Forwarded from 1N73LL1G3NC3
CVE-2023-23397
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
PoC:
https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY
https://github.com/api0cradle/CVE-2023-23397-POC-Powershell
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
PoC:
https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY
https://github.com/api0cradle/CVE-2023-23397-POC-Powershell
MDSec
Exploiting CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability - MDSec
Date: 14th March 2023 Today saw Microsoft patch an interesting vulnerability in Microsoft Outlook. The vulnerability is described as follows: Microsoft Office Outlook contains a privilege escalation vulnerability that allows...
🔥5
Forwarded from Offensive Xwitter
😈 [ fr0gger_, Thomas Roccia 🤘 ]
New EDR/AV evasion technique added to the #UnprotectProject by @Praetorian_GRD "Unloading Module Using FreeLibrary". Check out the detailed description, code snippet and CAPA rule👇 #cybersecurity #malware #infosec cf: @DarkCoderSc
https://t.co/Td7ogFwVcZ
🔗 https://unprotect.it/technique/unloading-module-with-freelibrary/
🐥 [ tweet ]
New EDR/AV evasion technique added to the #UnprotectProject by @Praetorian_GRD "Unloading Module Using FreeLibrary". Check out the detailed description, code snippet and CAPA rule👇 #cybersecurity #malware #infosec cf: @DarkCoderSc
https://t.co/Td7ogFwVcZ
🔗 https://unprotect.it/technique/unloading-module-with-freelibrary/
🐥 [ tweet ]
🔥3
Veeam Backup and Replication (CVE-2023-27532)
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
Research:
https://www.horizon3.ai/veeam-backup-and-replication-cve-2023-27532-deep-dive/
Exploit 1:
https://github.com/sfewer-r7/CVE-2023-27532
Exploit 2:
https://github.com/horizon3ai/CVE-2023-27532
Exploit 3 (RCE):
https://github.com/puckiestyle/CVE-2023-27532-RCE-Only
#veeam #credentials #rce #cve
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
Research:
https://www.horizon3.ai/veeam-backup-and-replication-cve-2023-27532-deep-dive/
Exploit 1:
https://github.com/sfewer-r7/CVE-2023-27532
Exploit 2:
https://github.com/horizon3ai/CVE-2023-27532
Exploit 3 (RCE):
https://github.com/puckiestyle/CVE-2023-27532-RCE-Only
#veeam #credentials #rce #cve
🔥7👍2👎2
⚙️ Joomla < 4.2.8 — Unauthenticated Information Disclosure (CVE-2023-23752)
Research:
https://vulncheck.com/blog/joomla-for-rce
Exploit:
https://github.com/Acceis/exploit-CVE-2023-23752
UPD:
Research:
https://vulncheck.com/blog/joomla-for-rce
Exploit:
https://github.com/Acceis/exploit-CVE-2023-23752
UPD:
httpx -l ip.txt -path '/api/index.php/v1/config/application?public=true'#joomla #information #disclosure #cve
🔥11👍1
Forwarded from Codeby
Друзья, рады вам сообщить, что уже в эту субботу, 1 апреля, мы проведём наш первый стрим в этом году!
Мы пригласили экспертов информационной безопасности, которые поделятся опытом работы в Red Team и расскажут о самых интересных и необычных ситуациях, с которыми они сталкивались в проектах по тестированию на проникновение. Вы узнаете, как они решают проблемы и справляются с непредсказуемыми ситуациями в процессе работы.
🌟 У нас в гостях:
🔹 @T3m3t_N0sc3 – гуру инфраструктурных пентестов и автор множества статей по Red Team;
🔹 @clevergod – вице-капитан команды Кодебай с колоссальным опытом в ред тим проектах;
🔹 @Riocool – основатель группы единомышленников RedTeam Brazzers, участник команды True0xA3;
🔹 @Acrono – создатель группы Telegram APT и автор нескольких CVE для Windows.
🎤 И, конечно же, ваш незаменимый ведущий – @puni1337!
⏰ Мы ждем вас 1 апреля в 17:00 по московскому времени!
#pentest #redteam #stream
Please open Telegram to view this post
VIEW IN TELEGRAM
❤🔥8👍4❤3
Forwarded from Offensive Xwitter
😈 [ elkement, elkement ]
Hi Active Directory / ADCS hackers, I've published something! You can add the new SID extension manually if certificate templates allow for custom names: https://t.co/SndcHH3Kz7
🔗 https://elkement.blog/2023/03/30/lord-of-the-sid-how-to-add-the-objectsid-attribute-to-a-certificate-manually/
🐥 [ tweet ]
Hi Active Directory / ADCS hackers, I've published something! You can add the new SID extension manually if certificate templates allow for custom names: https://t.co/SndcHH3Kz7
🔗 https://elkement.blog/2023/03/30/lord-of-the-sid-how-to-add-the-objectsid-attribute-to-a-certificate-manually/
🐥 [ tweet ]
👍3
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Запись нашего стрима про пентест и redteam с крутыми ребятами:
* @clevergod – вице-капитан команды Codeby с колоссальным опытом в ред тим проектах;
* @Riocool – создатель Telegram канала RedTeam Brazzers, участник команды True0xA3;
* @Acrono – создатель Telegram канала APT и автор нескольких CVE;
* @puni1337 - ведущий стримов Codeby.
https://www.youtube.com/live/ITtiyhA0rwU?feature=share
Интересно пообщались, не без смешных историй))
#stream #video
* @clevergod – вице-капитан команды Codeby с колоссальным опытом в ред тим проектах;
* @Riocool – создатель Telegram канала RedTeam Brazzers, участник команды True0xA3;
* @Acrono – создатель Telegram канала APT и автор нескольких CVE;
* @puni1337 - ведущий стримов Codeby.
https://www.youtube.com/live/ITtiyhA0rwU?feature=share
Интересно пообщались, не без смешных историй))
#stream #video
🔥14👍4❤2
🕳 Ngrok: SSH Reverse Tunnel Agent
Did you know that you can run ngrok without even installing ngrok? You can start tunnels via SSH without downloading an ngrok agent by running an SSH reverse tunnel command:
https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent/
#ngrok #ssh #reverse #tunnel
Did you know that you can run ngrok without even installing ngrok? You can start tunnels via SSH without downloading an ngrok agent by running an SSH reverse tunnel command:
ssh -i ~/.ssh/id_ed25519 -R 80:localhost:80 [email protected] http
Source:https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent/
#ngrok #ssh #reverse #tunnel
🔥12👍6
Forwarded from Offensive Xwitter
😈 [ _Kudaes_, Kurosh Dabbagh ]
I've found that fibers may be something to look at when it comes to execute local in-memory code. This is a simple PoC of how you can leverage fibers to execute in-memory code without spawning threads and hiding suspicious thread stacks among others.
https://t.co/kjIPOunGun
🔗 https://github.com/Kudaes/Fiber
🐥 [ tweet ]
I've found that fibers may be something to look at when it comes to execute local in-memory code. This is a simple PoC of how you can leverage fibers to execute in-memory code without spawning threads and hiding suspicious thread stacks among others.
https://t.co/kjIPOunGun
🔗 https://github.com/Kudaes/Fiber
🐥 [ tweet ]
👍6
Forwarded from Ralf Hacker Channel (Ralf Hacker)
В семействе картошек пополнение - GodPotato. Windows LPE:
* Windows Server 2012 - Windows Server 2022 ;
* Windows8 - Windows 11
https://github.com/BeichenDream/GodPotato
#git #soft #lpe
* Windows Server 2012 - Windows Server 2022 ;
* Windows8 - Windows 11
https://github.com/BeichenDream/GodPotato
#git #soft #lpe
GitHub
GitHub - BeichenDream/GodPotato
Contribute to BeichenDream/GodPotato development by creating an account on GitHub.
🔥9
🕸️ PowerShell Obfuscation Bible
A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion.
https://github.com/t3l3machus/PowerShell-Obfuscation-Bible
#powershell #obfuscation #redteam
A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion.
https://github.com/t3l3machus/PowerShell-Obfuscation-Bible
#powershell #obfuscation #redteam
GitHub
GitHub - t3l3machus/PowerShell-Obfuscation-Bible: A collection of techniques, examples and a little bit of theory for manually…
A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion, compiled for educational purposes. The contents of this repository...
🔥9👎2❤1👍1
Forwarded from PT SWARM
Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707)
👤 by testanull
While analyzing CVE-2022-41082, also known as Proxy Not Shell, researcher discovered CVE-2023-21707 vulnerability which he has detailed in this blog.
The vulnerability allows a privileged user to trigger RCE during a deserialization of untrusted data.
📝 Contents:
● Introduction
● The new variant
● Payload delivery
● Demo
● References
https://starlabs.sg/blog/2023/04-microsoft-exchange-powershell-remoting-deserialization-leading-to-rce-cve-2023-21707/
👤 by testanull
While analyzing CVE-2022-41082, also known as Proxy Not Shell, researcher discovered CVE-2023-21707 vulnerability which he has detailed in this blog.
The vulnerability allows a privileged user to trigger RCE during a deserialization of untrusted data.
📝 Contents:
● Introduction
● The new variant
● Payload delivery
● Demo
● References
https://starlabs.sg/blog/2023/04-microsoft-exchange-powershell-remoting-deserialization-leading-to-rce-cve-2023-21707/
👍10
Forwarded from Offensive Xwitter
😈 [ mpgn_x64, mpgn ]
The sponsor version of CrackMapExec just receive an update from @MJHallenbeck 🚀
▶️ cme is now using rich logging from @willmcgugan
▶️ a progress bar has been added 🚄🚃🚃
▶️ protocol ssh is now working with a key
▶️ cmedb now store creds found with ssh
@porchetta_ind 🪂
🐥 [ tweet ]
The sponsor version of CrackMapExec just receive an update from @MJHallenbeck 🚀
▶️ cme is now using rich logging from @willmcgugan
▶️ a progress bar has been added 🚄🚃🚃
▶️ protocol ssh is now working with a key
▶️ cmedb now store creds found with ssh
@porchetta_ind 🪂
🐥 [ tweet ]
👍9
Forwarded from 1N73LL1G3NC3
ETWHash
ETWHash is a C# POC that is able to extract NetNTLMv2 hashes of incoming authentications via SMB, by consuming ETW events from the Microsoft-Windows-SMBServer provider {D48CE617-33A2-4BC3-A5C7-11AA4F29619E}
https://labs.nettitude.com/blog/etwhash-he-who-listens-shall-receive/
ETWHash is a C# POC that is able to extract NetNTLMv2 hashes of incoming authentications via SMB, by consuming ETW events from the Microsoft-Windows-SMBServer provider {D48CE617-33A2-4BC3-A5C7-11AA4F29619E}
https://labs.nettitude.com/blog/etwhash-he-who-listens-shall-receive/
🔥5👍1
🥶 Freeze
Freeze.rs is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealthy manner. Freeze.rs utilizes multiple techniques to not only remove Userland EDR hooks, but to also execute shellcode in such a way that it circumvents other endpoint monitoring controls.
Research:
https://www.optiv.com/insights/source-zero/blog/sacrificing-suspended-processes
Source:
https://github.com/optiv/Freeze.rs
#av #edr #etw #windows #maldev
Freeze.rs is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealthy manner. Freeze.rs utilizes multiple techniques to not only remove Userland EDR hooks, but to also execute shellcode in such a way that it circumvents other endpoint monitoring controls.
Research:
https://www.optiv.com/insights/source-zero/blog/sacrificing-suspended-processes
Source:
https://github.com/optiv/Freeze.rs
#av #edr #etw #windows #maldev
🔥6❤1
🕳 Resocks
This is a reverse/back-connect SOCKS5 proxy tunnel that can be used to route traffic through a system that can't be directly accessed (e.g. due to NAT). The channel is secured by mutually trusted TLS with auto-generated certificates based on a connection key.
Blog:
https://blog.redteam-pentesting.de/2023/introducing-resocks/
Source:
https://github.com/RedTeamPentesting/resocks
#socks #proxy #tunnel #mtls
This is a reverse/back-connect SOCKS5 proxy tunnel that can be used to route traffic through a system that can't be directly accessed (e.g. due to NAT). The channel is secured by mutually trusted TLS with auto-generated certificates based on a connection key.
Blog:
https://blog.redteam-pentesting.de/2023/introducing-resocks/
Source:
https://github.com/RedTeamPentesting/resocks
#socks #proxy #tunnel #mtls
🔥10❤1
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Для дампа памяти процессов, защищённых PPL.
Работает с
https://github.com/gabriellandau/PPLFault
#creds #git #soft
Работает с
Windows 11 25346.1001 (April 2023).https://github.com/gabriellandau/PPLFault
#creds #git #soft
GitHub
GitHub - gabriellandau/PPLFault
Contribute to gabriellandau/PPLFault development by creating an account on GitHub.
👍6
Forwarded from 1N73LL1G3NC3
This media is not supported in your browser
VIEW IN TELEGRAM
CVE-2023-32233 LPE
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
Once the PoC is started on a vulnerable system, it may leave that system in an unstable state with corrupted kernel memory. We strongly recommend to test the PoC on a dedicated system to avoid potential data corruptions.
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
Once the PoC is started on a vulnerable system, it may leave that system in an unstable state with corrupted kernel memory. We strongly recommend to test the PoC on a dedicated system to avoid potential data corruptions.
👍12