👹 [ snovvcrash, sn🥶vvcr💥sh ]
[#Tooling ⚔️] Updated my SharpBin2SelfInject gist with the recent H/Invoke technique by @dr4k0nia for a stealthier GetModuleHandle / GetProcAddress resolution and invocation 🥷🏻
https://t.co/JZd3YCXfPh
#maldev #dinvoke #hinvoke
🔗 https://gist.github.com/snovvcrash/30bd25b1a5a18d8bb7ce3bb8dc2bae37
🐥 [ tweet ]
[#Tooling ⚔️] Updated my SharpBin2SelfInject gist with the recent H/Invoke technique by @dr4k0nia for a stealthier GetModuleHandle / GetProcAddress resolution and invocation 🥷🏻
https://t.co/JZd3YCXfPh
#maldev #dinvoke #hinvoke
🔗 https://gist.github.com/snovvcrash/30bd25b1a5a18d8bb7ce3bb8dc2bae37
🐥 [ tweet ]
😈 [ chvancooten, Cas van Cooten ]
. @Wietze rocking it on stage and launching https://t.co/X0GOVPaFsB, a community-driven project that maintains a repository of binaries vulnerable to variety of different DLL hijacks 🔥
🔗 https://hijacklibs.net/
🐥 [ tweet ]
. @Wietze rocking it on stage and launching https://t.co/X0GOVPaFsB, a community-driven project that maintains a repository of binaries vulnerable to variety of different DLL hijacks 🔥
🔗 https://hijacklibs.net/
🐥 [ tweet ]
😈 [ nachoskrnl, Ben Barnea ]
Long time has passed since the last authentication coercion vulnerability (DFSCoerce) so I think it's time for a new one. A vulnerability in the Server service leading to auth coerce.
Details: https://t.co/L3u8ZUVsaL
PoC:
https://t.co/6XqCqipwjX
🔗 https://www.akamai.com/blog/security/authentication-coercion-windows-server-service
🔗 https://github.com/akamai/akamai-security-research/tree/main/cve-2022-30216
🐥 [ tweet ]
Long time has passed since the last authentication coercion vulnerability (DFSCoerce) so I think it's time for a new one. A vulnerability in the Server service leading to auth coerce.
Details: https://t.co/L3u8ZUVsaL
PoC:
https://t.co/6XqCqipwjX
🔗 https://www.akamai.com/blog/security/authentication-coercion-windows-server-service
🔗 https://github.com/akamai/akamai-security-research/tree/main/cve-2022-30216
🐥 [ tweet ]
😈 [ m3g9tr0n, Spiros Fraganastasis ]
Zoom Persistence via Symlink Abuse
https://t.co/YTnbUuamj1
🔗 https://github.com/aahmad097/ZoomPersistence
🐥 [ tweet ]
Zoom Persistence via Symlink Abuse
https://t.co/YTnbUuamj1
🔗 https://github.com/aahmad097/ZoomPersistence
🐥 [ tweet ]
😈 [ HuntressLabs, Huntress ]
Credential stealing like #NPPSPY has probably been deployed in the wild before.
From what we can tell, we seem to be the first to share findings from NPPSPY deployed in a real attack.
Check it out: https://t.co/SoETRzZS8d
🔗 https://hubs.ly/Q01k9bcs0
🐥 [ tweet ]
Credential stealing like #NPPSPY has probably been deployed in the wild before.
From what we can tell, we seem to be the first to share findings from NPPSPY deployed in a real attack.
Check it out: https://t.co/SoETRzZS8d
🔗 https://hubs.ly/Q01k9bcs0
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
Red Team Privilege Escalation
Part 1 Local Privilege Escalation – Writable SYSTEM Path Privilege Escalation https://t.co/mDzvM6ZP6S
Part 2 RBCD Based Privilege Escalation https://t.co/Q7Xbydpse8
🔗 https://www.praetorian.com/blog/red-team-local-privilege-escalation-writable-system-path-privilege-escalation-part-1/
🔗 https://www.praetorian.com/blog/red-team-privilege-escalation-rbcd-based-privilege-escalation-part-2/
🐥 [ tweet ]
Red Team Privilege Escalation
Part 1 Local Privilege Escalation – Writable SYSTEM Path Privilege Escalation https://t.co/mDzvM6ZP6S
Part 2 RBCD Based Privilege Escalation https://t.co/Q7Xbydpse8
🔗 https://www.praetorian.com/blog/red-team-local-privilege-escalation-writable-system-path-privilege-escalation-part-1/
🔗 https://www.praetorian.com/blog/red-team-privilege-escalation-rbcd-based-privilege-escalation-part-2/
🐥 [ tweet ]
😈 [ mariuszbit, mgeeky | Mariusz Banach ]
🔥 Whooah, that's a really huge update to #CobaltStrike 4.7: enormous efforts made by @gregdarwin & Team, who once again pushed the Adversary Emulation industry by giving us:
SOCKS5, more BOFs memory mgmt primitives, greatly increased Sleep Mask size! 🔥
https://t.co/NEtyRiIQv3
🔗 https://bit.ly/3wbtNff
🐥 [ tweet ]
🔥 Whooah, that's a really huge update to #CobaltStrike 4.7: enormous efforts made by @gregdarwin & Team, who once again pushed the Adversary Emulation industry by giving us:
SOCKS5, more BOFs memory mgmt primitives, greatly increased Sleep Mask size! 🔥
https://t.co/NEtyRiIQv3
🔗 https://bit.ly/3wbtNff
🐥 [ tweet ]
👹 [ snovvcrash, sn🥶vvcr💥sh ]
So much fun automating this sick NPLogonNotify clear-text credential harvesting technique by @0gtweet! There’s a pretty cool blog post from @0x6d69636b on this subject, check it out 👇🏻👇🏻👇🏻
https://t.co/g2J1KkBdtt
🔗 https://www.scip.ch/en/?labs.20220217
🐥 [ tweet ]
So much fun automating this sick NPLogonNotify clear-text credential harvesting technique by @0gtweet! There’s a pretty cool blog post from @0x6d69636b on this subject, check it out 👇🏻👇🏻👇🏻
https://t.co/g2J1KkBdtt
🔗 https://www.scip.ch/en/?labs.20220217
🐥 [ tweet ]
😈 [ ORCA10K, ORCA ]
released a stable library that handles forwarded functions and does compile time hashing, replacing GetModuleHandle and GetProcAddress :
https://t.co/2rkTO2oNJ5
🔗 https://github.com/ORCx41/ApiHashing
🐥 [ tweet ]
released a stable library that handles forwarded functions and does compile time hashing, replacing GetModuleHandle and GetProcAddress :
https://t.co/2rkTO2oNJ5
🔗 https://github.com/ORCx41/ApiHashing
🐥 [ tweet ]
😈 [ _Qazeer, Qazeer ]
Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: https://t.co/sKK1QPqOlx 1/2
🔗 https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
🐥 [ tweet ]
Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: https://t.co/sKK1QPqOlx 1/2
🔗 https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
🐥 [ tweet ]
😈 [ TalBeerySec, Tal Be'ery ]
NTLM relay is dead and living in AAD.
An interesting @BlackHatEvents talk by @rubin_mor
https://t.co/9lVZdlkPHy
CC: @SteveSyfuhs @gentilkiwi
#BHUSA2022
🔗 https://i.blackhat.com/USA-22/Wednesday/US-22-Rubin-AAD-Joined-Machines-New-Lateral-Movement.pdf
🐥 [ tweet ]
NTLM relay is dead and living in AAD.
An interesting @BlackHatEvents talk by @rubin_mor
https://t.co/9lVZdlkPHy
CC: @SteveSyfuhs @gentilkiwi
#BHUSA2022
🔗 https://i.blackhat.com/USA-22/Wednesday/US-22-Rubin-AAD-Joined-Machines-New-Lateral-Movement.pdf
🐥 [ tweet ]
😈 [ rubin_mor, Mor Rubin ]
Glad that NTLM relay replacement found for AAD😆
Releasing My NegoEx relay tool which also allows you to modify the PKU2U part and bypass NegoEx message validation
https://t.co/UibeH6cuXB https://t.co/XpRFXu7pRr
🔗 https://github.com/morRubin/NegoExRelay
🐥 [ tweet ][ quote ]
Glad that NTLM relay replacement found for AAD😆
Releasing My NegoEx relay tool which also allows you to modify the PKU2U part and bypass NegoEx message validation
https://t.co/UibeH6cuXB https://t.co/XpRFXu7pRr
🔗 https://github.com/morRubin/NegoExRelay
🐥 [ tweet ][ quote ]
😈 [ NinjaParanoid, Chetan Nayak (Author of Brute Ratel C4) ]
Released a bunch of video tutorials and a sneak peak of the upcoming release.. Webhooks, Antidebugging, Stack Duplication and Bring Your Own Injection.. Release blog incoming.... #BRc4
https://t.co/MIlykf9Yz6
https://t.co/YkQQzUtZVh
https://t.co/kUeWIlF59g
https://t.co/ct15mE6VOC
🔗 https://www.youtube.com/watch?v=K-xbRN_ur0A
🔗 https://www.youtube.com/watch?v=Bd0fnV4w6tg
🔗 https://www.youtube.com/watch?v=i-xbu0O2fN8
🔗 https://www.youtube.com/watch?v=hc4X82gTvfg
🐥 [ tweet ]
Released a bunch of video tutorials and a sneak peak of the upcoming release.. Webhooks, Antidebugging, Stack Duplication and Bring Your Own Injection.. Release blog incoming.... #BRc4
https://t.co/MIlykf9Yz6
https://t.co/YkQQzUtZVh
https://t.co/kUeWIlF59g
https://t.co/ct15mE6VOC
🔗 https://www.youtube.com/watch?v=K-xbRN_ur0A
🔗 https://www.youtube.com/watch?v=Bd0fnV4w6tg
🔗 https://www.youtube.com/watch?v=i-xbu0O2fN8
🔗 https://www.youtube.com/watch?v=hc4X82gTvfg
🐥 [ tweet ]
😈 [ hasherezade, hasherezade ]
My new paper for @MBThreatIntel: "#JSSLoader - the #shellcode edition" : https://t.co/gzpnhlr6mf // #FIN7
🔗 https://malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition
🐥 [ tweet ]
My new paper for @MBThreatIntel: "#JSSLoader - the #shellcode edition" : https://t.co/gzpnhlr6mf // #FIN7
🔗 https://malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition
🐥 [ tweet ]
😈 [ 0xdf_, 0xdf ]
There's a been a string of nice easy-rated active directory boxes on @hackthebox_eu lately, and Late was one of those. The box requires abusing WinRM using keys/certificates, PowerShell history, and LAPS.
https://t.co/t66gFWGlZM
🔗 https://0xdf.gitlab.io/2022/08/20/htb-timelapse.html
🐥 [ tweet ]
There's a been a string of nice easy-rated active directory boxes on @hackthebox_eu lately, and Late was one of those. The box requires abusing WinRM using keys/certificates, PowerShell history, and LAPS.
https://t.co/t66gFWGlZM
🔗 https://0xdf.gitlab.io/2022/08/20/htb-timelapse.html
🐥 [ tweet ]
👹 [ snovvcrash, sn🥶vvcr💥sh ]
[#HackTip ⚒] While guys @_EthicalChaos_ and @an0n_r0 are talking about a legitimate way of jumping into RDP via smart card auth having a certificate, I’ll give a more clumsy approach: UnPAC-the-Hash (PKINIT) ⏭ DisableRestrictedAdmin=0 ⏭ scforceoption=0 ⏭ xfreerdp /pth 🎉
🐥 [ tweet ]
[#HackTip ⚒] While guys @_EthicalChaos_ and @an0n_r0 are talking about a legitimate way of jumping into RDP via smart card auth having a certificate, I’ll give a more clumsy approach: UnPAC-the-Hash (PKINIT) ⏭ DisableRestrictedAdmin=0 ⏭ scforceoption=0 ⏭ xfreerdp /pth 🎉
🐥 [ tweet ]
🔥1
😈 [ thefLinkk, thefLink ]
Just pushed a detection idea for Foliage/AceLdr to Hunt-Sleeping-Beacons.
State Wait:UserRequest is triggered by KiUserApcDispatcher? Probably a Beacon :-)
https://t.co/ro4WETq9Ox
🔗 https://github.com/thefLink/Hunt-Sleeping-Beacons
🐥 [ tweet ]
Just pushed a detection idea for Foliage/AceLdr to Hunt-Sleeping-Beacons.
State Wait:UserRequest is triggered by KiUserApcDispatcher? Probably a Beacon :-)
https://t.co/ro4WETq9Ox
🔗 https://github.com/thefLink/Hunt-Sleeping-Beacons
🐥 [ tweet ]