😈 [ mpgn_x64, mpgn ]

A much needed module during internal pentest will be added to CrackMapExec tonight 🌛

Why scan a /16 when you can get all ip/dns records of the domain using get-network module ? 🔥

Thanks to @_dirkjan (this module is adidnsdump as module) and @snovvcrash for the cidr trick !

🐥 [ tweet ]

😈 [ subtee, Casey Smith ]

Quick/easy alert if someone runs..
adfind.exe
qwinsta.exe
nltest.exe
tasklist.exe
seatbelt.exe
procdump64.exe
or _other_ odd, rare commands?

Give this a try?

❤️feedback, ways to improve.
It's not perfect, we know.
Help us improve/refine it.
https://t.co/tJ3buUL49E

🔗 https://github.com/thinkst/canarytokens

🐥 [ tweet ]

😈 [ awakecoding, Marc-André Moreau ]

Get-RdpLogonEvent: extract the list of recent RDP logons from the event viewer and become a magician 🧙‍♀️ that can answer impossible questions like "is it really using Kerberos (nope), or did it downgrade to NTLM (again)"? 👇 https://t.co/1TKpLfZB5w

🔗 https://gist.github.com/awakecoding/5fda938a5fd2d29ebffb31eb023fe51c

🐥 [ tweet ]

😈 [ _rybaz, Ryan Basden 🌻 ]

Always schedule your Q4 pentest in Q2

🐥 [ tweet ]

😈 [ ShitSecure, S3cur3Th1sSh1t ]

Still so much stuff to learn. Can really recommend going through the posts of @EmericNasi when some free timeslot is available 🔥

https://t.co/XeJ7MoxxPj

🔗 https://blog.sevagas.com/

🐥 [ tweet ]

😈 [ HuskyHacksMK, Matt | HuskyHacks ]

🚀🌠 Landed!

Happy to announce my PR for Nim shellcode generation support has been merged into the Metasploit Framework/MSFVenom!

huge thank you to @gray_sec whose PR for Go shellcode support lit the path. and thank you to the @rapid7 team for their help with the process!

💖✌

🐥 [ tweet ]

😈 [ C5pider, 5pider ]

Open sourced the "assembly execute" and "powerpick" module/command. Have fun.
https://t.co/tn87aai7nY

🔗 https://github.com/HavocFramework/Modules

🐥 [ tweet ]

😈 [ mariuszbit, mgeeky | Mariusz Banach ]

Nice! LNK-ISO polyglot weaponisation idea:

1. Create LNK that copies & renames itself to ISO
2. Create LNK-ISO polyglot with @angealbertini Mitra
3. Double-click on LNK -> will pop with ISO's contents
4. Rename polyglot back to poly.lnk

Double-click & ISO pops up ✨

@domchell

🐥 [ tweet ]

😈 [ httpyxel, yxel ]

Single stub direct and indirect syscalling rust library for windows :)

* Single stub
* One single line for all your syscalls
* Function name hashing at compilation time
* x86_64, WOW64 and x86 native support

https://t.co/e9VW04M1bK

🔗 https://github.com/janoglezcampos/rust_syscalls

🐥 [ tweet ]

😈 [ x86matthew, x86matthew ]

WriteProcessMemoryAPC - Write memory to a remote process using APC calls

Another alternative to WriteProcessMemory!

https://t.co/JIzWS927Uc

🔗 https://www.x86matthew.com/view_post?id=writeprocessmemory_apc

🐥 [ tweet ]

😈 [ ippsec, ippsec ]

Just uploaded my favorite way to detect Password Sprays and Kerberoasting on a budget by combining Event Log Filters, Scheduled Tasks, and CanaryTokens. The ability to create scheduled tasks that fire upon specific eventlog events is super powerful. https://t.co/ek3qh1O8Gl

🔗 https://youtu.be/BT9pT1tAmX8

🐥 [ tweet ]

😈 [ SkelSec, SkelSec ]

New pypykatz version 0.6.1 is out on Github and PIP. Now all
networking commands use the new interface!
One new feature added: dpapi masterkeyfile decryption with domain backupkey (.pvk)
Thanks @ProcessusT for the contribution.

https://t.co/qZRCcJBviJ

🔗 https://github.com/skelsec/pypykatz

🐥 [ tweet ]

😈 [ aetsu, 𝕬𝖊𝖙𝖘𝖚 ]

‘GIFShell’ — Covert Attack Chain and C2 Utilizing Microsoft Teams GIFs -> https://t.co/6nx18oZmIk

🔗 https://link.medium.com/xJDuMH0watb

🐥 [ tweet ]

😈 [ splinter_code, Antonio Cocomazzi ]

We are releasing an alternative way for elevating to SYSTEM when you have SeTcbPrivilege

How?
Leveraging AcquireCredentialsHandle through an SSPI hook that allows authenticating as SYSTEM to SCM

Should be "lighter" than the classic S4U

cc @decoder_it

https://t.co/IQiMXoKIP7

🔗 https://gist.github.com/antonioCoco/19563adef860614b56d010d92e67d178

🐥 [ tweet ]