#lpe #linux #cve

LPE exploit for CVE-2022-34918.
This exploit has been written for the kernel Linux ubuntu 5.15.0-39-generic

article: https://randorisec.fr/crack-linux-firewall/

https://github.com/randorisec/CVE-2022-34918-LPE-PoC

@NetPentesters

#ldap #gc #impacket

If ldap/ldaps ports are blocked by firewall but gc port (3268) is accessible. In my case, kerberoasting with impacket can't be achieved. Simply switch ldap:// protocol to gc:// in impacket and win!


@NetPentesters

#av #evasion

A PoC implementation for an evasion technique to terminate the current
thread and restore it before resuming execution, while implementing page
protection changes during no execution.

https://github.com/janoglezcampos/DeathSleep

@NetPentesters

#windows #impersonate #lpe

[ DiagTrackEoP ]
Just another way to abuse SeImpersonate privilege

https://github.com/Wh04m1001/DiagTrackEoP

@NetPentesters

[ Running Exploit As Protected Process Light From Userland ]
Run any code as the highest level of protection, meaning that the exploit will have full access over any other Protected Process Light and anti-malware services won’t be able to monitor it(Since they run with the lower protection of AntiMalware)

https://tastypepperoni.medium.com/running-exploit-as-protected-process-ligh-from-userland-f4c7dfe63387

+POC: https://github.com/tastypepperoni/RunAsWinTcb
#exploit
@NetPentesters

#pid #lsass

Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service (LSASS)

https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/

@NetPentesters

#sandbox #detect

Such a tiny code snippet that can help you bypass some automatic sandbox detections

@NetPentesters

MimiKatz for Pentester: Kerberos.

https://www.hackingarticles.in/mimikatz-for-pentester-kerberos/

#MimiKatz
@NetPentesters

Deny internet access and sniff your local network by performing arp spoofing attacks.

https://github.com/avan-pra/arpmess

@NetPentesters

[ Know Your AD Vulnerability: CVE-2022-26923 ]

An article with a detailed analysis of the CVE-2022-26923 vulnerability

https://www.semperis.com/blog/ad-vulnerability-cve-2022-26923/
#CVE
#AD
@NetPentesters

LDAP shell


https://github.com/PShlyundin/ldap_shell


#ldap
#shell
@NetPentesters

A VMWare Workspace ONE Access Remote Code Execution Exploit

https://github.com/sourceincite/hekate
#vmware
#one
#cve
#poc
@NetPentesters

[ Concealed code execution: Techniques and detection ]

https://www.huntandhackett.com/blog/concealed-code-execution-techniques-and-detection

@NetPentesters

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections
and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
#edr
#bypass
@NetPentesters

PrintNightmare exploit With the following features:
- Ability to target multiple hosts.
- Built-in SMB server for payload delivery, removing the need for open file shares.
- Exploit includes both MS-RPRN & MS-PAR protocols (define in CMD args).
- Implements UNC bypass technique.

https://github.com/m8sec/CVE-2021-34527
@NetPentesters

A basic emulation of an "RPC Backdoor"

https://github.com/eladshamir/RPC-Backdoor

#rpc
#backdoor
@NetPentesters

​​dc-sonar

Analyzing AD domains for security risks related to user accounts

https://github.com/ST1LLY/dc-sonar

#ad
#redteam
@NetPentesters

Best Practices for Securing Active Directory
https://docs.microsoft.com/en-gb/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory

#ad
#blueteam
@NetPentesters

​​RPCRecon

Tool in Bash to carry out a basic enumeration and extract the most relevant information from an Active Directory via rpcclient.

This utility will allow us to obtain the following information from a Domain:

▫️ Domain Users
▫️ Domain Users with their denoscription
▫️ Domain Admin Users
▫️ Domain Groups
▫️ Domains within the network

https://github.com/m4lal0/RPCrecon
#AD
@NetPentesters

​​SilentHound

Quietly enumerate an Active Directory Domain via LDAP parsing users, admins, groups, etc.

This will create an isolated virtual environment with dependencies needed for the project. To use the project you can either open a shell in the virtualenv with pipenv shell or run commands directly with pipenv run.

https://github.com/layer8secure/SilentHound

#ad
@NetPentesters