12.5K subscribers
550 photos
27 videos
24 files
889 links
This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.iss.one/APT_Notes/6

Chat Link:
t.iss.one/APT_Notes_PublicChat
Download Telegram
🌐 101 Chrome Exploitation

Introductory course on browser exploitation — not just covering individual JIT bugs, but a comprehensive dive into browser architecture, security layers, and principles of building exploit chains. The author demonstrates how to turn memory corruption into working exploits by analyzing a functional 3-stage chain for Chrome 130.

🔗 Source:
https://opzero.ru/en/press/101-chrome-exploitation-part-0-preface/

#chrome #v8 #sandbox #redteam
Please open Telegram to view this post
VIEW IN TELEGRAM
👍174😱4🔥1
🖼️ SharePoint RCE — ToolShell (CVE‑2025‑53770)

Critical deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote code execution over the network. The exploit uses POST requests to /_layouts/15/ToolPane.aspx with HTTP Referer header /_layouts/SignOut.aspx to bypass authentication, then extracts MachineKey configuration to generate valid __VIEWSTATE payloads for arbitrary code execution via a single HTTP request.

🔗 Research:
https://research.eye.security/sharepoint-under-siege/

🔗 PoC:
https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501

🔗 Exploit:
https://github.com/soltanali0/CVE-2025-53770-Exploit

#ad #sharepoint #deserialization #toolshell #rce
Please open Telegram to view this post
VIEW IN TELEGRAM
14🔥13👍4
Forwarded from PT SWARM
👑 Our researcher has discovered LPE in VMWare Tools (CVE-2025-22230 & CVE-2025-22247) via VGAuth!

Write-up by the one who broke it: Sergey Bliznyuk

https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/
1🔥10😁6👍2
Forwarded from Whitehat Lab
💻 GroupPolicyBackdoor

Инструмент пост эксплуатации для различных манипуляций с GPO. Написан на 😰 Python
Впервые представлена на DEFCON 33

Примеры:

#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'


Пример ini:

[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"

[MODULEFILTERS]
filters =
[{
"operator": "AND",
"type": "Computer Name",
"value": "ad01-srv1.corp.com"
}]


GPO creation, deletion, backup and injections
Various injectable configurations, with, for each, customizable options (see list in the wiki)
Possibility to remove injected configurations from the target GPO
Possibility to revert the actions performed on client devices
GPO links manipulation
GPO enumeration / user privileges enumeration on GPOs


💻 Repo
📔 Docs

#gpo #redteam #windows

✈️ Whitehat Lab 💬Chat
Please open Telegram to view this post
VIEW IN TELEGRAM
11👍5🔥4🤔1
🛡CreateProcessAsPPL

This is a utility for running processes with Protected Process Light (PPL) protection, enabling bypass of EDR/AV solution defensive mechanisms. It leverages legitimate Windows clipup.exe functionality from System32 to create protected processes that can overwrite antivirus service executable files.

🔗 Source:
https://github.com/2x7EQ13/CreateProcessAsPPL

🔗 Research:
https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html

#av #edr #bypass #ppl
1👍105
🎯 SpearSpray

Advanced password spraying tool for Active Directory environments. Combines LDAP user enumeration with intelligent pattern-based password generation. Uses Kerberos pre-authentication and leverages user-specific data (pwdLastSet, displayName) to create personalized passwords per user.

🔗 Source:
https://github.com/sikumy/spearspray

#ad #password #spraying #kerberos #bloodhound
2🔥13👍5
Forwarded from Offensive Xwitter
😈 [ codewhisperer84 @codewhisperer84 ]

Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.

🔗 https://github.com/trustedsec/Titanis/

🐥 [ tweet ]
🔥75❤‍🔥3👍2
Forwarded from Pentest Notes
Подготовил для вас подробное руководство по тестированию на проникновение Outlook Web Access (OWA). 😈

➡️ В статье я разобрал все основные атаки и уязвимости OWA. Собрал и структурировал самое полезное в одном месте.

➡️ Также материал идеально подойдет для тех, кто все еще путает между собой OWA, Outlook и MS Exchange :)

Даже если вы раньше не сталкивались с почтовыми сервисами Microsoft, после прочтения смело можете бежать проверять их на безопасность. 🥤

Ссылка на статью

💫 @pentestnotes | #pentest #OWA #Exchange
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥13❤‍🔥4👍43😁1