😈 [ praetorianlabs, Praetorian ]

Praetorian has developed and is releasing an open source tool ADFSRelay and NTLMParse, which can be used for performing relaying attacks targeting ADFS and analyzing NTLM messages respectively.

https://t.co/Zzxb5cUDsa

🔗 https://www.praetorian.com/blog/relaying-to-adfs-attacks/

🐥 [ tweet ]

😈 [ s4ntiago_p, S4ntiagoP ]

New update to nanodump!

You can now force WerFault.exe to dump LSASS for you. Thanks to @asaf_gilboa for the original research.

https://t.co/R2lVXtd3uX

🔗 https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507

🐥 [ tweet ]

😈 [ praetorianlabs, Praetorian ]

For the last 48 hours, our red teams have been leveraging the new dfscoerce security flaw to achieve domain admin with wild success. Here are some tips on detecting the activity

https://t.co/awSFENDvpO

#dfscoerce

🔗 https://www.praetorian.com/blog/how-to-detect-dfscoerce/

🐥 [ tweet ]

😈 [ s4ntiago_p, S4ntiagoP ]

New update to nanodump!

You can now force WerFault.exe to dump LSASS for you. Thanks to @asaf_gilboa for the original research.

https://t.co/R2lVXtd3uX

🔗 https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507

🐥 [ tweet ]

😈 [ DirectoryRanger, DirectoryRanger ]

Offensive Windows IPC Internals, by @0xcsandker
Part 1: Named Pipes https://t.co/Ug3gPKHrza
Part 2: RPC https://t.co/cfgY8eaOVa
Part 3: ALPC https://t.co/avXPjh8d6W

🔗 https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html
🔗 https://csandker.io/2021/02/21/Offensive-Windows-IPC-2-RPC.html
🔗 https://csandker.io/2022/05/24/Offensive-Windows-IPC-3-ALPC.html

🐥 [ tweet ]

😈 [ DirectoryRanger, DirectoryRanger ]

SharpWSUS. CSharp tool for lateral movement through WSUS
https://t.co/0hDHe6ePZs

🔗 https://github.com/nettitude/SharpWSUS

🐥 [ tweet ]

😈 [ clearbluejar, clearbluejar ]

Cheers to @itm4n for inspiration, @topotam77 for PetitPotam, and @tiraniddo for NtObjectManager.

New post detailing #RPC auditing with NtObjectManager

https://t.co/7brWus4LoV

🔗 https://clearbluejar.github.io/posts/from-ntobjectmanager-to-petitpotam/

🐥 [ tweet ]

😈 [ vxunderground, vx-underground ]

We've update the VXUG Windows Malware paper collection

-Studying Next Generation Malware: NightHawks attempt as Sleep obfuscation
-About: Remote Library Injection
-KCTHIJACK - KernelCallbackTableInjection
-Sleep Obfuscation: Ekko
-Gargoyle x64: DeepSleep

https://t.co/cLyIwMexhc

🔗 https://www.vx-underground.org/windows.html

🐥 [ tweet ]

😈 [ jsecurity101, Jonny Johnson ]

See a scheduled task using <ComHandler> in the actions tag where the principal is SYSTEM but can't modify the CLSID in HKLM?

Impersonate TrustedInstaller, change the registry value to point to your DLL and send it.

🐥 [ tweet ]

😈 [ BushidoToken, Will ]

🍻The feeling all IT workers dread: "After spending Tuesday evening drinking at a restaurant, he realised on his way home that the bag containing the drive was missing". cc @TheBeerFarmers
https://t.co/YJBHalD6L0

🔗 https://www.theguardian.com/world/2022/jun/24/japanese-city-worker-loses-usb-containing-personal-details-of-every-resident

🐥 [ tweet ]

😈 [ 0gtweet, Grzegorz Tworek ]

Want to disable the Security Event Log? Almost two years after my original research I finally had a moment to wrap it into a short video. Enjoy :) https://t.co/WnazgfXcPK

🔗 https://youtu.be/Wx7gIO71HBg

🐥 [ tweet ][ quote ]

😈 [ _Wra7h, Christian W ]

Add shellcode as a bitmap to the .rsrc section using UpdateResource before spawning as suspended. Parse the header down to the sections, skip past the bitmap shenannigans and then you get your shellcode address.

https://t.co/AoZV4CINip

🔗 https://github.com/Wra7h/PEResourceInject

🐥 [ tweet ]

😈 [ eloypgz, Eloy ]

I've playing with AWS security, and found the resources/perms enumeration tools quite limited, so developed https://t.co/D0QLCgTsvu with service filtering and recursion (e.g, automatically check S3 buckets you have access). It is still incomplete, but hope you find it useful.

🔗 https://github.com/zer1t0/awsenum

🐥 [ tweet ]

😈 [ 0xdf_, 0xdf ]

Phoenix from @hackthebox_eu involved working around a really slow SQL injection. I'll do some reverse engineering of a WordPress plugin to figure out just the data I need. There's also compiled shell scripts, pam modules config, and wildcard injection.

https://t.co/oAU8XOof2I

🔗 https://0xdf.gitlab.io/2022/06/25/htb-phoenix.html

🐥 [ tweet ]

😈 [ mariuszbit, Mariusz Banach ]

☢️ I'm so excited - just issued my first blog post☢️
As promised - sharing my @WarConPL slides deck on:

https://t.co/mynQW0aXsF

Power of positive feedback made me publish them during my first day of holidays (●'◡'●)

Let me know if you like it 🔥

🔗 https://mgeeky.tech/warcon-2022-modern-initial-access-and-evasion-tactics/

🐥 [ tweet ]

😈 [ NorthwaveLabs, Northwave Labs. ]

Cobalt Strike BOF foundation for kernel exploitation using CVE-2021-21551. In its current state, as a PoC, it overwrites the beacon token with the system token (privesc).

https://t.co/JR1Vao7t9c

🔗 https://github.com/NorthwaveSecurity/kernel-mii

🐥 [ tweet ]

😈 [ theluemmel, S4U2LuemmelSec ]

Oh holy Nimikätz / custom invoke-mimikatz
If you want the l33t shit for your next engagement you should:
Read -> https://t.co/ZCP5OP1M9e
Read -> https://t.co/8ulbUEyZJY
Use -> https://t.co/WNRJrDGGIz from @danielhbohannon
Use -> private tools from @ShitSecure by sponsoring him

🔗 https://s3cur3th1ssh1t.github.io/Bypass-AMSI-by-manual-modification-part-II/
🔗 https://s3cur3th1ssh1t.github.io/Building-a-custom-Mimikatz-binary/
🔗 https://github.com/danielbohannon/Invoke-Obfuscation

🐥 [ tweet ]

😈 [ mcohmi, Ohm-I (Oh My) ]

New tool drop. Introducing Dumpscan, a wrapper around volatility3 and some other stuff to make dumping certificates way easier. You can read about it here.

https://t.co/CAK4Y2QSJm

🔗 https://daddycocoaman.dev/posts/introducing-dumpscan/
🔗 https://github.com/daddycocoaman/dumpscan

🐥 [ tweet ]