Ralf Hacker Channel

Еще одна картошка)) Абузит RPCSS в DCOM при обработке OXID

https://github.com/lypd0/DeadPotato

#lpe #potato #ad #pentest #redteam

13.7K viewsRalf Hacker, 10:28

Ralf Hacker Channel

А это прикольно. Можно получать креды на 445 порту (или релеить) без загрузки драйверов или либ в LSASS😁 есть python версия, и есть BOF...

Статья: https://posts.specterops.io/relay-your-heart-away-an-opsec-conscious-approach-to-445-takeover-1c9b4666c8ac

Софт: https://github.com/zyn3rgy/smbtakeover

#pentest #redteam

Medium

Relay Your Heart Away: An OPSEC-Conscious Approach to 445 Takeover

Even within organizations that have achieved a mature security posture, targeted NTLM relay attacks are still incredibly effective after…

14.9K viewsRalf Hacker, edited 17:22

Ralf Hacker Channel

FakePotato зарегестрировано как CVE-2024-38100. Опять DCOM для обхода контекста безопасности...

https://decoder.cloud/2024/08/02/the-fake-potato/

Помечено как "Important LPE", но запатчено в июле... MS такой MS 😅😂

#pentest #redteam #lpe #ad

Decoder's Blog

The “Fake” Potato

While exploring the DCOM objects for the “SilverPotato” abuse, I stumbled upon the “ShellWindows” DCOM application. This, along with “ShellBrowserWindows”, is we…

14.4K viewsRalf Hacker, 17:54

Ralf Hacker Channel

FakePotato зарегестрировано как CVE-2024-38100. Опять DCOM для обхода контекста безопасности... https://decoder.cloud/2024/08/02/the-fake-potato/ Помечено как "Important LPE", но запатчено в июле... MS такой MS 😅😂 #pentest #redteam #lpe #ad

https://youtu.be/InyrqNeaZfQ?si=TZ-qzgB56XWnPD-E

Инструмент позволяет получить NetNTLM-хеши ЛЮБОГО пользователя, чья сессия присутствует на хосте.

Требования по правам: любые.

Софт: https://github.com/MzHmO/LeakedWallpaper

Способ до установки июньского фикса KB5040434 будет работать безотказно.

@Michaelzhm, молодец)

#lateral #pentest #ad #redteam

YouTube

LeakedWallpaper demo

15.5K viewsRalf Hacker, 19:09

Ralf Hacker Channel

CVE-2024-38077: Windows Remote Desktop Licensing Service RCE

https://github.com/CloudCrowSec001/CVE-2024-38077-POC

Запатчено 9 июля

#exploit #ad #rce #pentest #redteam

14.0K viewsRalf Hacker, 06:15

Ralf Hacker Channel

Много чего про SCCM в последнее время появляется, вот еще:

Soft: https://github.com/synacktiv/SCCMSecrets

Blog: https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial

#pentest #redteam #ad #sccm #lateral #creds

GitHub

GitHub - synacktiv/SCCMSecrets: SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial…

SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement. - synacktiv/SCCMSecrets

13.8K viewsRalf Hacker, 06:14

Ralf Hacker Channel

Cobalt Strike - CDN & Reverse Proxy Setup. Подробно описанный мануал по подготовке C2 инфраструктуры CS на примере Azure.

https://redops.at/en/blog/cobalt-strike-cdn-reverse-proxy-setup

#redteam #infra #bypass

15.7K viewsRalf Hacker, 06:50

Ralf Hacker Channel

Bypass LSA protection using the BYODLL technique

https://github.com/itm4n/PPLrevenant

#pentest #redteam #bypass

GitHub

GitHub - itm4n/PPLrevenant: Bypass LSA protection using the BYODLL technique

Bypass LSA protection using the BYODLL technique. Contribute to itm4n/PPLrevenant development by creating an account on GitHub.

16.0K viewsRalf Hacker, 06:48

Ralf Hacker Channel

CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177: Linux OpenPrinting CUPS RCE

blog: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

PoC: https://github.com/RickdeJager/cupshax

patch:

sudo systemctl stop cups-browsed
sudo systemctl disable cups-browsed

#exploit #git #pentest #redteam

evilsocket

Attacking UNIX Systems via CUPS, Part I

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Linux systems with an RCE. As someone who’s

14.3K viewsRalf Hacker, 10:56

Ralf Hacker Channel

Please open Telegram to view this post

VIEW IN TELEGRAM

14.3K viewsRalf Hacker, 12:12

Ralf Hacker Channel

Забыл написать, тут же ESC15 появился))

https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc

Для поиска в BloodHound CE:

MATCH p=(:Base)-[:Enroll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(:Domain)
WHERE ct.enrolleesuppliessubject = True
AND ct.authenticationenabled = False AND ct.requiresmanagerapproval = False
AND ct.schemaversion = 1
RETURN p

И заодно нашел скрипт для патча:
https://github.com/JonasBK/Powershell/blob/master/Remediate-ESC15.ps1

#pentest #redteam #adcs

TrustedSec

EKUwu: Not just another AD CS ESC

11.8K viewsRalf Hacker, 05:47

Ralf Hacker Channel

Так, новая техника инъекции в процессы - Early Cascade Injection.

Ну и ресерч достаточно подробный)

https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/

#redteam #maldev #bypass

Outflank

Introducting Early Cascade Injection | Outflank Blog

Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.

11.4K viewsRalf Hacker, 21:36

Ralf Hacker Channel

Питонячий скрипт для работы с реестром через WMI StdRegProv

https://github.com/0xthirteen/reg_snake

#evasion #pentest #redteam #lateral