😈 [ cnotin, Clément Notin ]

Have you ever wondered how to decrypt “encrypted stub data” 🔐 fields in Wireshark when analyzing Kerberos, RPC, LDAP... traffic?
➡️ Ask no more!
https://t.co/dkjidQt6Fv
1. get Kerberos keys
2. give keys to Wireshark in a keytab file
3. get decrypted RPC!
Works with NTLM too 😉

🔗 https://medium.com/tenable-techblog/decrypt-encrypted-stub-data-in-wireshark-deb132c076e7

🐥 [ tweet ]

😈 [ cube0x0, Cube0x0 ]

How do you work in security without having to talk?

🐥 [ tweet ]

хакеров-интровертов тред

😈 [ cube0x0, Cube0x0 ]

🐥 [ tweet ]

😈 [ NotMedic, Tim McGuffin ]

I don't know what to do with this knowledge, but today I learned that curl has a handler for LDAP URIs.

curl --user $CREDS "ldaps://ldap.foo.com/DC=ads,DC=foo,DC=com?memberOf?sub?(&(sAMAccountName=$USER)(memberOf=CN=$GROUP,OU=Distribution,OU=Groups,DC=ads,DC=foo,DC=com))"

🐥 [ tweet ]

😈 [ PortSwiggerRes, PortSwigger Research ]

Arbitrary cache poisoning on all Akamai websites via 'Connection: Content-Length' - $50k in bounties well-earned by @jacopotediosi
https://t.co/UmlKIGsgWR

https://t.co/OFHGMVA2gP

🔗 https://medium.com/@jacopotediosi/worldwide-server-side-cache-poisoning-on-all-akamai-edge-nodes-50k-bounty-earned-f97d80f3922b
🔗 https://blog.hacktivesecurity.com/index.php/2022/09/17/http/

🐥 [ tweet ]

😈 [ C5pider, 5pider ]

Have fun guys.
https://t.co/hjq5qTYgMc
https://t.co/Z2mAJIiAGQ
https://t.co/WehmmCVCsC

🔗 https://www.virustotal.com/gui/file/ec6896542e726997e4e01d11f4fce88cb97ec59243f291966fb3ce48308041d8
🔗 https://www.virustotal.com/gui/file/56d507046eaf1fcfbdaa5491679c4f7244c9ad5cc9da4a03332c6ccb2f69ee2d
🔗 https://www.virustotal.com/gui/file-analysis/ZGFhZGU5ZWIzNjcxNzA4ODhkNzdmZDljNjViODY4MzU6MTY2NDU0NTE2Mw==

🐥 [ tweet ]

эм, а где сорцы-то??

😈 [ C5pider, 5pider ]

The Havoc Framework
https://t.co/eBpOaicsI6

🔗 https://github.com/HavocFramework/Havoc

🐥 [ tweet ]

так, дождались сорцов

😈 [ codex_tf2, CodeX ]

PyHmmm - third party agent PoC for Havoc C2 - repo + blogpost
https://t.co/kolzUJHL0n
https://t.co/pzPAK77ftn

🔗 https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2/third-party-agents
🔗 https://github.com/CodeXTF2/PyHmmm

🐥 [ tweet ]

😈 [ MrUn1k0d3r, Mr.Un1k0d3r ]

You want to use signed PowerShell noscripts?

Have a look at all the signed PowerShell noscripts located in C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\

Some of these can execute code and do all kind of interesting stuff.

https://t.co/7uBzACJ4JP

#redteam

🔗 https://github.com/Mr-Un1k0d3r/ATP-PowerShell-Scripts

🐥 [ tweet ]

😈 [ theluemmel, ADCluemmelSec ]

UPDATES to ADCS blog.
@ly4k_ gave so much input I had to implement.
@n00py1 gave a really good hint for ESC5 with his question.

So here goes:
ESC2 - Update how it works
ESC4 - Automation via Certipy
ESC5 - Full attack path
Bonus - Bloodhound Integration
https://t.co/iWvY9gTIAM

🔗 https://luemmelsec.github.io/Skidaddle-Skideldi-I-just-pwnd-your-PKI/

🐥 [ tweet ]

Про то, что делать, когда у тебя на руках есть только NT-хеш машинной учетки, чтобы стать на ней локал админом 👇🏻

https://threadreaderapp.com/thread/1576176699300990976.html

😈 [ 0xdf_, 0xdf ]

Scrambled from @hackthebox_eu disabled NTLM auth, breaking how I typically interact with a Windows host. .NET RE, Silver Tickets, Kerberoasting. I'll show attacking from both Windows and Linux. And JuicyPotatoNG in Beyond Root.

https://t.co/ER0RUaEApA

🔗 https://0xdf.gitlab.io/2022/10/01/htb-scrambled.html

🐥 [ tweet ]

Про разные сфорженные тикеты 👇🏻

https://threadreaderapp.com/thread/1576640678410432512.html

😈 [ itm4n, Clément Labro ]

Some news about PrivescCheck! 📰

If you are a Metasploit user, please note that I finally solved a (stupid) issue that prevented the noscript from working properly with "powershell_execute". 🥳

More info on GitHub.
👉 https://t.co/OZfgHlAq8S
👉 https://t.co/UvD5hRwBey

🔗 https://github.com/itm4n/PrivescCheck#metasploit-timeout
🔗 https://github.com/itm4n/PrivescCheck/issues/27

🐥 [ tweet ]

😈 [ mrd0x, mr.d0x ]

Chromium's application mode can be used to easily build realistic phishing desktop applications. Enjoy.

https://t.co/rUolWjd5Ch

🔗 https://mrd0x.com/phishing-with-chromium-application-mode/

🐥 [ tweet ]

Прикольный видос, как детектить артефакты от #Impacket-а 👇🏻

https://youtu.be/UMogme3rDRA

😈 [ n00py1, n00py ]

Pentest tip: Leave Pcredz, Impacket SMB server, Responder (Analyze mode), etc running all the time. You never know when a random Domain Admin will try to auth to you over NTLM.

Very typical with agentless security products.

🐥 [ tweet ]