😈 [ M4yFly, Mayfly ]

Let's play with the ad lab, goadv2:
https://t.co/zvysxTYQlq
https://t.co/xdd4UD44TN
https://t.co/NTvxzojcAv

🔗 https://mayfly277.github.io/posts/GOADv2-pwning_part1/
🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part2/
🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part3/

🐥 [ tweet ]

😈 [ mpgn_x64, mpgn ]

Dumping SAM from a live Kali Linux in 2022 🔽

1⃣ cd Windows/System32/config
2⃣ pypykatz registry --sam SAM SYSTEM

Tools like chntpw, bkhive, pwdump, samdump2 are not working on latest Windows 10 👀

https://t.co/LyHlBnvcCX

🔗 https://security.stackexchange.com/a/158174/41351

🐥 [ tweet ]

😈 [ _mohemiv, Arseniy Sharoglazov ]

🧨 Be aware, dnSpy .NET Debugger / Assembly Editor has been trojaned again!

In Google's TOP 2, there was a malicious site maintained by threat actors, who also distributed infected CPU-Z, Notepad++, MinGW, and many more.

🎯 Thanks to NameSilo, the domain has been deactivated!

🐥 [ tweet ]

😈 [ 0xdeaddood, leandro ]

Just merged to Impacket the [MS-TSTS] Terminal Services Terminal Server Runtime Interface Protocol implementation 🚀🔥

The PR also includes a new tool that allows you to run qwinsta, tasklist, taskkill, and more commands remotely!

Thanks @nopernik🎉
https://t.co/uZgHTChSPe

🔗 https://github.com/SecureAuthCorp/impacket/pull/1327

🐥 [ tweet ]

😈 [ ippsec, ippsec ]

HackTheBox RouterSpace video is now up, the tough thing with this box was getting an Android VM up and running to test the APK File. I'm always amazed at how much trouble I have with the normal Android SDK Manager, thankful for Genymotion here. https://t.co/LQ1UP6k9F3

🔗 https://youtu.be/bilgniEPOfs

🐥 [ tweet ]

😈 [ DirectoryRanger, DirectoryRanger ]

Implementing Global Injection and Hooking in Windows, by @m417z
https://t.co/ayx9cFZPdp

🔗 https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/

🐥 [ tweet ]

😈 [ DirectoryRanger, DirectoryRanger ]

Good series on AD sec by @Bhaskarpal__
(1) https://t.co/LT3oD9bqDU
(2) https://t.co/CCkeWe3Nuy
(3) https://t.co/B4egj79cUg
(4) https://t.co/zN0GkXlZfS
(5) https://t.co/kgKlIxla0I

🔗 https://0xstarlight.github.io/posts/Active-Directory-Introduction/
🔗 https://0xstarlight.github.io/posts/Offensive-PowerShell/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Local-Privilege-Escalation/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Lateral-Movement/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Domain-Persistence/

🐥 [ tweet ]

😈 [ ghostlulz1337, ghostlulz ]

Cool blog on abusing callback functions to execute shellcode. There are so many windows APIs that can be leveraged to execute your shellcode. Really cool stuff!

https://t.co/D1WJT80ehW

#redteam #infosec

🔗 http://ropgadget.com/posts/abusing_win_functions.html

🐥 [ tweet ]

😈 [ al3x_m3rcer, m3rcer ]

Here's the official release of Chisel-Strike: A .NET XOR encrypted Cobalt Strike Aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.

https://t.co/1wlwABP71E

#RedTeaming #CobaltStrike #Pentesting

🔗 https://github.com/m3rcer/Chisel-Strike

🐥 [ tweet ]

😈 [ C5pider, 5pider ]

Perform HTTP/s requests using WinHTTP and optional get response.
https://t.co/HAwhep2Pyv

🔗 https://gist.github.com/Cracked5pider/4f784ad7405eeda45a13a2b2638b85ec

🐥 [ tweet ]

😈 [ _dirkjan, Dirk-jan ]

New blog: "Abusing forgotten permissions on computer objects in Active Directory".
The post is a dive into permissions that are set when you pre-create computer accounts the wrong way, why BloodHound missed those and how to abuse, fix, or monitor for this. https://t.co/T8WmiIoL53

🔗 https://dirkjanm.io/abusing-forgotten-permissions-on-precreated-computer-objects-in-active-directory/

🐥 [ tweet ]

😈 [ m3g9tr0n, Spiros Fraganastasis ]

P2P Remote Desktop - Portable, No Configuration or Installation Needed https://t.co/taaggUyfC0

🔗 https://github.com/miroslavpejic85/p2p

🐥 [ tweet ]

😈 [ m3g9tr0n, Spiros Fraganastasis ]

tokenduplicator: can also be used to access disconnected sessions, without knowing the password of the victim user https://t.co/VMeIQdwMdg

🔗 https://github.com/magnusstubman/tokenduplicator

🐥 [ tweet ]

😈 [ M4yFly, Mayfly ]

GOAD pwning part4 - poison and relay
https://t.co/g4seCCWrif

🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part4/

🐥 [ tweet ]

😈 [ mikeloss, l0ss ]

Hey kids, you ever wanted to use Snaffler or Group3r via inlineExecuteAssembly or whatever, but couldn't because it used Environment.Exit() and that would kill your beacon? Well, I fixed that, so now it's not a problem any more. https://t.co/Ts8WFVojcY and https://t.co/QePyTfNcbm

🔗 http://github.com/SnaffCon/Snaffler
🔗 http://github.com/Group3r/Group3r

🐥 [ tweet ]

😈 [ 0gtweet, Grzegorz Tworek ]

As a fan of non-obvious persistence mechanisms I had to try to collect (and categorize!) them all. It has just started, first 10 entries appeared, and more is coming each day.
I am happy to share it. Enjoy, contribute, use freely - https://t.co/PWb2ofSZjQ

🔗 https://persistence-info.github.io/

🐥 [ tweet ]

😈 [ SkelSec, SkelSec ]

YOU👏DON'T👏NEED👏A👏REDTEAM👏
The security consultants identified that the domain controller XXX uses an outdated Apache server running as “NT/SYSTEM” which uses the default “cgi-bin” folder to host the application logic. This folder was found to be writable by any domain user..

🐥 [ tweet ]

😈 [ podalirius_, Podalirius ]

Want to play around with @Microsoft #RPC? I'm releasing a few #tools that I use in my lab 👌

Today I'm releasing a tool that lists all open #SMB #pipes remotely in live mode. With this you can easily see which pipes will open when starting services. 🥳

https://t.co/PWNQFkGDag

🔗 https://github.com/p0dalirius/microsoft-rpc-fuzzing-tools

🐥 [ tweet ]

😈 [ mariuszbit, mgeeky | Mariusz Banach ]

- "... and then he said to sign my malware.exe with faked Microsoft cert to evade AVs/EDRs. Would you believe?"

(￣y▽￣)╭ Ohohoho.....

Sign-Artifact.ps1 - based on @mattifestation research & implementation shamelessly borrowed here:

https://t.co/6LAVgCrOVN

🔗 https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/red-teaming/Self-Signed%20Threat

🐥 [ tweet ]

😈 [ an0n_r0, an0n ]

another episode of my Sliver C2 testing. off-the-shelf bypass techniques like the unhook-bof in the official Armory seems to be useful and performs well against some modern EDR/AV products. seems like it is less painful than with Cobalt Strike. :)

🐥 [ tweet ]