😈 [ HuskyHacksMK, Matt | HuskyHacks ]

the user said it looked safe🤦‍♂️ New PMAT bonus binary sample is up!

Difficulty: 🟨(med)

Available here (the labs are free and always will be):

https://t.co/YvMIe2D0DR

https://t.co/H9OaPt1XtJ

🔗 https://github.com/HuskyHacks/PMAT-labs/tree/main/labs/X-X.BonusBinaries/Dropper.installer.msi.malz
🔗 https://github.com/HuskyHacks/PMAT-labs

🐥 [ tweet ]

😈 [ cry__pto, Ammar Amer🇸🇾 ]

AMSI Unchained: Review of Known AMSI Bypass Techniques and Introducing a New One
https://t.co/uGpsIOkplP

🔗 https://www.blackhat.com/asia-22/briefings/schedule/#amsi-unchained-review-of-known-amsi-bypass-techniques-and-introducing-a-new-one-26120

🐥 [ tweet ]

😈 [ _nwodtuhs, Charlie Bromberg (Shutdown) ]

So apparently Microsoft ninja-patched two things lately in KB5014692 (06/14/2022)
1. ShadowCoerce (auth coercion abusing MS-FSRVP)
2. Self-RBCD trick to bypass limitations of Kerberos Constrained Delegation without Protocol Transition
Identified this with @Geiseric4 and @mkolsek

🐥 [ tweet ]

😈 [ mpgn_x64, mpgn ]

CrackMapExec version 5.3.0 "OPERATION C01NS 🪙" is now public 🎉🎉🎉

Lot's of new features and fixed issues. All private features from the @porchetta_ind repo have been integrated to the public repository (rdp, audit mode, laps winrm etc)🚀

https://t.co/ozLmJNyUmn

🔗 https://github.com/Porchetta-Industries/CrackMapExec/releases/tag/v5.3.0
🔗 https://mpgn.gitbook.io/crackmapexec/news-2022/operation-c01ns

🐥 [ tweet ]

😈 [ EricaZelic, malCOM ]

New UAC bypass credited to @filip_dragovic
https://t.co/yVo7xnbWJj

🔗 https://github.com/Wh04m1001/IDiagnosticProfileUAC

🐥 [ tweet ]

😈 [ ShitSecure, S3cur3Th1sSh1t ]

Just added the two new AMSI bypass PoC's via Provider Patching into my Amsi-Bypass-Powershell repo. Plus one PoC in Nim as pull request for OffensiveNim:

https://t.co/CSqnqAuUaz

https://t.co/4W8RSPuzVG

Tested both, works perfectly fine. 👌

🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
🔗 https://github.com/byt3bl33d3r/OffensiveNim/pull/51

🐥 [ tweet ]

😈 [ mrd0x, mr.d0x ]

Nothing too crazy in this blog post, but thought it may be useful for some people. Enjoy!

Social engineering your way into the network.

https://t.co/uPVBiClrXc

🔗 https://mrd0x.com/social-engineering-your-way-into-the-network/

🐥 [ tweet ]

😈 [ ReconOne_, ReconOne ]

Easy trick: From Shodan to nuclei one liner 👇🔥

Credits: @pdnuclei, @PhilippeDelteil

#recontips #AttackSurface #shodan #bugbountytips #nuclei #recon

🐥 [ tweet ]

😈 [ M4yFly, Mayfly ]

GOAD v2 is out !
You can now test your AD commands and pentest skill on a multi-domain AD lab.
Have fun :)

https://t.co/Rpawi6FFl8
https://t.co/pKN8WwSDli

🔗 https://github.com/Orange-Cyberdefense/GOAD
🔗 https://mayfly277.github.io/posts/GOADv2/

🐥 [ tweet ]

😈 [ _nwodtuhs, Charlie Bromberg (Shutdown) ]

Did you know the WriteOwner ACE doesn't allow to change an object's owner arbitrarily? If userA has that privilege against userB, he can set userB's owner to itself, userA. That's it.
You'd need SeRestorePrivilege to set the owner to any other user.
Thanks @BlWasp_ for the info!

🔗 https://github.com/SecureAuthCorp/impacket/pull/1323

🐥 [ tweet ]

😈 [ tiraniddo, James Forshaw ]

Opened up one of my RCG bugs, you could use a Kerberos relay attack to authenticate as that user to an RDP server due to a lack of user checking in the ticket authentication process. https://t.co/MvGmjYa5sm

🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2268

🐥 [ tweet ]

😈 [ s4ntiago_p, S4ntiagoP ]

Ok, a few updates on nanodump:

1) implemented a cool new technique by @splinter_code where seclogon opens a handle to LSASS and then you duplicate it by winning a race condition using file locks
2) now you can call NtOpenProcess with a fake calling stack and produce fake telemetry, got it from @joehowwolf
https://t.co/nRVmSuZ9qP

🔗 https://github.com/helpsystems/nanodump/commit/c890da208511bacb09f91c68b935915821f4f0f0

🐥 [ tweet ]

😈 [ mariuszbit, mgeeky | Mariusz Banach ]

A single slide from my Malware Development training @x33fcon .
Suprising how widespread VBA actually is. 💀

☢️ Anyone fancy trying out VBA for:
- Terminal emulator serving critical systems,
- CAD projects of military equipment,
- SCADA consoles

https://t.co/8wRuj7ZGQc

🔗 https://www.x33fcon.com/#!t/maldev.md

🐥 [ tweet ]

😈 [ citronneur, Sylvain Peyrefitte ]

Pamspy is a credential dumper for Linux, that use #eBPF to hook libpam ! Enjoy !
https://t.co/PwsseTe4iJ

🔗 https://github.com/citronneur/pamspy

🐥 [ tweet ]

😈 [ C5pider, 5pider ]

How I send over data to my server. Nothing big. maybe someone finds this useful for something.
https://t.co/DGyT7Ws55J

🔗 https://gist.github.com/Cracked5pider/1857e292a9fec28cba88bed80d4e509d

🐥 [ tweet ]

😈 [ NinjaParanoid, Paranoid Ninja (Brute Ratel C4) ]

A thoroughly detailed blog on Brute Ratel C4 by Palo Alto. Proper Actions have been taken to against the found licenses which were sold in the Black Market. As for existing customers, #BRc4 v1.1 release will change every aspect of IOC found in the previous releases.

🔗 https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/

🐥 [ tweet ][ quote ]

😈 [ TomNomNom, TomNomNom ]

Need to grep stderr as well as stdout and can never quite get the 2>&1 incantation right on the first try? Try |& instead. E.g:

strace ls |& grep open

Instead of

strace ls 2>&1 | grep open

🐥 [ tweet ]

😈 [ tiraniddo, James Forshaw ]

Finally I can release details about my most serious RCG bug. RCE/EoP in LSASS via CredSSP. Reachable through RDP or WinRM if configured correctly. Will try and put together a blog about it at some point😁https://t.co/ujuMXRCxNT

🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2271

🐥 [ tweet ]