Offensive Xwitter
19.4K subscribers
910 photos
49 videos
21 files
2.09K links
~$ socat TWITTER-LISTEN:443,fork,reuseaddr TELEGRAM:1.3.3.7:31337

Disclaimer: https://t.iss.one/OffensiveTwitter/546
Download Telegram
😈 [ Adam Svoboda @adamsvoboda ]

Ever find yourself on an endpoint with SentinelOne and have Local Admin? Just ask SentinelAgent.exe nicely, and it will dump a process for you, including itself!

It bombs out on LSASS, but most other processes work.

πŸ”— https://gist.github.com/adamsvoboda/8e248c6b7fb812af5d04daba141c867e

Unable to dump LSASS using the previous script? No problem, just ask S1 for a Live Kernel Dump instead! You can open this in windbg (and use mimilib.dll) and go from there.

πŸ”— https://gist.github.com/adamsvoboda/8f29e09d74b73e1dec3f9049c4358e80

πŸ₯ [ tweet ][ quote ]
😁4
😈 [ HackerRalf @hacker_ralf ]

Everyone takes a lot from the community... it's time to give something back yourself.

Kerbeus - BOF implementation of Rubeus (not all).

πŸ”— https://github.com/RalfHacker/Kerbeus-BOF

P. S. PM me about all bugs

#redteam #kerberos #havoc #cobaltstrike #bof

πŸ₯ [ tweet ]
πŸ‘10
😈 [ hermit @ackmage ]

hi, check out this tool for easy Linux kernel building and debugging - easylkb

worked on it together with @netspooky! πŸ’•

writeup:
πŸ”— https://tmpout.sh/3/20.html

repo:
πŸ”— https://github.com/deepseagirl/easylkb

πŸ₯ [ tweet ]
πŸ‘4
😈 [ Synacktiv @Synacktiv ]

Unlock the Global Admin access πŸ† on Azure with this pentesting mindmap made by @alexisdanizan!

πŸ”— https://github.com/synacktiv/Mindmaps

πŸ₯ [ tweet ]
πŸ”₯1
😈 [ OtterHacker @OtterHacker ]

Finally 🀩 I got a PIC code for my #beacon! It was a really nice journey and a lot of things have been learnt on the way. If you want to try it too, I found this blog by @winternl_t really interesting:

πŸ”— https://winternl.com/shellcodestdio/

And as usual, the @C5pider #Havoc ❀️

πŸ₯ [ tweet ]
πŸ”₯2
😈 [ soka @pentest_soka ]

I just released a blogpost where I describe how two open source tools can be easily converted to Reflective DLL to be loaded in memory with Cobalt Strike.

This post comes along with which exists thanks to @Prepouce_ work

πŸ”— https://sokarepo.github.io/redteam/2023/10/11/create-reflective-dll-for-cobaltstrike.html
πŸ”— https://github.com/sokaRepo/CoercedPotatoRDLL

πŸ₯ [ tweet ]
πŸ”₯3
😈 [ 𝙁 𝙀 𝙇 𝙄 𝙓 π™ˆ @felixm_pw ]

Indisputable C2 tier list

πŸ₯ [ tweet ]

ΠΊΡ€ΠΈΠ½ΠΆ ΠΈΠ»ΠΈ Ρ€ΠΎΡ„Π»?
😁15
😈 [ SAINTCON @SAINTCON ]

Lee Christensen, Will Schroeder, and Maxwell Harley - Fighting Data With Data

Detailing the various red team challenges regarding data, leading into how this influenced Nemesis’ architectural decisions and design.

πŸ”— https://youtu.be/0q9u2hDcpIo

πŸ₯ [ tweet ]
πŸ”₯1
Offensive Xwitter
😈 [ Antonio Cocomazzi @splinter_code ] Do you want to start the RemoteRegistry service without Admin privileges? Just write into the "winreg" named pipe πŸ‘† πŸ₯ [ tweet ]
😈 [ an0n @an0n_r0 ]

just found that SharpHound used this RemoteRegistry trigger already earlier for session enumeration, like nmap smb-enum-sessions script and Sysinternals PsLoggedOn also. here is a nice summary about it from Sven Defatsch (@compasssecurity) in 2022:

πŸ”— https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/

πŸ₯ [ tweet ][ quote ]
πŸ‘1πŸ”₯1
ΠžΡ‡Π΅Π½ΡŒ ΠΊΡ€ΡƒΡ‚ΠΎ
Forwarded from vx-underground
Media is too big
VIEW IN TELEGRAM
Some nerd on Twitter named Bjorn Staal is programming out of his mind.

11/10. Solid programming skills (designed to demonstrate quantum entanglement)
🀯9πŸ‘1πŸ”₯1
vx-underground
Some nerd on Twitter named Bjorn Staal is programming out of his mind. 11/10. Solid programming skills (designed to demonstrate quantum entanglement)
😈 [ 𝕭𝖏ø𝖗𝖓 𝕾𝖙𝖆𝖆𝖑 @_nonfigurativ_ ]

Ok, so a lot of people have been asking me for code/writeup of this so I made a stripped down example (works with an infinite amount of windows) so that you can look at to get the basic gist of it (that's all I have time for now, sorry!).

πŸ”— https://bgstaal.github.io/multipleWindow3dScene/
πŸ”— https://github.com/bgstaal/multipleWindow3dScene

πŸ₯ [ tweet ][ quote ]
πŸ‘5
😈 [ Ido Veltzman @Idov31 ]

Weekly Nidhogg update
Driver hiding feature is also finished and live in the dev branch: :)
On the photos you can see the before and after in DriverView (From Nirsoft's tools)

πŸ”— https://github.com/Idov31/Nidhogg/tree/dev

#infosec #CyberSecurity

πŸ₯ [ tweet ]
πŸ‘4
😈 [ WHOAMI @wh0amitz ]

To audit the security of read-only domain controllers, I created the SharpRODC project, a simple .NET tool for RODC-related misconfigurations.

πŸ”— https://github.com/wh0amitz/SharpRODC

#infosec #redteam #cybersecurity #pentesting

πŸ₯ [ tweet ]
πŸ”₯3
😈 [ OtterHacker @OtterHacker ]

Majority of custom #GetProcAddress I found didn't handle well forwarded export, here is a snippet for #GetProcAddress and #GetModuleHandle that handle this edge case !

Feel free to use it !

πŸ”— https://gist.github.com/OtterHacker/8abaf54694ef27b9e3d38dfe57f13bd3

πŸ₯ [ tweet ]
πŸ₯±1
Π Π°Π·Π²Π΅Ρ€Π½ΡƒΡ‚ΡŒ ΠΏΡ€ΠΈΠ²Π°Ρ‚Π½Ρ‹ΠΉ Gitea Π½Π° VPS-ΠΊΠ΅ Π·Π° 5 ΠΌΠΈΠ½ΡƒΡ‚? Изи πŸ‘‡πŸ»

$ docker run -d --name mysql-gitea -e MYSQL_ROOT_PASSWORD='my_mysql_root_pass' -v /opt/volume/mysql-gitea:/var/lib/mysql mysql:latest

$ docker container exec -it mysql-gitea bash
# mysql -u root -p'my_mysql_root_pass'
mysql> CREATE USER 'gitea-user'@'%' IDENTIFIED BY 'my_gitea_db_password';
mysql> CREATE DATABASE giteadb;
mysql> GRANT ALL PRIVILEGES ON giteadb.* TO 'gitea-user'@'%';
mysql> FLUSH PRIVILEGES;
mysql> ^DBye
# exit

$ docker run -d --name gitea -v /opt/volume/gitea:/data -p 127.0.0.1:3000:3000 -p 127.0.0.1:2222:22 -e VIRTUAL_HOST=mygitea.local -e VIRTUAL_PORT=3000 -e USER_UID=1001 -e USER_GID=1001 -e DB_TYPE=mysql -e DB_HOST=172.17.0.2:3306 -e DB_NAME=giteadb -e DB_USER=gitea-user -e DB_PASSWD='my_gitea_db_password' gitea/gitea:latest

$ socat TCP4-LISTEN:31337,bind=0.0.0.0,fork TCP4:127.0.0.1:2222


ΠŸΡƒΡˆΠΈΡ‚ΡŒ ΠΈ ΠΏΡƒΠ»Π»ΠΈΡ‚ΡŒ Ρ‚Π΅ΠΏΠ΅Ρ€ΡŒ ΠΌΠΎΠΆΠ½ΠΎ ΠΏΠΎ Ρ‚Π°ΠΊΠΎΠΌΡƒ Ρ€Π΅ΠΌΠΎΡƒΡ‚Ρƒ πŸ‘‡πŸ»

$ git remote set-url origin '[[email protected]:31337]:snovvcrash/HackThePlanet.git'


Как ΠΆΠ΅ ΠΏΠΎΡ…ΠΎΡ€ΠΎΡˆΠ΅Π» дСвопс ΠΏΡ€ΠΈ ΠΊΠΎΠ½Ρ‚Π΅ΠΉΠ½Π΅Ρ€ΠΈΠ·Π°Ρ†ΠΈΠΈ...

#devops #git #gitea
πŸ‘7πŸ”₯2
😈 [ XMander @checkymander ]

Setting up Nemesis can be daunting, I wrote a blog post detailing the exact steps you need to to go from a fresh Ubuntu 22.04 image to a running Nemesis setup.

Future posts, I'd like to go into operational usage of it with Mythic and other tools

πŸ”— https://blog.checkymander.com/red%20team/tools/operations/Nemesis-Zero-To-Hero/

πŸ₯ [ tweet ]