#Blue_Team

Scheduled Task Tampering

https://labs.f-secure.com/blog/scheduled-task-tampering

@BlueRedTeam

#exploit
+ CVE-2022-1388:
BIG-IP F5 iControl REST vulnerability
https://github.com/numanturle/CVE-2022-1388

+ CVE-2022-1040:
Auth bypass and RCE in webmin portal of Sophos Firewall
https://github.com/cve-hunter/CVE-2022-1040-sophos-rce

@BlueRedTeam

#exploit
Hacking a Bank by Finding a 0day in DotCMS
https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce

@BlueRedTeam

#tools
#Red_Team
+ AD CS: weaponizing the ESC7 attack
https://www.tarlogic.com/blog/ad-cs-esc7-attack
+ An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav)
https://github.com/med0x2e/NTLMRelay2Self
+ Tools for performing attacks on EIGRP domains
https://github.com/necreas1ng/EIGRPWN

@BlueRedTeam

#Blue_Team
"Windows Defender for Endpoint:
Lifting the veil, a look at MDE under the hood"
@BlueRedTeam

#CVE-2022-28776

Any App Can Install Any App In The Galaxy App Store

https://labs.f-secure.com/advisories/samsung-galaxy-any-app-can-install-any-app/

@BlueRedTeam

#webshell

Making webshell and terminal supports trzsz ( trz / tsz ), which similar to rz / sz, and compatible with tmux.

https://github.com/trzsz/trzsz.js

@BlueRedTeam

#Red_Team

For this project, I worked on a Red Team vs. Blue Team scenario in which I played the role of both pentester and SOC analyst.

https://github.com/Jtullis316/Red-Team-vs-Blue-Team

@BlueRedTeam

#tools
#Red_Team

MalSCCM - tool allows you to abuse local/remote SCCM servers to deploy malicious applications to hosts they manage
https://github.com/nettitude/MalSCCM
]-> https://labs.nettitude.com/blog/introducing-malsccm

@BlueRedTeam

#Red_Team #Blue_Team

Red Team Vs Blue Team

@BlueRedTeam

Scheduled Task Tampering

In this post we will explore two approaches that can be used to achieve the same result: create or modify a scheduled task and execute it, without generating the relevant telemetry. First, we will explore how direct registry manipulation could be used to create or modify tasks and how this did not generate the usual entries in the eventlog. Finally, an alternative route based on tampering with the Task Scheduler ETW will be presented that will completely suppress most of logging related to the Task Scheduler.

https://labs.f-secure.com/blog/scheduled-task-tampering/

@BlueRedTeam

#Red_Team

Rust Windows Kernel Driver for Red Teamers

https://github.com/memN0ps/eagle-rs

@BlueRedTeam

#CVE-2022

PoC for CVE-2022-1388_F5_BIG-IP

https://github.com/sherlocksecurity/CVE-2022-1388_F5_BIG-IP

@BlueRedTeam

#CVE-2022

K23605346: BIG-IP iControl REST vulnerability CVE-2022-1388

https://github.com/numanturle/CVE-2022-1388

@BlueRedTeam

#CVE-2022

PoC for CVE-2022-1388_F5_BIG-IP

https://github.com/sherlocksecurity/CVE-2022-1388_F5_BIG-IP_RCE

@BlueRedTeam

#CVE-2022

batch scan CVE-2022-1388

https://github.com/yukar1z0e/CVE-2022-1388

@BlueRedTeam