Для опроса Defender'а Windows, например об исключениях (и ещё много о чем) на локальной или удалённой системе. Ещё и не нужно высоких привилегий.
https://github.com/0xsp-SRD/MDE_Enum
#git #soft #pentest #redteam
https://github.com/0xsp-SRD/MDE_Enum
#git #soft #pentest #redteam
GitHub
GitHub - 0xsp-SRD/MDE_Enum: comprehensive .NET tool designed to extract and display detailed information about Windows Defender…
comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reduction (ASR) rules without Admin privileges - 0xsp-SRD/MDE_Enum
CVE-2024-26229: Windows LPE
PATCHED: Apr 9, 2024
https://github.com/RalfHacker/CVE-2024-26229-exploit
P.S. Чуть поправил оригинальный эксплоит
#git #exploit #lpe #pentest #redteam
PATCHED: Apr 9, 2024
https://github.com/RalfHacker/CVE-2024-26229-exploit
P.S. Чуть поправил оригинальный эксплоит
#git #exploit #lpe #pentest #redteam
Lateral Movement with the .NET Profiler
Blog: https://posts.specterops.io/lateral-movement-with-the-net-profiler-8772c86f9523
Source: https://github.com/MayerDaniel/profiler-lateral-movement
#ad #lateral #redteam
Blog: https://posts.specterops.io/lateral-movement-with-the-net-profiler-8772c86f9523
Source: https://github.com/MayerDaniel/profiler-lateral-movement
#ad #lateral #redteam
Medium
Lateral Movement with the .NET Profiler
The accompanying code for this blogpost can be found HERE.
Scriptblock Smuggling... Или как прятать скрипт Powershell, чтобы он не мелькал в логах, и обходить AMSI без исправлений в памяти (патчей)
https://bc-security.org/scriptblock-smuggling/
#bypass #redteam #amsi #evasion
https://bc-security.org/scriptblock-smuggling/
#bypass #redteam #amsi #evasion
Please open Telegram to view this post
VIEW IN TELEGRAM
Маленький мануал по отключению агентов EDR
https://www.3nailsinfosec.com/post/edrprison-borrow-a-legitimate-driver-to-mute-edr-agent
#evasion #redteam #av
https://www.3nailsinfosec.com/post/edrprison-borrow-a-legitimate-driver-to-mute-edr-agent
#evasion #redteam #av
3NailsInfoSec
EDRPrison: Borrow a Legitimate Driver to Mute EDR Agent
Explore techniques for evading EDR products, including exploiting detection oversights and using tools like mitmproxy and EDRSilencer.
This media is not supported in your browser
VIEW IN TELEGRAM
А это прикольно. Можно получать креды на 445 порту (или релеить) без загрузки драйверов или либ в LSASS😁 есть python версия, и есть BOF...
Статья: https://posts.specterops.io/relay-your-heart-away-an-opsec-conscious-approach-to-445-takeover-1c9b4666c8ac
Софт: https://github.com/zyn3rgy/smbtakeover
#pentest #redteam
Статья: https://posts.specterops.io/relay-your-heart-away-an-opsec-conscious-approach-to-445-takeover-1c9b4666c8ac
Софт: https://github.com/zyn3rgy/smbtakeover
#pentest #redteam
Medium
Relay Your Heart Away: An OPSEC-Conscious Approach to 445 Takeover
Even within organizations that have achieved a mature security posture, targeted NTLM relay attacks are still incredibly effective after…
FakePotato зарегестрировано как CVE-2024-38100. Опять DCOM для обхода контекста безопасности...
https://decoder.cloud/2024/08/02/the-fake-potato/
Помечено как "
#pentest #redteam #lpe #ad
https://decoder.cloud/2024/08/02/the-fake-potato/
Помечено как "
Important LPE", но запатчено в июле... MS такой MS 😅😂#pentest #redteam #lpe #ad
Decoder's Blog
The “Fake” Potato
While exploring the DCOM objects for the “SilverPotato” abuse, I stumbled upon the “ShellWindows” DCOM application. This, along with “ShellBrowserWindows”, is we…
Ralf Hacker Channel
FakePotato зарегестрировано как CVE-2024-38100. Опять DCOM для обхода контекста безопасности... https://decoder.cloud/2024/08/02/the-fake-potato/ Помечено как "Important LPE", но запатчено в июле... MS такой MS 😅😂 #pentest #redteam #lpe #ad
https://youtu.be/InyrqNeaZfQ?si=TZ-qzgB56XWnPD-E
Инструмент позволяет получить NetNTLM-хеши ЛЮБОГО пользователя, чья сессия присутствует на хосте.
Требования по правам: любые.
Софт: https://github.com/MzHmO/LeakedWallpaper
Способ до установки июньского фикса KB5040434 будет работать безотказно.
@Michaelzhm, молодец)
#lateral #pentest #ad #redteam
Инструмент позволяет получить NetNTLM-хеши ЛЮБОГО пользователя, чья сессия присутствует на хосте.
Требования по правам: любые.
Софт: https://github.com/MzHmO/LeakedWallpaper
Способ до установки июньского фикса KB5040434 будет работать безотказно.
@Michaelzhm, молодец)
#lateral #pentest #ad #redteam
YouTube
LeakedWallpaper demo
Много чего про SCCM в последнее время появляется, вот еще:
Soft: https://github.com/synacktiv/SCCMSecrets
Blog: https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial
#pentest #redteam #ad #sccm #lateral #creds
Soft: https://github.com/synacktiv/SCCMSecrets
Blog: https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial
#pentest #redteam #ad #sccm #lateral #creds
GitHub
GitHub - synacktiv/SCCMSecrets: SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial…
SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement. - synacktiv/SCCMSecrets
Cobalt Strike - CDN & Reverse Proxy Setup. Подробно описанный мануал по подготовке C2 инфраструктуры CS на примере Azure.
https://redops.at/en/blog/cobalt-strike-cdn-reverse-proxy-setup
#redteam #infra #bypass
https://redops.at/en/blog/cobalt-strike-cdn-reverse-proxy-setup
#redteam #infra #bypass
Bypass LSA protection using the BYODLL technique
https://github.com/itm4n/PPLrevenant
#pentest #redteam #bypass
https://github.com/itm4n/PPLrevenant
#pentest #redteam #bypass
GitHub
GitHub - itm4n/PPLrevenant: Bypass LSA protection using the BYODLL technique
Bypass LSA protection using the BYODLL technique. Contribute to itm4n/PPLrevenant development by creating an account on GitHub.
CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177: Linux OpenPrinting CUPS RCE
blog: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
PoC: https://github.com/RickdeJager/cupshax
patch:
#exploit #git #pentest #redteam
blog: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
PoC: https://github.com/RickdeJager/cupshax
patch:
sudo systemctl stop cups-browsed
sudo systemctl disable cups-browsed
#exploit #git #pentest #redteam
evilsocket
Attacking UNIX Systems via CUPS, Part I
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Linux systems with an RCE. As someone who’s
Забыл написать, тут же ESC15 появился))
https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc
Для поиска в BloodHound CE:
И заодно нашел скрипт для патча:
https://github.com/JonasBK/Powershell/blob/master/Remediate-ESC15.ps1
#pentest #redteam #adcs
https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc
Для поиска в BloodHound CE:
MATCH p=(:Base)-[:Enroll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(:Domain)
WHERE ct.enrolleesuppliessubject = True
AND ct.authenticationenabled = False AND ct.requiresmanagerapproval = False
AND ct.schemaversion = 1
RETURN p
И заодно нашел скрипт для патча:
https://github.com/JonasBK/Powershell/blob/master/Remediate-ESC15.ps1
#pentest #redteam #adcs
TrustedSec
EKUwu: Not just another AD CS ESC
Так, новая техника инъекции в процессы - Early Cascade Injection.
Ну и ресерч достаточно подробный)
https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/
#redteam #maldev #bypass
Ну и ресерч достаточно подробный)
https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/
#redteam #maldev #bypass
Outflank
Introducting Early Cascade Injection | Outflank Blog
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.
Питонячий скрипт для работы с реестром через WMI StdRegProv
https://github.com/0xthirteen/reg_snake
#evasion #pentest #redteam #lateral
https://github.com/0xthirteen/reg_snake
#evasion #pentest #redteam #lateral
GitHub
GitHub - 0xthirteen/reg_snake: Python tool to interact with WMI StdRegProv
Python tool to interact with WMI StdRegProv. Contribute to 0xthirteen/reg_snake development by creating an account on GitHub.