π [ cod @wolfcod ]
Combining RtlCreateProcessReflection plus NanoDump Writer to avoid MiniDump callback api:
π https://github.com/wolfcod/lsassdump
π₯ [ tweet ]
Combining RtlCreateProcessReflection plus NanoDump Writer to avoid MiniDump callback api:
π https://github.com/wolfcod/lsassdump
π₯ [ tweet ]
π5π₯3
π [ Elastic Security Labs @elasticseclabs ]
Threat hunting just got easier! This new repo of detection rules is crafted by our veteran detection engineers and powered by different Elastic query languages. Get the details of whatβs included and see the future of this repo here:
π https://www.elastic.co/security-labs/elevate-your-threat-hunting
π₯ [ tweet ]
Threat hunting just got easier! This new repo of detection rules is crafted by our veteran detection engineers and powered by different Elastic query languages. Get the details of whatβs included and see the future of this repo here:
π https://www.elastic.co/security-labs/elevate-your-threat-hunting
π₯ [ tweet ]
π₯7π2
π [ Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid ]
Here's my journey/blog of an entire wasted day on reversing the NTAPI call and the internals of
Blog:
π https://bruteratel.com/research/2024/10/20/Exception-Junction/
PoC:
π https://github.com/paranoidninja/Exception-Junction
π₯ [ tweet ]
Here's my journey/blog of an entire wasted day on reversing the NTAPI call and the internals of
ntdll!LdrpVectorHandlerList to write my own RtlpAddVectoredExceptionHandler from scratch. The code is hosted on my git.Blog:
π https://bruteratel.com/research/2024/10/20/Exception-Junction/
PoC:
π https://github.com/paranoidninja/Exception-Junction
π₯ [ tweet ]
π₯7π3
π [ Steph @w34kp455 ]
Call it the biggest #NTLM #password database or monstrous #MD5 leak, but on, you can find precomputed datasets for various wordlists and different hashes - all free!
FYI:
π https://weakpass.com
π₯ [ tweet ]
Call it the biggest #NTLM #password database or monstrous #MD5 leak, but on, you can find precomputed datasets for various wordlists and different hashes - all free!
FYI:
all_in_one.latin.txt for NTLM contains 26.5 billion pairs of hash:password inside!π₯π https://weakpass.com
π₯ [ tweet ]
π₯19π5
π [ CICADA8Research @CICADA8Research ]
Hi! We'd like to share our new research with you. You've probably heard about COM Hijacking, but we've found another way of persistence via COM. Typelib! Read the article here:
π https://medium.com/@cicada-8/hijack-the-typelib-new-com-persistence-technique-32ae1d284661
π₯ [ tweet ]
Hi! We'd like to share our new research with you. You've probably heard about COM Hijacking, but we've found another way of persistence via COM. Typelib! Read the article here:
π https://medium.com/@cicada-8/hijack-the-typelib-new-com-persistence-technique-32ae1d284661
π₯ [ tweet ]
π₯12π₯±6π4π€3
π [ Chris Au @netero_1010 ]
Something interesting I found in SCCM remote control.
π https://www.netero1010-securitylab.com/red-team/abuse-sccm-remote-control-as-native-vnc
π₯ [ tweet ]
Something interesting I found in SCCM remote control.
π https://www.netero1010-securitylab.com/red-team/abuse-sccm-remote-control-as-native-vnc
π₯ [ tweet ]
π3π₯±2π₯1
π [ Octoberfest7 @Octoberfest73 ]
Happy to share another open source project- An x64 position-independent shellcode stager that validates the downloaded payload stage prior to execution. Integration with Cobalt Strike out of the box. Check out Secure_Stager here:
π https://github.com/Octoberfest7/Secure_Stager
π₯ [ tweet ]
Happy to share another open source project- An x64 position-independent shellcode stager that validates the downloaded payload stage prior to execution. Integration with Cobalt Strike out of the box. Check out Secure_Stager here:
π https://github.com/Octoberfest7/Secure_Stager
π₯ [ tweet ]
π4π₯3π₯±2
This media is not supported in your browser
VIEW IN TELEGRAM
π [ Bnb @HulkOperator ]
I'm thrilled to share my latest project: AuthStager. This is a proof-of-concept tool that generates a shellcode stager with authentication.
Shout out to @MalDevAcademy, which is hands down the best resource to learn maldev.
Blog:
π https://hulkops.gitbook.io/blog/red-team/stage-but-verify
Code:
π https://github.com/HulkOperator/AuthStager
π₯ [ tweet ]
I'm thrilled to share my latest project: AuthStager. This is a proof-of-concept tool that generates a shellcode stager with authentication.
Shout out to @MalDevAcademy, which is hands down the best resource to learn maldev.
Blog:
π https://hulkops.gitbook.io/blog/red-team/stage-but-verify
Code:
π https://github.com/HulkOperator/AuthStager
π₯ [ tweet ]
π7π₯4
π [ MalDev Academy @MalDevAcademy ]
Embed an encrypted payload within a PNG file across multiple sections.
π https://github.com/Maldev-Academy/EmbedPayloadInPng
π₯ [ tweet ]
Embed an encrypted payload within a PNG file across multiple sections.
π https://github.com/Maldev-Academy/EmbedPayloadInPng
π₯ [ tweet ]
π6π₯±5
π [ TrustedSec @TrustedSec ]
Itβs time to get Groovy! In our new #blog, @__mez0__ goes over a variety of post-exploitation tasks in the #Groovy programming language for the next time youβre #enumerating a network. Read it now!
π https://hubs.la/Q02Vhm2G0
π₯ [ tweet ]
Itβs time to get Groovy! In our new #blog, @__mez0__ goes over a variety of post-exploitation tasks in the #Groovy programming language for the next time youβre #enumerating a network. Read it now!
π https://hubs.la/Q02Vhm2G0
π₯ [ tweet ]
π3
π [ 0xdf @0xdf_ ]
Mist from @hackthebox_eu is just a monster active directory challenge. My favorite parts were exploiting PetitPotam with ntlmrelayx to relay into LDAP access on the DC, enumerating Defender exclusion directories, and exploiting ESC13.
π https://0xdf.gitlab.io/2024/10/26/htb-mist.html
π₯ [ tweet ]
Mist from @hackthebox_eu is just a monster active directory challenge. My favorite parts were exploiting PetitPotam with ntlmrelayx to relay into LDAP access on the DC, enumerating Defender exclusion directories, and exploiting ESC13.
π https://0xdf.gitlab.io/2024/10/26/htb-mist.html
π₯ [ tweet ]
π4π₯2
π [ Lampros @lampnout ]
Did you know attackers can register scheduled tasks configured with a custom handler (COM) to hide the full path of their payload? In my revisited post I explore (source code) how it is possible to register a task using the
π https://stmxcsr.com/persistence/scheduled-tasks.html#programmatically-register-a-scheduled-task-using-com-icomhandleraction
π₯ [ tweet ]
Did you know attackers can register scheduled tasks configured with a custom handler (COM) to hide the full path of their payload? In my revisited post I explore (source code) how it is possible to register a task using the
IComHandlerAction interface:π https://stmxcsr.com/persistence/scheduled-tasks.html#programmatically-register-a-scheduled-task-using-com-icomhandleraction
π₯ [ tweet ]
π4π₯3
π [ Elastic Security Labs @elasticseclabs ]
The ElasticSecurityLabs team breaks down a recent Chrome update that introduced App-Bound Encryption and how the most common infostealers have adapted:
π https://www.elastic.co/security-labs/katz-and-mouse-game
π₯ [ tweet ]
The ElasticSecurityLabs team breaks down a recent Chrome update that introduced App-Bound Encryption and how the most common infostealers have adapted:
π https://www.elastic.co/security-labs/katz-and-mouse-game
π₯ [ tweet ]
π₯4π3
This media is not supported in your browser
VIEW IN TELEGRAM
π [ Diego Capriotti @naksyn ]
This has been one of my favorites for a while, but now it's time to let it go.
Here's my preferred way of getting the KeePass db that we often hunt for:
downgrade the executable to version 2.53, use CVE-2023-24055 and wait for the busy admin to trigger the dump of the database.
The target can remain clean and you can simply check for the dump creation.
KeePass version 2.53 can still open kdbx created with the version 2.57 and if using a proper xml the user will likely notice nothing.
Update alerts can also be disabled within the xml.
π https://gist.github.com/naksyn/6d5660dacd0730498a274b85d62a77e8
π₯ [ tweet ]
This has been one of my favorites for a while, but now it's time to let it go.
Here's my preferred way of getting the KeePass db that we often hunt for:
downgrade the executable to version 2.53, use CVE-2023-24055 and wait for the busy admin to trigger the dump of the database.
The target can remain clean and you can simply check for the dump creation.
KeePass version 2.53 can still open kdbx created with the version 2.57 and if using a proper xml the user will likely notice nothing.
Update alerts can also be disabled within the xml.
π https://gist.github.com/naksyn/6d5660dacd0730498a274b85d62a77e8
π₯ [ tweet ]
π5
This media is not supported in your browser
VIEW IN TELEGRAM
π [ Γscar Alfonso DΓaz @OscarAkaElvis ]
Fresh meat! We've created a new Evil-WinRM branch with integrated multiple AI LLM support. New docker image, new gem (gem install evil-winrm-ai) and new possibilities.
Check it out and let us know what you think:
π https://github.com/Hackplayers/evil-winrm/tree/ai
π₯ [ tweet ]
π - ΠΊΡΠΈΠ½ΠΆ
π₯ - ΡΠΎΡΠ»
Fresh meat! We've created a new Evil-WinRM branch with integrated multiple AI LLM support. New docker image, new gem (gem install evil-winrm-ai) and new possibilities.
Check it out and let us know what you think:
π https://github.com/Hackplayers/evil-winrm/tree/ai
π₯ [ tweet ]
π - ΠΊΡΠΈΠ½ΠΆ
π₯ - ΡΠΎΡΠ»
π19π₯16
Offensive Xwitter
π [ OtterHacker @OtterHacker ] I've published my #defcon32 workshop! If you want to develop your own "Perfect DLL Loader", you will have all you need in it. From the classic minimal loader to a fully featured one, this workshop in 6 steps is a journey insideβ¦
π [ OtterHacker @OtterHacker ]
A few months ago I've created a "Pefect DLL Loader". You can find some details on my article that was just published today!
The full implem can be found directly in the @defcon workshop in my github!
Hope you will learn something in this π
π https://www.riskinsight-wavestone.com/en/2024/10/loadlibrary-madness-dynamically-load-winhttp-dll/
π₯ [ tweet ]
A few months ago I've created a "Pefect DLL Loader". You can find some details on my article that was just published today!
The full implem can be found directly in the @defcon workshop in my github!
Hope you will learn something in this π
π https://www.riskinsight-wavestone.com/en/2024/10/loadlibrary-madness-dynamically-load-winhttp-dll/
π₯ [ tweet ]
π2
π [ Cobalt Strike @_CobaltStrike ]
Curious about Cobalt Strike's #UDRL capabilities? Get a walkthrough on how to easily develop custom loaders.
π https://www.cobaltstrike.com/blog/revisiting-the-udrl-part-1-simplifying-development
π₯ [ tweet ]
Curious about Cobalt Strike's #UDRL capabilities? Get a walkthrough on how to easily develop custom loaders.
π https://www.cobaltstrike.com/blog/revisiting-the-udrl-part-1-simplifying-development
π₯ [ tweet ]
π₯4
π [ Matt Creel @Tw1sm ]
New blog up to cover manual AD CS enumeration using ldapsearch and the new release of bofhound π
π https://posts.specterops.io/bofhound-ad-cs-integration-91b706bc7958
π₯ [ tweet ]
New blog up to cover manual AD CS enumeration using ldapsearch and the new release of bofhound π
π https://posts.specterops.io/bofhound-ad-cs-integration-91b706bc7958
π₯ [ tweet ]
π₯4π₯±1
π [ Chris Thompson @_Mayyhem ]
Want to move laterally from C2 on an Intune admin's workstation to any Intune-enrolled device? Check out Maestro, a new(ish) tool I wrote for those situations, and this blog post to walk you through how:
Code:
π https://github.com/Mayyhem/Maestro
Blog:
π https://posts.specterops.io/maestro-9ed71d38d546
π₯ [ tweet ]
Want to move laterally from C2 on an Intune admin's workstation to any Intune-enrolled device? Check out Maestro, a new(ish) tool I wrote for those situations, and this blog post to walk you through how:
Code:
π https://github.com/Mayyhem/Maestro
Blog:
π https://posts.specterops.io/maestro-9ed71d38d546
π₯ [ tweet ]