​​rokenSMTP

Small python noscript to look for common #vulnerabilities on the #SMTP server.

Supported Vulnerability:
▫️ Spoofing - The ability to send an email by impersonating another user.
▫️ User Enumeration - Looking for the possibility to enumerate users with the SMTP VFRY command.

https://github.com/mrlew1s/BrokenSMTP

@NetPentesters

Vulnerabilities Scan: 15000+PoCs; 20 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty...

https://github.com/hktalent/scan4all
@NetPentesters

​​PPLDump

RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows.

https://github.com/last-byte/RIPPL

#ad
#ppl
#lsass
#tools
@NetPentesters

Azure_Workshop

#Azure #RedTeam Attack and Detect Workshop

This is a vulnerable-by-design Azure lab, containing 2 x attack paths with common misconfigurations. If you would like to see what alerts your attack path vectors are causing, recommend signing up for a Microsoft E5 trial which has Microsoft Defender for Cloud as well as Azure AD premium P2 plan. Links for signing up to an Azure Developer account can be found in the resources.txt file.

Each kill-chain has in its folder the Terraform noscript (and other pre-reqs files needed for deployment) as well as the solutions to the challenges.

https://github.com/mandiant/Azure_Workshop

@NetPentesters

Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and more!

https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7

#BloodHound
@NetPentesters

Token Duplicator

https://github.com/magnusstubman/tokenduplicator
#impersonate
#token
#duplicate
@NetPentesters

​​BloodHound-Tools

A collection of tools that integrate to BloodHound.

Bloodhound is the defacto standard that both blue and red security teams use to find lateral movement and privilege escalation paths that can potentially be exploited inside an enterprise environment. A typical environment can yield millions of paths, representing almost endless opportunities for red teams to attack and creating a seemingly insurmountable number of attack vectors for blue teams to tackle.

However, a critical dimension that Bloodhound ignores, namely network access, could hold the key to shutting down excessive lateral movement. This repository contains tools that integrate with Bloodhound’s database in order to reflect network access, for the benefit of both red and blue teams.

https://github.com/zeronetworks/BloodHound-Tools

Research:
https://zeronetworks.com/blog/adversary-resilience-via-least-privilege-networking-part-1/

#Bloodhound
@NetPentesters

Pingtunnel is a tool that send TCP/UDP traffic over ICMP

https://github.com/esrrhs/pingtunnel

@NetPentesters

LDAP Monitor

Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!
With this tool you can quickly see if your attack worked and if it changed LDAP attributes of the target object.

https://github.com/p0dalirius/LDAPmonitor

#LDAP
@NetPentesters

CVE-2022-30216:
Server Service Authentication Coerce Vulnerability (Windows 11 / Server 2022)
https://github.com/akamai/akamai-security-research/tree/main/cve-2022-30216

#Vulnerability
#Exploit
@NetPentesters

PowerView alternative

https://github.com/aniqfakhrul/powerview.py

https://github.com/the-useless-one/pywerview

@NetPentesters

A swiss army knife for pentesting networks

https://github.com/snovvcrash/CrackMapExec/tree/dotnetassembly

@NetPentesters

#uac #bypass

[ UAC BYPASS]
iscsicpl autoelevate DLL Search Order hijacking UAC Bypass 0day

https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC

@NetPentesters

#ipv6 #scan


[ An interesting article about solving the IPv6 scanning problem. ]

https://www.shadowserver.org/news/hello-ipv6-scanning-world/

@NetPentesters

[ hoaxshell ]
hoaxshell is an unconventional Windows reverse shell, currently undetected
by Microsoft Defender and other AV solutions as it is solely based on http(s) traffic.
Thanks to: Ruslan

https://github.com/t3l3machus/hoaxshell

@NetPentesters

#lpe #linux #cve

LPE exploit for CVE-2022-34918.
This exploit has been written for the kernel Linux ubuntu 5.15.0-39-generic

article: https://randorisec.fr/crack-linux-firewall/

https://github.com/randorisec/CVE-2022-34918-LPE-PoC

@NetPentesters

#ldap #gc #impacket

If ldap/ldaps ports are blocked by firewall but gc port (3268) is accessible. In my case, kerberoasting with impacket can't be achieved. Simply switch ldap:// protocol to gc:// in impacket and win!


@NetPentesters

#av #evasion

A PoC implementation for an evasion technique to terminate the current
thread and restore it before resuming execution, while implementing page
protection changes during no execution.

https://github.com/janoglezcampos/DeathSleep

@NetPentesters

#windows #impersonate #lpe

[ DiagTrackEoP ]
Just another way to abuse SeImpersonate privilege

https://github.com/Wh04m1001/DiagTrackEoP

@NetPentesters

[ Running Exploit As Protected Process Light From Userland ]
Run any code as the highest level of protection, meaning that the exploit will have full access over any other Protected Process Light and anti-malware services won’t be able to monitor it(Since they run with the lower protection of AntiMalware)

https://tastypepperoni.medium.com/running-exploit-as-protected-process-ligh-from-userland-f4c7dfe63387

+POC: https://github.com/tastypepperoni/RunAsWinTcb
#exploit
@NetPentesters

#pid #lsass

Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service (LSASS)

https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/

@NetPentesters