😈 [ gentilkiwi, 🥝 Benjamin Delpy ]

Always fabulous to see editors low the Windows Security level

When Citrix SSO is enabled... passwords are stored in *user processes* (in addition to system ones)

Ho yeah, *even if you have Credential Guard*
Yeah, that's what Citrix is calling "SSO"

> Will be in #mimikatz 3 🥝

🐥 [ tweet ]

😈 [ TrustedSec, TrustedSec ]

Does crack[.]sh being offline got you down? 😔 Don't worry, you have options.
Find out how @n00py1 uses two different techniques to exploit systems that allow for the NTLMv1 authentication protocol.

https://t.co/eMqdnbZHLP

🔗 https://hubs.la/Q01mpY-j0

🐥 [ tweet ]

😈 [ SkelSec, SkelSec ]

Python. Asyncio. SSH. Client. (library)
Don't use it if you need security, use it when you want to test security :)
Public, MIT license.
As usual, thank you for all supporters of @porchetta_ind

https://t.co/hc6izOo6Xd

🔗 https://github.com/skelsec/amurex

🐥 [ tweet ]

😈 [ zux0x3a, Lawrence 勞倫斯 ]

Imagine you are 18 years old and accidentally putting your life and future on the edge just because you want to hack/show fame !? For what? Being a criminal is not a smart move, and in the end, you will be caught.

🐥 [ tweet ]

true

👹 [ snovvcrash, sn🥶vvcr💥sh ]

Being on a vacation I couldn’t resist from playing with a slightly modified example of internal credential phishing by @zux0x3a (which is not as complex as the CredentialPhisher from @foxit). Below is a quick demo of invoking a credential dialog with CME, DInjector and donut 🍩

🔗 https://github.com/0xsp-SRD/0xsp.com/tree/main/creds_hunt

🐥 [ tweet ]

😈 [ 0xdf_, 0xdf ]

Streamio retires from @hackthebox_eu. A Windows box with MSSQL injection in a PHP site, local and remote file includes, and LAPS.

https://t.co/dE4dFy3n9F

🔗 https://0xdf.gitlab.io/2022/09/17/htb-streamio.html

🐥 [ tweet ]

😈 [ ippsec, ippsec ]

#HackTheBox StreamIO video is live, this box has an excellent primer on manually enumerating MSSQL Databases after a successful inject. There’s a lot more to the box than that like active director and LAPS.
https://t.co/of1Puv1EBR

🔗 https://youtu.be/qKcUKlwoGw8

🐥 [ tweet ]

😈 [ theluemmel, S4U2LuemmelSec ]

Not sure if ADCS ESC 3 is abusable, because Certify and Certipy only give info on the 1st prerequisit "Certificate Request Agent"?

Use ldapfilter
(&(objectclass=pkicertificatetemplate)(msPKI-RA-Application-Policies=1.3.6.1.4.1.311.20.2.1)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2))'

🐥 [ tweet ]

😈 [ doc_guard, DOCGuard - Detect Maldocs in Seconds! ]

Strange PPT maldoc with low detection rates since 2022-02-02.

MD5: c0060c0741833af67121390922c44f91

PPT file>wnoscript.exe>powershell.exe>rundll32.exe

[+]Exec wnoscript when user moves mouse
[+]Wnoscript exec powershell
[+]PS download the XORed DLL.
[+]Exec it using rundll32.exe

🐥 [ tweet ]

😈 [ lkarlslund, Lars Karlslund ]

Stuck on a network with no credentials? No worry, you can anonymously bruteforce Active Directory controllers for usernames over LDAP Pings (cLDAP) using my new tool - with parallelization I get 10K usernames/sec
https://t.co/ETeKR4OVFP

🔗 https://github.com/lkarlslund/ldapnomnom

🐥 [ tweet ]

😈 [ splinter_code, Antonio Cocomazzi ]

After more than 2 years, RunasCs got a big update! 🥳

Biggest changes:
- NetworkCleartext (8) default logon type
- UAC bypass (when admin pass is known)

Enjoy :D

https://t.co/WgAH4qpbZ6

🔗 https://github.com/antonioCoco/RunasCs/releases/tag/v1.4

🐥 [ tweet ]

😈 [ mrd0x, mr.d0x ]

Stealing Access Tokens From Office Desktop Applications

https://t.co/12bMrugfe9

🔗 https://mrd0x.com/stealing-tokens-from-office-applications/

🐥 [ tweet ]

😈 [ cube0x0, Cube0x0 ]

A new blog post about relaying YubiKeys is up and tools have been uploaded to GitHub!
This would not have been possible without the previous work of @_EthicalChaos_ so big thanks to him
https://t.co/zfEV7RUAV5

🔗 https://cube0x0.github.io/Relaying-YubiKeys/

🐥 [ tweet ]

😈 [ an0n_r0, an0n ]

Here is why NetNTLMv1 should be disabled in prod networks ASAP. Besides cracking the hash back to NTLM (and then forging Silver Tickets) is straightforward, there is also a lesser known but immediate relay attack path by removing the MIC and doing RBCD abuse. Demo in screenshots.

🐥 [ tweet ]

😈 [ aniqfakhrul, Aniq Fakhrul ]

Thanks for the detailed poc! You can also do this without password by relaying ms-efsrpc to target computer, store the socks session and use it with printerbug

🐥 [ tweet ][ quote ]

😈 [ alukatsky, Alexey Lukatsky ]

Последние нашумевшие взломы (Uber, Okta, Microsoft, LastPass, Cisco и т.п.) объединяет одно - обход MFA. Не пора ли выбросить ее на свалку или все-таки у этой защитной меры есть шанс на достойное существование и надо просто правильно ее использовать? https://t.co/IRNwbbj2lU

🔗 https://lukatsky.ru/technology/vzlom-uber-cisco-i-okta-ili-ne-pora-li-vykinut-mfa-na-pomoyku.html

🐥 [ tweet ]