Invoke-WinSATBypass

This script will create a mock directory of "C:\Windows\System32" and copy a legitimate application of Windows (WinSAT.exe) into it.
It will after try to download a DLL called version.dll, which is loaded by default by WinSAT.exe, in order to perform a UAC Bypass by doing some DLL Hijacking.

https://github.com/b4keSn4ke/Invoke-WinSATBypass

#uac #bypass #winsat #tools

Docem

A utility to embed XXE and XSS payloads in docx, odt, pptx, etc - any documents that is a zip archive with bunch of xml files inside.

https://github.com/whitel1st/docem

#xxe #xss #doc #file #upload

ADCS: Playing with ESC4

Enumeration and abuse of Linux-based ADCS ESC4

Research:
https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4

Source:
https://github.com/fortalice/modifyCertTemplate

#adcs #abuse #pentest #tools

Windows 10 Hardening

The project started as a simple hardening list for Windows 10. After some time, HardeningKitty was created to simplify the hardening of Windows. Now, HardeningKitty supports guidelines from Microsoft, CIS Benchmarks, DoD STIG and BSI SiSyPHuS Win10

https://github.com/0x6d69636b/windows_hardening/

#blueteam #windows #hardening #benchmarks

A (not so deep) Dive into Grafana CVE-2021-43798

This post will cover some details behind the recent Grafana vulnerability (CVE-2021-43798), which is a directory traversal bug allowing unauthenticated attackers to read files on the target server filesystem. This post will also discuss some real world scenario and attack surface of the Grafana.

https://nusgreyhats.org/posts/writeups/a-not-so-deep-dive-in-to-grafana-cve-2021-43798/

#grafana #lfi #cve

Arsenal of AWS Security Tools

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

https://github.com/toniblyx/my-arsenal-of-aws-security-tools

#aws #security #benchmarks #blueteam

MultiPotato

Another Potato to get SYSTEM via SeImpersonate privileges

https://github.com/S3cur3Th1sSh1t/MultiPotato

#windows #lpi #potato #tools

DetectionLab

DetectionLab is a repository containing a variety of Packer, Vagrant, Powershell, Ansible, and Terraform scripts that allow you to automate the process of bringing an ActiveDirectory environment online complete with logging and security tooling using a variety of different platforms.

DetectionLab can currently be deployed to the following platforms:

— Virtualbox (Windows, MacOS, Linux)
— VMware Workstation/Fusion (Windows, MacOS, Linux)
— HyperV
— ESXi
— AWS
— Azure
— LibVirt (Not officially supported)
— Proxmox (Not officially supported)

https://detectionlab.network/

#lab #cloud #blueteam #redteam

Сaldera — Automated Adversary Emulation Platform

Сaldera is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response.

https://github.com/mitre/caldera

#blueteam #redteam #automated

Executing Code Using Microsoft Teams Updater

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/executing-code-using-microsoft-teams-updater/

#teams #redteam #research

PHP LFI with Nginx Assistance

This post presents a new method to exploit local file inclusion (LFI) vulnerabilities in utmost generality, assuming only that PHP is running in combination with Nginx under a common standard configuration.

https://bierbaumer.net/security/php-lfi-with-nginx-assistance/

#lfi #nginx #php

GoWard

GoWard proxies HTTP C2 traffic to specified Red Team servers based on the HTTP header of the traffic.

https://github.com/chdav/GoWard

#c2 #proxy #redteam

ldap2json — Offline Analysis Tool

The ldap2json script allows you to extract the whole LDAP content of a Windows domain into a JSON file.

Features:
— Authenticate with password
— Authenticate with LM:NT hashes
— Authenticate with kerberos ticket
— Save ldap content in json format

https://github.com/p0dalirius/ldap2json

#ldap #json #tools #redteam

ADExplorerSnapshot

ADExplorerSnapshot is an AD Explorer snapshot ingestor for BloodHound.
AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are currently attached to. This tool allows you to convert those snapshots to BloodHound-compatible JSON files.

https://github.com/c3c/ADExplorerSnapshot.py

#adexplorer #ldap #json #bloodhound

Decoding PDF Injection

This article talks about PDF injection from scratch to the execution of XSS and SSRF via PDF injection.

https://medium.com/@urshilaravindran/pdf-injection-in-simple-words-8c399f92593c

#pdf #xss #ssrf #injection

VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit (Vortex)

A very simple Python framework, inspired by SprayingToolkit, that tries to automate most of the process required to detect, enumerate and attack common O365 and VPN endpoints (like Cisco, Citrix, Fortinet, Pulse, etc...).

Features:
— User Search and Collection
— Password Leaks
— Main Domain Identification
— Subdomain Search
— VPN Endpoint Detection
— Password Spraying/Guessing attacks
— Search profiles on Social Networks

https://github.com/klezVirus/vortex

#osint #vpn #enumeration #spraying #tools

Apache APISIX Dashboard — Unauthorized RCE (CVE-2021-45232)

Attackers can access certain interfaces without logging in to Apache APISIX Dashboard, thus making unauthorized changes or obtaining relevant configuration information such as Apache APISIX Route, Upstream, Service, etc., and cause problems such as SSRF, malicious traffic proxies built by attackers, and arbitrary code execution.

Shodan Dorks:

title:"Apache APISIX Dashboard"

PoC:

curl https://IP:9000/apisix/admin/migrate/export

https://apisix.apache.org/blog/2021/12/28/dashboard-cve-2021-45232/

#apache #apisix #cve #poc

New article "Fuzzing for XSS via nested parsers condition" by our researcher @Psych0tr1a.

This techniques allowed us to find a bunch of vulnerabilities in popular web products that no one had noticed before!

https://swarm.ptsecurity.com/fuzzing-for-xss-via-nested-parsers-condition/

Our team wishes you and yours a Merry Christmas and a Happy New Year! ❤️