😈 [ HuntressLabs, Huntress ]
Credential stealing like #NPPSPY has probably been deployed in the wild before.
From what we can tell, we seem to be the first to share findings from NPPSPY deployed in a real attack.
Check it out: https://t.co/SoETRzZS8d
🔗 https://hubs.ly/Q01k9bcs0
🐥 [ tweet ]
Credential stealing like #NPPSPY has probably been deployed in the wild before.
From what we can tell, we seem to be the first to share findings from NPPSPY deployed in a real attack.
Check it out: https://t.co/SoETRzZS8d
🔗 https://hubs.ly/Q01k9bcs0
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
Red Team Privilege Escalation
Part 1 Local Privilege Escalation – Writable SYSTEM Path Privilege Escalation https://t.co/mDzvM6ZP6S
Part 2 RBCD Based Privilege Escalation https://t.co/Q7Xbydpse8
🔗 https://www.praetorian.com/blog/red-team-local-privilege-escalation-writable-system-path-privilege-escalation-part-1/
🔗 https://www.praetorian.com/blog/red-team-privilege-escalation-rbcd-based-privilege-escalation-part-2/
🐥 [ tweet ]
Red Team Privilege Escalation
Part 1 Local Privilege Escalation – Writable SYSTEM Path Privilege Escalation https://t.co/mDzvM6ZP6S
Part 2 RBCD Based Privilege Escalation https://t.co/Q7Xbydpse8
🔗 https://www.praetorian.com/blog/red-team-local-privilege-escalation-writable-system-path-privilege-escalation-part-1/
🔗 https://www.praetorian.com/blog/red-team-privilege-escalation-rbcd-based-privilege-escalation-part-2/
🐥 [ tweet ]
😈 [ mariuszbit, mgeeky | Mariusz Banach ]
🔥 Whooah, that's a really huge update to #CobaltStrike 4.7: enormous efforts made by @gregdarwin & Team, who once again pushed the Adversary Emulation industry by giving us:
SOCKS5, more BOFs memory mgmt primitives, greatly increased Sleep Mask size! 🔥
https://t.co/NEtyRiIQv3
🔗 https://bit.ly/3wbtNff
🐥 [ tweet ]
🔥 Whooah, that's a really huge update to #CobaltStrike 4.7: enormous efforts made by @gregdarwin & Team, who once again pushed the Adversary Emulation industry by giving us:
SOCKS5, more BOFs memory mgmt primitives, greatly increased Sleep Mask size! 🔥
https://t.co/NEtyRiIQv3
🔗 https://bit.ly/3wbtNff
🐥 [ tweet ]
👹 [ snovvcrash, sn🥶vvcr💥sh ]
So much fun automating this sick NPLogonNotify clear-text credential harvesting technique by @0gtweet! There’s a pretty cool blog post from @0x6d69636b on this subject, check it out 👇🏻👇🏻👇🏻
https://t.co/g2J1KkBdtt
🔗 https://www.scip.ch/en/?labs.20220217
🐥 [ tweet ]
So much fun automating this sick NPLogonNotify clear-text credential harvesting technique by @0gtweet! There’s a pretty cool blog post from @0x6d69636b on this subject, check it out 👇🏻👇🏻👇🏻
https://t.co/g2J1KkBdtt
🔗 https://www.scip.ch/en/?labs.20220217
🐥 [ tweet ]
😈 [ ORCA10K, ORCA ]
released a stable library that handles forwarded functions and does compile time hashing, replacing GetModuleHandle and GetProcAddress :
https://t.co/2rkTO2oNJ5
🔗 https://github.com/ORCx41/ApiHashing
🐥 [ tweet ]
released a stable library that handles forwarded functions and does compile time hashing, replacing GetModuleHandle and GetProcAddress :
https://t.co/2rkTO2oNJ5
🔗 https://github.com/ORCx41/ApiHashing
🐥 [ tweet ]
😈 [ _Qazeer, Qazeer ]
Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: https://t.co/sKK1QPqOlx 1/2
🔗 https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
🐥 [ tweet ]
Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: https://t.co/sKK1QPqOlx 1/2
🔗 https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
🐥 [ tweet ]
😈 [ TalBeerySec, Tal Be'ery ]
NTLM relay is dead and living in AAD.
An interesting @BlackHatEvents talk by @rubin_mor
https://t.co/9lVZdlkPHy
CC: @SteveSyfuhs @gentilkiwi
#BHUSA2022
🔗 https://i.blackhat.com/USA-22/Wednesday/US-22-Rubin-AAD-Joined-Machines-New-Lateral-Movement.pdf
🐥 [ tweet ]
NTLM relay is dead and living in AAD.
An interesting @BlackHatEvents talk by @rubin_mor
https://t.co/9lVZdlkPHy
CC: @SteveSyfuhs @gentilkiwi
#BHUSA2022
🔗 https://i.blackhat.com/USA-22/Wednesday/US-22-Rubin-AAD-Joined-Machines-New-Lateral-Movement.pdf
🐥 [ tweet ]
😈 [ rubin_mor, Mor Rubin ]
Glad that NTLM relay replacement found for AAD😆
Releasing My NegoEx relay tool which also allows you to modify the PKU2U part and bypass NegoEx message validation
https://t.co/UibeH6cuXB https://t.co/XpRFXu7pRr
🔗 https://github.com/morRubin/NegoExRelay
🐥 [ tweet ][ quote ]
Glad that NTLM relay replacement found for AAD😆
Releasing My NegoEx relay tool which also allows you to modify the PKU2U part and bypass NegoEx message validation
https://t.co/UibeH6cuXB https://t.co/XpRFXu7pRr
🔗 https://github.com/morRubin/NegoExRelay
🐥 [ tweet ][ quote ]
😈 [ NinjaParanoid, Chetan Nayak (Author of Brute Ratel C4) ]
Released a bunch of video tutorials and a sneak peak of the upcoming release.. Webhooks, Antidebugging, Stack Duplication and Bring Your Own Injection.. Release blog incoming.... #BRc4
https://t.co/MIlykf9Yz6
https://t.co/YkQQzUtZVh
https://t.co/kUeWIlF59g
https://t.co/ct15mE6VOC
🔗 https://www.youtube.com/watch?v=K-xbRN_ur0A
🔗 https://www.youtube.com/watch?v=Bd0fnV4w6tg
🔗 https://www.youtube.com/watch?v=i-xbu0O2fN8
🔗 https://www.youtube.com/watch?v=hc4X82gTvfg
🐥 [ tweet ]
Released a bunch of video tutorials and a sneak peak of the upcoming release.. Webhooks, Antidebugging, Stack Duplication and Bring Your Own Injection.. Release blog incoming.... #BRc4
https://t.co/MIlykf9Yz6
https://t.co/YkQQzUtZVh
https://t.co/kUeWIlF59g
https://t.co/ct15mE6VOC
🔗 https://www.youtube.com/watch?v=K-xbRN_ur0A
🔗 https://www.youtube.com/watch?v=Bd0fnV4w6tg
🔗 https://www.youtube.com/watch?v=i-xbu0O2fN8
🔗 https://www.youtube.com/watch?v=hc4X82gTvfg
🐥 [ tweet ]
😈 [ hasherezade, hasherezade ]
My new paper for @MBThreatIntel: "#JSSLoader - the #shellcode edition" : https://t.co/gzpnhlr6mf // #FIN7
🔗 https://malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition
🐥 [ tweet ]
My new paper for @MBThreatIntel: "#JSSLoader - the #shellcode edition" : https://t.co/gzpnhlr6mf // #FIN7
🔗 https://malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition
🐥 [ tweet ]
😈 [ 0xdf_, 0xdf ]
There's a been a string of nice easy-rated active directory boxes on @hackthebox_eu lately, and Late was one of those. The box requires abusing WinRM using keys/certificates, PowerShell history, and LAPS.
https://t.co/t66gFWGlZM
🔗 https://0xdf.gitlab.io/2022/08/20/htb-timelapse.html
🐥 [ tweet ]
There's a been a string of nice easy-rated active directory boxes on @hackthebox_eu lately, and Late was one of those. The box requires abusing WinRM using keys/certificates, PowerShell history, and LAPS.
https://t.co/t66gFWGlZM
🔗 https://0xdf.gitlab.io/2022/08/20/htb-timelapse.html
🐥 [ tweet ]
👹 [ snovvcrash, sn🥶vvcr💥sh ]
[#HackTip ⚒] While guys @_EthicalChaos_ and @an0n_r0 are talking about a legitimate way of jumping into RDP via smart card auth having a certificate, I’ll give a more clumsy approach: UnPAC-the-Hash (PKINIT) ⏭ DisableRestrictedAdmin=0 ⏭ scforceoption=0 ⏭ xfreerdp /pth 🎉
🐥 [ tweet ]
[#HackTip ⚒] While guys @_EthicalChaos_ and @an0n_r0 are talking about a legitimate way of jumping into RDP via smart card auth having a certificate, I’ll give a more clumsy approach: UnPAC-the-Hash (PKINIT) ⏭ DisableRestrictedAdmin=0 ⏭ scforceoption=0 ⏭ xfreerdp /pth 🎉
🐥 [ tweet ]
🔥1
😈 [ thefLinkk, thefLink ]
Just pushed a detection idea for Foliage/AceLdr to Hunt-Sleeping-Beacons.
State Wait:UserRequest is triggered by KiUserApcDispatcher? Probably a Beacon :-)
https://t.co/ro4WETq9Ox
🔗 https://github.com/thefLink/Hunt-Sleeping-Beacons
🐥 [ tweet ]
Just pushed a detection idea for Foliage/AceLdr to Hunt-Sleeping-Beacons.
State Wait:UserRequest is triggered by KiUserApcDispatcher? Probably a Beacon :-)
https://t.co/ro4WETq9Ox
🔗 https://github.com/thefLink/Hunt-Sleeping-Beacons
🐥 [ tweet ]
😈 [ _ZakSec, Zak ]
If you're interested by an alternative way to dump domain users' NT hashes and TGT without touching LSASS, take a look at the new Masky tool :)
Everything is explained in this article: https://t.co/jbcgupxvGi
Thanks @harmj0y, @tifkin_ and @ly4k_ for their amazing work on ADCS!
🔗 https://z4ksec.github.io/posts/masky-release-v0.0.3/
🐥 [ tweet ]
If you're interested by an alternative way to dump domain users' NT hashes and TGT without touching LSASS, take a look at the new Masky tool :)
Everything is explained in this article: https://t.co/jbcgupxvGi
Thanks @harmj0y, @tifkin_ and @ly4k_ for their amazing work on ADCS!
🔗 https://z4ksec.github.io/posts/masky-release-v0.0.3/
🐥 [ tweet ]
😈 [ albertzsigovits, Albert Zsigovits ]
"Don't write malware in Nim please."
17dcfd678baabb152dad73f8d2af3a6fe3504d98667f92795897c164a5983a39
C:\Users\abc\Desktop\NimShellCodeLoader_Winx64\NimShellCodeLoader\bin\OEP_Hiijack_Inject_Load.exe
@malwrhunterteam @vxunderground @HuskyHacksMK @Hexacorn @0verfl0w_
🐥 [ tweet ]
"Don't write malware in Nim please."
17dcfd678baabb152dad73f8d2af3a6fe3504d98667f92795897c164a5983a39
C:\Users\abc\Desktop\NimShellCodeLoader_Winx64\NimShellCodeLoader\bin\OEP_Hiijack_Inject_Load.exe
@malwrhunterteam @vxunderground @HuskyHacksMK @Hexacorn @0verfl0w_
🐥 [ tweet ]
😈 [ s4ntiago_p, S4ntiagoP ]
Just finished implementing the new Shtinkering technique on nanodump, credits to @asaf_gilboa!
https://t.co/yEutAPBnS8
🔗 https://github.com/helpsystems/nanodump/pull/25
🐥 [ tweet ]
Just finished implementing the new Shtinkering technique on nanodump, credits to @asaf_gilboa!
https://t.co/yEutAPBnS8
🔗 https://github.com/helpsystems/nanodump/pull/25
🐥 [ tweet ]