[ hoaxshell ]
hoaxshell is an unconventional Windows reverse shell, currently undetected
by Microsoft Defender and other AV solutions as it is solely based on http(s) traffic.
Thanks to: Ruslan

https://github.com/t3l3machus/hoaxshell

@NetPentesters

#lpe #linux #cve

LPE exploit for CVE-2022-34918.
This exploit has been written for the kernel Linux ubuntu 5.15.0-39-generic

article: https://randorisec.fr/crack-linux-firewall/

https://github.com/randorisec/CVE-2022-34918-LPE-PoC

@NetPentesters

#ldap #gc #impacket

If ldap/ldaps ports are blocked by firewall but gc port (3268) is accessible. In my case, kerberoasting with impacket can't be achieved. Simply switch ldap:// protocol to gc:// in impacket and win!


@NetPentesters

#av #evasion

A PoC implementation for an evasion technique to terminate the current
thread and restore it before resuming execution, while implementing page
protection changes during no execution.

https://github.com/janoglezcampos/DeathSleep

@NetPentesters

#windows #impersonate #lpe

[ DiagTrackEoP ]
Just another way to abuse SeImpersonate privilege

https://github.com/Wh04m1001/DiagTrackEoP

@NetPentesters

[ Running Exploit As Protected Process Light From Userland ]
Run any code as the highest level of protection, meaning that the exploit will have full access over any other Protected Process Light and anti-malware services won’t be able to monitor it(Since they run with the lower protection of AntiMalware)

https://tastypepperoni.medium.com/running-exploit-as-protected-process-ligh-from-userland-f4c7dfe63387

+POC: https://github.com/tastypepperoni/RunAsWinTcb
#exploit
@NetPentesters

#pid #lsass

Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service (LSASS)

https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/

@NetPentesters

#sandbox #detect

Such a tiny code snippet that can help you bypass some automatic sandbox detections

@NetPentesters

MimiKatz for Pentester: Kerberos.

https://www.hackingarticles.in/mimikatz-for-pentester-kerberos/

#MimiKatz
@NetPentesters

Deny internet access and sniff your local network by performing arp spoofing attacks.

https://github.com/avan-pra/arpmess

@NetPentesters

[ Know Your AD Vulnerability: CVE-2022-26923 ]

An article with a detailed analysis of the CVE-2022-26923 vulnerability

https://www.semperis.com/blog/ad-vulnerability-cve-2022-26923/
#CVE
#AD
@NetPentesters

LDAP shell


https://github.com/PShlyundin/ldap_shell


#ldap
#shell
@NetPentesters

A VMWare Workspace ONE Access Remote Code Execution Exploit

https://github.com/sourceincite/hekate
#vmware
#one
#cve
#poc
@NetPentesters

[ Concealed code execution: Techniques and detection ]

https://www.huntandhackett.com/blog/concealed-code-execution-techniques-and-detection

@NetPentesters

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections
and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
#edr
#bypass
@NetPentesters

PrintNightmare exploit With the following features:
- Ability to target multiple hosts.
- Built-in SMB server for payload delivery, removing the need for open file shares.
- Exploit includes both MS-RPRN & MS-PAR protocols (define in CMD args).
- Implements UNC bypass technique.

https://github.com/m8sec/CVE-2021-34527
@NetPentesters

A basic emulation of an "RPC Backdoor"

https://github.com/eladshamir/RPC-Backdoor

#rpc
#backdoor
@NetPentesters

​​dc-sonar

Analyzing AD domains for security risks related to user accounts

https://github.com/ST1LLY/dc-sonar

#ad
#redteam
@NetPentesters

Best Practices for Securing Active Directory
https://docs.microsoft.com/en-gb/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory

#ad
#blueteam
@NetPentesters

​​RPCRecon

Tool in Bash to carry out a basic enumeration and extract the most relevant information from an Active Directory via rpcclient.

This utility will allow us to obtain the following information from a Domain:

▫️ Domain Users
▫️ Domain Users with their denoscription
▫️ Domain Admin Users
▫️ Domain Groups
▫️ Domains within the network

https://github.com/m4lal0/RPCrecon
#AD
@NetPentesters