Token Duplicator

https://github.com/magnusstubman/tokenduplicator
#impersonate
#token
#duplicate
@NetPentesters

​​BloodHound-Tools

A collection of tools that integrate to BloodHound.

Bloodhound is the defacto standard that both blue and red security teams use to find lateral movement and privilege escalation paths that can potentially be exploited inside an enterprise environment. A typical environment can yield millions of paths, representing almost endless opportunities for red teams to attack and creating a seemingly insurmountable number of attack vectors for blue teams to tackle.

However, a critical dimension that Bloodhound ignores, namely network access, could hold the key to shutting down excessive lateral movement. This repository contains tools that integrate with Bloodhound’s database in order to reflect network access, for the benefit of both red and blue teams.

https://github.com/zeronetworks/BloodHound-Tools

Research:
https://zeronetworks.com/blog/adversary-resilience-via-least-privilege-networking-part-1/

#Bloodhound
@NetPentesters

Pingtunnel is a tool that send TCP/UDP traffic over ICMP

https://github.com/esrrhs/pingtunnel

@NetPentesters

LDAP Monitor

Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!
With this tool you can quickly see if your attack worked and if it changed LDAP attributes of the target object.

https://github.com/p0dalirius/LDAPmonitor

#LDAP
@NetPentesters

CVE-2022-30216:
Server Service Authentication Coerce Vulnerability (Windows 11 / Server 2022)
https://github.com/akamai/akamai-security-research/tree/main/cve-2022-30216

#Vulnerability
#Exploit
@NetPentesters

PowerView alternative

https://github.com/aniqfakhrul/powerview.py

https://github.com/the-useless-one/pywerview

@NetPentesters

A swiss army knife for pentesting networks

https://github.com/snovvcrash/CrackMapExec/tree/dotnetassembly

@NetPentesters

#uac #bypass

[ UAC BYPASS]
iscsicpl autoelevate DLL Search Order hijacking UAC Bypass 0day

https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC

@NetPentesters

#ipv6 #scan


[ An interesting article about solving the IPv6 scanning problem. ]

https://www.shadowserver.org/news/hello-ipv6-scanning-world/

@NetPentesters

[ hoaxshell ]
hoaxshell is an unconventional Windows reverse shell, currently undetected
by Microsoft Defender and other AV solutions as it is solely based on http(s) traffic.
Thanks to: Ruslan

https://github.com/t3l3machus/hoaxshell

@NetPentesters

#lpe #linux #cve

LPE exploit for CVE-2022-34918.
This exploit has been written for the kernel Linux ubuntu 5.15.0-39-generic

article: https://randorisec.fr/crack-linux-firewall/

https://github.com/randorisec/CVE-2022-34918-LPE-PoC

@NetPentesters

#ldap #gc #impacket

If ldap/ldaps ports are blocked by firewall but gc port (3268) is accessible. In my case, kerberoasting with impacket can't be achieved. Simply switch ldap:// protocol to gc:// in impacket and win!


@NetPentesters

#av #evasion

A PoC implementation for an evasion technique to terminate the current
thread and restore it before resuming execution, while implementing page
protection changes during no execution.

https://github.com/janoglezcampos/DeathSleep

@NetPentesters

#windows #impersonate #lpe

[ DiagTrackEoP ]
Just another way to abuse SeImpersonate privilege

https://github.com/Wh04m1001/DiagTrackEoP

@NetPentesters

[ Running Exploit As Protected Process Light From Userland ]
Run any code as the highest level of protection, meaning that the exploit will have full access over any other Protected Process Light and anti-malware services won’t be able to monitor it(Since they run with the lower protection of AntiMalware)

https://tastypepperoni.medium.com/running-exploit-as-protected-process-ligh-from-userland-f4c7dfe63387

+POC: https://github.com/tastypepperoni/RunAsWinTcb
#exploit
@NetPentesters

#pid #lsass

Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service (LSASS)

https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/

@NetPentesters

#sandbox #detect

Such a tiny code snippet that can help you bypass some automatic sandbox detections

@NetPentesters

MimiKatz for Pentester: Kerberos.

https://www.hackingarticles.in/mimikatz-for-pentester-kerberos/

#MimiKatz
@NetPentesters

Deny internet access and sniff your local network by performing arp spoofing attacks.

https://github.com/avan-pra/arpmess

@NetPentesters

[ Know Your AD Vulnerability: CVE-2022-26923 ]

An article with a detailed analysis of the CVE-2022-26923 vulnerability

https://www.semperis.com/blog/ad-vulnerability-cve-2022-26923/
#CVE
#AD
@NetPentesters