Если есть привилегия SeTcbPrivilege (а локальный админ может ее активировать), то можно запросить TGS билет для любого авторизованного в системе пользователя без указания его пароля. Интересный сценарий...
https://github.com/foxlox/GIUDA
https://github.com/MzHmO/TGSThief
#ad #pentest #redteam #soft #git
https://github.com/foxlox/GIUDA
https://github.com/MzHmO/TGSThief
#ad #pentest #redteam #soft #git
GitHub
GitHub - foxlox/GIUDA: Ask a TGS on behalf of another user without password
Ask a TGS on behalf of another user without password - foxlox/GIUDA
👍21🔥7😱5
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
🔨KRBUACBypass
By adding a
Research:
https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html
Source:
https://github.com/wh0amitz/KRBUACBypass
#ad #kerberos #uac #bypass
By adding a
KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges.Research:
https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html
Source:
https://github.com/wh0amitz/KRBUACBypass
#ad #kerberos #uac #bypass
🔥20👍6
Escalate Service Account To LocalSystem via Kerberos.
https://github.com/wh0amitz/S4UTomato
#privesc #ad #redteam #pentest
https://github.com/wh0amitz/S4UTomato
#privesc #ad #redteam #pentest
GitHub
GitHub - wh0amitz/S4UTomato: Escalate Service Account To LocalSystem via Kerberos
Escalate Service Account To LocalSystem via Kerberos - wh0amitz/S4UTomato
👍19🔥6🥰1
Пока тут тихо, кину Твиттер) Информация не дублируется, там много интересного...
https://twitter.com/hacker_ralf
P. S. А то ощущение, что почти одна АПТа подписывается😁
https://twitter.com/hacker_ralf
P. S. А то ощущение, что почти одна АПТа подписывается😁
😁43👍9
This media is not supported in your browser
VIEW IN TELEGRAM
SCCM AdminService API уязвим к релей атакам🙈 Интересненько...
https://posts.specterops.io/site-takeover-via-sccms-adminservice-api-d932e22b2bf
#ad #redteam #pentest #sccm #relay
https://posts.specterops.io/site-takeover-via-sccms-adminservice-api-d932e22b2bf
#ad #redteam #pentest #sccm #relay
🔥32👍3
Доклады с Black Hat USA 2023
https://github.com/onhexgroup/Conferences/tree/main/Black%20Hat%20USA%202023%20slides
#git #notes #pentest
https://github.com/onhexgroup/Conferences/tree/main/Black%20Hat%20USA%202023%20slides
#git #notes #pentest
GitHub
Conferences/Black Hat USA 2023 slides at main · onhexgroup/Conferences
Conference presentation slides. Contribute to onhexgroup/Conferences development by creating an account on GitHub.
👍27🔥14🎉5
Forwarded from Pwn3rzs
acunetix_23.7_windows-pwn3rzs+cyberarsenal.7z
219.7 MB
added another check in bat file for admin rights (sigh)
🔥25👍3
Спасибо всем, кого встретил и с кем пообщались на offzone))
🥰19👍7😁5🎉1
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
⚛️ Nuclei Templates AI Generator
Nuclei Template Editor - AI-powered hub to create, debug, scan, and store templates. Covering a wide array of vulnerabilities using public templates & rich CVE data.
📝 Note:
Current focus is HTTP, more protocols coming soon
🌐 Source:
https://templates.nuclei.sh
https://docs.nuclei.sh/editor
#nuclei #template #generator
Nuclei Template Editor - AI-powered hub to create, debug, scan, and store templates. Covering a wide array of vulnerabilities using public templates & rich CVE data.
📝 Note:
Current focus is HTTP, more protocols coming soon
🌐 Source:
https://templates.nuclei.sh
https://docs.nuclei.sh/editor
#nuclei #template #generator
🔥23👍5🎉1
Довольно интересна и свежая серия статей, в частности по AD и чуть-чуть туннелям
1. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform
2. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2
3. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3
#ad #pentest #redteam #lofl
1. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform
2. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2
3. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3
#ad #pentest #redteam #lofl
👍17🔥6
Ну вот и дождались... Теперь в Excel доступен python🫣
https://techcommunity.microsoft.com/t5/microsoft-365-blog/introducing-python-in-excel-the-best-of-both-worlds-for-data/ba-p/3905482
P.S. Майкрософт: макросы - это опасно, а python - норм😅
#pentest #redteam #blueteam #fishing
https://techcommunity.microsoft.com/t5/microsoft-365-blog/introducing-python-in-excel-the-best-of-both-worlds-for-data/ba-p/3905482
P.S. Майкрософт: макросы - это опасно, а python - норм😅
#pentest #redteam #blueteam #fishing
TECHCOMMUNITY.MICROSOFT.COM
Introducing Python in Excel: The Best of Both Worlds for Data Analysis and Visualization | Microsoft Community Hub
Today, we are excited to introduce the Public Preview of Python in Excel – making it possible to integrate Python...
🔥32😁21👍8😱6
Прикольный скрипт (PyQt) для проверки, эксплуатации и постэксплуатации VMWare vCenter
https://github.com/W01fh4cker/VcenterKit
#git #vmware #pentest #soft
https://github.com/W01fh4cker/VcenterKit
#git #vmware #pentest #soft
👍24
Хорошая статья от MDSec, как они "редтимили" разработчиков. Наиболее интересный момент - это разработка и публикация вредоносного расширения VSCode для фишинга и получения первоначального доступа.
https://www.mdsec.co.uk/2023/08/leveraging-vscode-extensions-for-initial-access/
#redteam #pentest #pishing #initial
https://www.mdsec.co.uk/2023/08/leveraging-vscode-extensions-for-initial-access/
#redteam #pentest #pishing #initial
MDSec
Leveraging VSCode Extensions for Initial Access - MDSec
Introduction On a recent red team engagement, MDSec were tasked with crafting a phishing campaign for initial access. The catch was that the in-scope phishing targets were developers with technical...
🔥16👍8
Вот смотрю ещё один свежий материал по фишингу от TrustedSec. Главная идея: с помощью HTML инъекции отправить сообщение с доверенного домена.
https://www.trustedsec.com/blog/crafting-emails-with-html-injection
Т.е. это двойной фишинг получается?! Сложно пока, но интересно...
#pentest #redteam #fishing
https://www.trustedsec.com/blog/crafting-emails-with-html-injection
Т.е. это двойной фишинг получается?! Сложно пока, но интересно...
#pentest #redteam #fishing
TrustedSec
Crafting Emails with HTML Injection
Crafting emails with HTML injection vulnerabilities allows attackers to alter the email body, potentially revealing sensitive information or executing…
👍17🔥2
Про NetNTLMv1 downgrade & relay в 2023 году
https://www.r-tec.net/r-tec-blog-netntlmv1-downgrade-to-compromise.html
#pentest #redteam #relay #creds
https://www.r-tec.net/r-tec-blog-netntlmv1-downgrade-to-compromise.html
#pentest #redteam #relay #creds
www.r-tec.net
NetNTLMv1 Downgrade to compromise
Easy to understand NetNTLMv1 downgrade, relaying stuff and further resources for those who want to get the bigger picture at the end of this post.
👍9🔥7
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
🔄 Active Directory GPOs through NTLM relaying, and more!
Learn about a attack vector that exploits GPOs through NTLM relaying, potentially allowing unauthenticated attackers to abuse.
🌐 Source:
https://www.synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more
#ad #gpo #relay #ntlm
Learn about a attack vector that exploits GPOs through NTLM relaying, potentially allowing unauthenticated attackers to abuse.
🌐 Source:
https://www.synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more
#ad #gpo #relay #ntlm
👍15🔥1