source tool ADFSRelay and NTLMParse, which can be used for performing relaying attacks targeting ADFS and analyzing NTLM messages respectively.
https://t.co/Zzxb5cUDsa
π https://www.praetorian.com/blog/relaying-to-adfs-attacks/
π₯ [ tweet ]
π₯1
π [ s4ntiago_p, S4ntiagoP ]
New update to nanodump!
You can now force WerFault.exe to dump LSASS for you. Thanks to @asaf_gilboa for the original research.
https://t.co/R2lVXtd3uX
π https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507
π₯ [ tweet ]
New update to nanodump!
You can now force WerFault.exe to dump LSASS for you. Thanks to @asaf_gilboa for the original research.
https://t.co/R2lVXtd3uX
π https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507
π₯ [ tweet ]
π [ praetorianlabs, Praetorian ]
For the last 48 hours, our red teams have been leveraging the new dfscoerce security flaw to achieve domain admin with wild success. Here are some tips on detecting the activity
https://t.co/awSFENDvpO
#dfscoerce
π https://www.praetorian.com/blog/how-to-detect-dfscoerce/
π₯ [ tweet ]
For the last 48 hours, our red teams have been leveraging the new dfscoerce security flaw to achieve domain admin with wild success. Here are some tips on detecting the activity
https://t.co/awSFENDvpO
#dfscoerce
π https://www.praetorian.com/blog/how-to-detect-dfscoerce/
π₯ [ tweet ]
π [ s4ntiago_p, S4ntiagoP ]
New update to nanodump!
You can now force WerFault.exe to dump LSASS for you. Thanks to @asaf_gilboa for the original research.
https://t.co/R2lVXtd3uX
π https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507
π₯ [ tweet ]
New update to nanodump!
You can now force WerFault.exe to dump LSASS for you. Thanks to @asaf_gilboa for the original research.
https://t.co/R2lVXtd3uX
π https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507
π₯ [ tweet ]
π [ DirectoryRanger, DirectoryRanger ]
Offensive Windows IPC Internals, by @0xcsandker
Part 1: Named Pipes https://t.co/Ug3gPKHrza
Part 2: RPC https://t.co/cfgY8eaOVa
Part 3: ALPC https://t.co/avXPjh8d6W
π https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html
π https://csandker.io/2021/02/21/Offensive-Windows-IPC-2-RPC.html
π https://csandker.io/2022/05/24/Offensive-Windows-IPC-3-ALPC.html
π₯ [ tweet ]
Offensive Windows IPC Internals, by @0xcsandker
Part 1: Named Pipes https://t.co/Ug3gPKHrza
Part 2: RPC https://t.co/cfgY8eaOVa
Part 3: ALPC https://t.co/avXPjh8d6W
π https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html
π https://csandker.io/2021/02/21/Offensive-Windows-IPC-2-RPC.html
π https://csandker.io/2022/05/24/Offensive-Windows-IPC-3-ALPC.html
π₯ [ tweet ]
π [ DirectoryRanger, DirectoryRanger ]
SharpWSUS. CSharp tool for lateral movement through WSUS
https://t.co/0hDHe6ePZs
π https://github.com/nettitude/SharpWSUS
π₯ [ tweet ]
SharpWSUS. CSharp tool for lateral movement through WSUS
https://t.co/0hDHe6ePZs
π https://github.com/nettitude/SharpWSUS
π₯ [ tweet ]
π [ clearbluejar, clearbluejar ]
Cheers to @itm4n for inspiration, @topotam77 for PetitPotam, and @tiraniddo for NtObjectManager.
New post detailing #RPC auditing with NtObjectManager
https://t.co/7brWus4LoV
π https://clearbluejar.github.io/posts/from-ntobjectmanager-to-petitpotam/
π₯ [ tweet ]
Cheers to @itm4n for inspiration, @topotam77 for PetitPotam, and @tiraniddo for NtObjectManager.
New post detailing #RPC auditing with NtObjectManager
https://t.co/7brWus4LoV
π https://clearbluejar.github.io/posts/from-ntobjectmanager-to-petitpotam/
π₯ [ tweet ]
π [ vxunderground, vx-underground ]
We've update the VXUG Windows Malware paper collection
-Studying Next Generation Malware: NightHawks attempt as Sleep obfuscation
-About: Remote Library Injection
-KCTHIJACK - KernelCallbackTableInjection
-Sleep Obfuscation: Ekko
-Gargoyle x64: DeepSleep
https://t.co/cLyIwMexhc
π https://www.vx-underground.org/windows.html
π₯ [ tweet ]
We've update the VXUG Windows Malware paper collection
-Studying Next Generation Malware: NightHawks attempt as Sleep obfuscation
-About: Remote Library Injection
-KCTHIJACK - KernelCallbackTableInjection
-Sleep Obfuscation: Ekko
-Gargoyle x64: DeepSleep
https://t.co/cLyIwMexhc
π https://www.vx-underground.org/windows.html
π₯ [ tweet ]
π [ jsecurity101, Jonny Johnson ]
See a scheduled task using <ComHandler> in the actions tag where the principal is SYSTEM but can't modify the CLSID in HKLM?
Impersonate TrustedInstaller, change the registry value to point to your DLL and send it.
π₯ [ tweet ]
See a scheduled task using <ComHandler> in the actions tag where the principal is SYSTEM but can't modify the CLSID in HKLM?
Impersonate TrustedInstaller, change the registry value to point to your DLL and send it.
π₯ [ tweet ]
π [ BushidoToken, Will ]
π»The feeling all IT workers dread: "After spending Tuesday evening drinking at a restaurant, he realised on his way home that the bag containing the drive was missing". cc @TheBeerFarmers
https://t.co/YJBHalD6L0
π https://www.theguardian.com/world/2022/jun/24/japanese-city-worker-loses-usb-containing-personal-details-of-every-resident
π₯ [ tweet ]
π»The feeling all IT workers dread: "After spending Tuesday evening drinking at a restaurant, he realised on his way home that the bag containing the drive was missing". cc @TheBeerFarmers
https://t.co/YJBHalD6L0
π https://www.theguardian.com/world/2022/jun/24/japanese-city-worker-loses-usb-containing-personal-details-of-every-resident
π₯ [ tweet ]
π [ 0gtweet, Grzegorz Tworek ]
Want to disable the Security Event Log? Almost two years after my original research I finally had a moment to wrap it into a short video. Enjoy :) https://t.co/WnazgfXcPK
π https://youtu.be/Wx7gIO71HBg
π₯ [ tweet ][ quote ]
Want to disable the Security Event Log? Almost two years after my original research I finally had a moment to wrap it into a short video. Enjoy :) https://t.co/WnazgfXcPK
π https://youtu.be/Wx7gIO71HBg
π₯ [ tweet ][ quote ]
π [ _Wra7h, Christian W ]
Add shellcode as a bitmap to the .rsrc section using UpdateResource before spawning as suspended. Parse the header down to the sections, skip past the bitmap shenannigans and then you get your shellcode address.
https://t.co/AoZV4CINip
π https://github.com/Wra7h/PEResourceInject
π₯ [ tweet ]
Add shellcode as a bitmap to the .rsrc section using UpdateResource before spawning as suspended. Parse the header down to the sections, skip past the bitmap shenannigans and then you get your shellcode address.
https://t.co/AoZV4CINip
π https://github.com/Wra7h/PEResourceInject
π₯ [ tweet ]
π [ eloypgz, Eloy ]
I've playing with AWS security, and found the resources/perms enumeration tools quite limited, so developed https://t.co/D0QLCgTsvu with service filtering and recursion (e.g, automatically check S3 buckets you have access). It is still incomplete, but hope you find it useful.
π https://github.com/zer1t0/awsenum
π₯ [ tweet ]
I've playing with AWS security, and found the resources/perms enumeration tools quite limited, so developed https://t.co/D0QLCgTsvu with service filtering and recursion (e.g, automatically check S3 buckets you have access). It is still incomplete, but hope you find it useful.
π https://github.com/zer1t0/awsenum
π₯ [ tweet ]
π₯1
π [ 0xdf_, 0xdf ]
Phoenix from @hackthebox_eu involved working around a really slow SQL injection. I'll do some reverse engineering of a WordPress plugin to figure out just the data I need. There's also compiled shell scripts, pam modules config, and wildcard injection.
https://t.co/oAU8XOof2I
π https://0xdf.gitlab.io/2022/06/25/htb-phoenix.html
π₯ [ tweet ]
Phoenix from @hackthebox_eu involved working around a really slow SQL injection. I'll do some reverse engineering of a WordPress plugin to figure out just the data I need. There's also compiled shell scripts, pam modules config, and wildcard injection.
https://t.co/oAU8XOof2I
π https://0xdf.gitlab.io/2022/06/25/htb-phoenix.html
π₯ [ tweet ]
π [ mariuszbit, Mariusz Banach ]
β’οΈ I'm so excited - just issued my first blog postβ’οΈ
As promised - sharing my @WarConPL slides deck on:
https://t.co/mynQW0aXsF
Power of positive feedback made me publish them during my first day of holidays (β'β‘'β)
Let me know if you like it π₯
π https://mgeeky.tech/warcon-2022-modern-initial-access-and-evasion-tactics/
π₯ [ tweet ]
β’οΈ I'm so excited - just issued my first blog postβ’οΈ
As promised - sharing my @WarConPL slides deck on:
https://t.co/mynQW0aXsF
Power of positive feedback made me publish them during my first day of holidays (β'β‘'β)
Let me know if you like it π₯
π https://mgeeky.tech/warcon-2022-modern-initial-access-and-evasion-tactics/
π₯ [ tweet ]
π1
π [ NorthwaveLabs, Northwave Labs. ]
Cobalt Strike BOF foundation for kernel exploitation using CVE-2021-21551. In its current state, as a PoC, it overwrites the beacon token with the system token (privesc).
https://t.co/JR1Vao7t9c
π https://github.com/NorthwaveSecurity/kernel-mii
π₯ [ tweet ]
Cobalt Strike BOF foundation for kernel exploitation using CVE-2021-21551. In its current state, as a PoC, it overwrites the beacon token with the system token (privesc).
https://t.co/JR1Vao7t9c
π https://github.com/NorthwaveSecurity/kernel-mii
π₯ [ tweet ]