ADenum

ADEnum is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.

https://github.com/SecuProject/ADenum

#ad #ldap #kerberos #enumeration #tools

Exploiting CVE-2021-42287/CVE-2021-42278 (Linux)

https://github.com/WazeHell/sam-the-admin

#ad #pac #s4u2self #windows #redteam

Find-Hardcoded

You can find hardcoded API key, secret, token, etc...

https://github.com/arijitdirghanji/Find-Hardcoded

#android #apk #find #secrets #tools

GitLab CI jobs unmasked passwords scanner

https://github.com/Whitespots-OU/gitlab-ci-secrets

#tools #secrets #devsecops

Microsoft Teams Abuse

https://mrd0x.com/microsoft-teams-abuse/

#teams #abuse #redteam

log4hshell — Quick Guide

https://musana.net/2021/12/13/log4shell-Quick-Guide/

#log4j #waf #bypass #bugbounty

Cobalt-Clip

Cobalt-clip is clipboard addons for Cobalt Strike to interact with clipboard. With this you can dump, edit and monitor the content of clipboard.

https://github.com/DallasFR/Cobalt-Clip

#cobaltstrike #clipboard #dump

Bypass AV & Advanced XDR solutions

Mortar Loader is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following:

— Kaspersky
— ESET
— Malewarebytes
— Mcafee
— Cortex XDR
— Windows defender
— Cylance

Research:
https://0xsp.com/security%20research%20&%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutions

Source:
https://github.com/0xsp-SRD/mortar

#av #xdr #evasion #redteam

PreAuth RCE in ManageEngine ServiceDesk Plus (CVE-2021-44077)

PoC:
https://github.com/horizon3ai/CVE-2021-44077

Research:
https://xz.aliyun.com/t/10631

#manageengine #servicedesk #rce #cve

Quick & Lazy Malware Development

https://capt-meelo.github.io//redteam/maldev/2021/12/15/lazy-maldev.html

#malware #av #evasion #redteam

DNS-Black-Cat

Multi-platform toolkit for an interactive C2C DNS shell, by using DNS-Black-Cat, you will be able to execute system commands in shell mode over a fully encrypted covert channel.

https://github.com/lawrenceamer/dns-black-cat

#c2 #dns #redteam

Auto-Elevate

This tool demonstrates the power of UAC bypasses and built-in features of Windows. This utility auto-locates winlogon.exe, steals and impersonates it's process TOKEN, and spawns a new SYSTEM-level process with the stolen token. Combined with UAC bypass method #41 (ICMLuaUtil UAC bypass) from hfiref0x's UACME utility, this utility can auto-elevate a low privileged Administrative account to NT AUTHORITY\SYSTEM.

https://github.com/FULLSHADE/Auto-Elevate

#uac #bypass #windows #tools

Native Function Static Map

A *very* imperfect attempt to correlate Kernel32 function calls to native API (Nt/Zw) counterparts/execution flow.

# https://u5ksv.csb.app/
# https://github.com/EspressoCake/NativeFunctionStaticMap

#mapping #pinvoke #winapi #maldev

WindowsDllsExport

A list of all the DLLs export in C:\windows\system32\
The idea is to find some interesting export that can be used to evade some detection.

https://github.com/Mr-Un1k0d3r/WindowsDllsExport

#winapi #dll #exports #pentest #redteam

Alternative Process Injection

Process injection is a well-known defense evasion technique that has been used for decades to execute malicious code in a legitimate process. Until now, it is still a common technique used by hackers/red teamers.

https://www.netero1010-securitylab.com/eavsion/alternative-process-injection

#process #injection #maldev

Bug Bounty Tip — Log4j Vulnerability Cheatsheet

— How It Works
— Test Environments
— Challenges & Labs (Rooms)
— Where Payloads can be Injected
— What Information can be Extracted
— How To Identify (Services & Scanners)

#log4j #cheatsheet #bugbounty

Osmedeus

Fully automated offensive security framework for reconnaissance and vulnerability scanning

Features
— Subdomain Scan.
— Subdomain TakeOver Scan.
— Screenshot the target.
— Basic recon like Whois, Dig info.
— Web Technology detection.
— IP Discovery.
— CORS Scan.
— SSL Scan.
— Wayback Machine Discovery.
— URL Discovery.
— Headers Scan.
— Port Scan.
— Vulnerable Scan.
— Seperate workspaces to store all scan output and details logging.
— REST API.
— React Web UI.
— Support Continuous Scan.
— Slack notifications.
— Easily view report from commnad line.

https://github.com/j3ssie/Osmedeus

#osint #vulnerability #scanner #bugbounty

SharpHookCheek

Most EDR's hook Nt and Zw APIs to determine if a running program has malicious intent. This C# based script returns a list of currently hooked APIs.

https://gist.github.com/sbasu7241/4c2640fb6dd5bfdcfac07b83f1648ee0

#edr #hooks #csharp #maldev