Ralf Hacker Channel

Если есть привилегия SeTcbPrivilege (а локальный админ может ее активировать), то можно запросить TGS билет для любого авторизованного в системе пользователя без указания его пароля. Интересный сценарий...

https://github.com/foxlox/GIUDA

https://github.com/MzHmO/TGSThief

#ad #pentest #redteam #soft #git

GitHub

GitHub - foxlox/GIUDA: Ask a TGS on behalf of another user without password

Ask a TGS on behalf of another user without password - foxlox/GIUDA

👍21🔥7😱5

19.7K viewsRalf Hacker, edited 08:03

Ralf Hacker Channel

It's a tool to interact with remote hosts using the Windows Search Protocol and coerce authentication. The target host will connect over SMB to the listener host using the machine account.

https://github.com/slemire/WSPCoerce

#git #tools #pentest #redteam #ad #relay

🔥21👍4

15.7K viewsRalf Hacker, 08:43

Ralf Hacker Channel

Forwarded from APT

This media is not supported in your browser

VIEW IN TELEGRAM

🔨KRBUACBypass

By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges.

Research:
https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html

Source:
https://github.com/wh0amitz/KRBUACBypass

#ad #kerberos #uac #bypass

🔥20👍6

18.3K viewsRalf Hacker, 15:23

Ralf Hacker Channel

Escalate Service Account To LocalSystem via Kerberos.

https://github.com/wh0amitz/S4UTomato

#privesc #ad #redteam #pentest

GitHub

GitHub - wh0amitz/S4UTomato: Escalate Service Account To LocalSystem via Kerberos

Escalate Service Account To LocalSystem via Kerberos - wh0amitz/S4UTomato

👍19🔥6🥰1

20.1K viewsRalf Hacker, 06:00

Ralf Hacker Channel

Пока тут тихо, кину Твиттер) Информация не дублируется, там много интересного...

https://twitter.com/hacker_ralf

P. S. А то ощущение, что почти одна АПТа подписывается😁

😁43👍9

26.1K viewsRalf Hacker, 11:34

Ralf Hacker Channel

0:37

This media is not supported in your browser

VIEW IN TELEGRAM

SCCM AdminService API уязвим к релей атакам🙈 Интересненько...

https://posts.specterops.io/site-takeover-via-sccms-adminservice-api-d932e22b2bf

#ad #redteam #pentest #sccm #relay

🔥32👍3

18.8K viewsRalf Hacker, 19:58

Ralf Hacker Channel

Доклады с Black Hat USA 2023

https://github.com/onhexgroup/Conferences/tree/main/Black%20Hat%20USA%202023%20slides

#git #notes #pentest

GitHub

Conferences/Black Hat USA 2023 slides at main · onhexgroup/Conferences

Conference presentation slides. Contribute to onhexgroup/Conferences development by creating an account on GitHub.

👍27🔥14🎉5

40.8K viewsRalf Hacker, 06:58

Ralf Hacker Channel

Forwarded from Pwn3rzs

acunetix_23.7_linux-pwn3rzs_cyberarsenal.7z

263.4 MB

acunetix_23.7_windows-pwn3rzs+cyberarsenal.7z

219.7 MB

added another check in bat file for admin rights (sigh)

🔥25👍3

15.8K viewsRalf Hacker, 08:01

Ralf Hacker Channel

0:20

This media is not supported in your browser

VIEW IN TELEGRAM

CVE-2023-36874: Windows LPE

https://github.com/Wh04m1001/CVE-2023-36874

#git #exploit #lpe

👍32

17.7K viewsRalf Hacker, 15:35

Ralf Hacker Channel

Спасибо всем, кого встретил и с кем пообщались на offzone))

🥰19👍7😁5🎉1

12.5K viewsRalf Hacker, 17:45

Ralf Hacker Channel

Forwarded from APT

0:45

This media is not supported in your browser

VIEW IN TELEGRAM

⚛️ Nuclei Templates AI Generator

Nuclei Template Editor - AI-powered hub to create, debug, scan, and store templates. Covering a wide array of vulnerabilities using public templates & rich CVE data.

📝 Note:
Current focus is HTTP, more protocols coming soon

🌐 Source:
https://templates.nuclei.sh
https://docs.nuclei.sh/editor

#nuclei #template #generator

🔥23👍5🎉1

13.3K viewsRalf Hacker, 18:46

Ralf Hacker Channel

Довольно интересна и свежая серия статей, в частности по AD и чуть-чуть туннелям

1. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform

2. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2

3. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3

#ad #pentest #redteam #lofl

👍17🔥6

15.9K viewsRalf Hacker, 05:08

Ralf Hacker Channel

Ну вот и дождались... Теперь в Excel доступен python🫣

https://techcommunity.microsoft.com/t5/microsoft-365-blog/introducing-python-in-excel-the-best-of-both-worlds-for-data/ba-p/3905482

P.S. Майкрософт: макросы - это опасно, а python - норм😅

#pentest #redteam #blueteam #fishing

TECHCOMMUNITY.MICROSOFT.COM

Introducing Python in Excel: The Best of Both Worlds for Data Analysis and Visualization | Microsoft Community Hub

Today, we are excited to introduce the Public Preview of Python in Excel – making it possible to integrate Python...

🔥32😁21👍8😱6

21.8K viewsRalf Hacker, 07:50

Ralf Hacker Channel

WinRAR <= 6.22: code execution PoC

https://github.com/b1tg/CVE-2023-38831-winrar-exploit

#git #exploit #pentest #redteam #fishing #initial

🔥33😱8😁5👍3

19.1K viewsRalf Hacker, 18:24

Ralf Hacker Channel

Прикольный скрипт (PyQt) для проверки, эксплуатации и постэксплуатации VMWare vCenter

https://github.com/W01fh4cker/VcenterKit

#git #vmware #pentest #soft

👍24

15.2K viewsRalf Hacker, 07:14

Ralf Hacker Channel

Хорошая статья от MDSec, как они "редтимили" разработчиков. Наиболее интересный момент - это разработка и публикация вредоносного расширения VSCode для фишинга и получения первоначального доступа.

https://www.mdsec.co.uk/2023/08/leveraging-vscode-extensions-for-initial-access/

#redteam #pentest #pishing #initial

MDSec

Leveraging VSCode Extensions for Initial Access - MDSec

Introduction On a recent red team engagement, MDSec were tasked with crafting a phishing campaign for initial access. The catch was that the in-scope phishing targets were developers with technical...

🔥16👍8

18.3K viewsRalf Hacker, 19:58

Ralf Hacker Channel

Вот смотрю ещё один свежий материал по фишингу от TrustedSec. Главная идея: с помощью HTML инъекции отправить сообщение с доверенного домена.

https://www.trustedsec.com/blog/crafting-emails-with-html-injection

Т.е. это двойной фишинг получается?! Сложно пока, но интересно...

#pentest #redteam #fishing

TrustedSec

Crafting Emails with HTML Injection

If an HTML-enabled email is sent that contains user input, it can be vulnerable to HTML injection, which can allow an attacker to change the entire body…

👍17🔥2

16.6K viewsRalf Hacker, 08:30

Ralf Hacker Channel

Про NetNTLMv1 downgrade & relay в 2023 году

https://www.r-tec.net/r-tec-blog-netntlmv1-downgrade-to-compromise.html

#pentest #redteam #relay #creds

www.r-tec.net

NetNTLMv1 Downgrade to compromise

Easy to understand NetNTLMv1 downgrade, relaying stuff and further resources for those who want to get the bigger picture at the end of this post.

👍9🔥7

18.9K viewsRalf Hacker, 11:19

Ralf Hacker Channel

Forwarded from APT

This media is not supported in your browser

VIEW IN TELEGRAM

🔄 Active Directory GPOs through NTLM relaying, and more!

Learn about a attack vector that exploits GPOs through NTLM relaying, potentially allowing unauthenticated attackers to abuse.

🌐 Source:
https://www.synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more

#ad #gpo #relay #ntlm

👍15🔥1

15.8K viewsRalf Hacker, 16:10

Ralf Hacker Channel

Forwarded from SHADOW:Group

💻

Что поискать на сайте с IIS?

1. Используем shortscan, для поиска коротких (а по возможности и полных) имен файлов и расширений.

2. Проверяем наличие реверс прокси и пробуем directory traversal:
/backend/ -> 10.0.0.1/api/
/backend/..%2Ftest -> 10.0.0.1/test
Подробнее можно почитать тут.

3. Когда удастся получить раскрытие файлов, смотрим ключи в web.conf и пробуем получить RCE через дисериализацию. Почитать об этом тут.

4. Пробуем грузить файлы .asp, .aspx, .ashx и тд (полный список тут)

#web #iis #rce

Please open Telegram to view this post

VIEW IN TELEGRAM

👍38🔥13

20.1K viewsRalf Hacker, 19:21

About

Blog

Apps

Platform