😈 [ _dirkjan, Dirk-jan ]
Fox-IT just open sourced their enterprise forensics tooling dissect. This is a big project that some of the smartest people I know have worked on. It supports many filesystems and file formats, all as Python libraries. Docs: https://t.co/M6YAygmW3E / code: https://t.co/HKT4eYIm1a
🔗 https://docs.dissect.tools
🔗 http://github.com/fox-it/dissect
🐥 [ tweet ]
Fox-IT just open sourced their enterprise forensics tooling dissect. This is a big project that some of the smartest people I know have worked on. It supports many filesystems and file formats, all as Python libraries. Docs: https://t.co/M6YAygmW3E / code: https://t.co/HKT4eYIm1a
🔗 https://docs.dissect.tools
🔗 http://github.com/fox-it/dissect
🐥 [ tweet ]
😈 [ tiraniddo, James Forshaw ]
Here's a fork of Rubeus with the 'askrc4' command. https://t.co/g5IHpyaFfR it's not remotely suitable for a PR as I'm just using Rubeus as a surrogate Kerberos client. Knock yourselves out.
🔗 https://github.com/tyranid/Rubeus/commit/3092e1f11164bf379708b815a05061783653e834
🐥 [ tweet ][ quote ]
Here's a fork of Rubeus with the 'askrc4' command. https://t.co/g5IHpyaFfR it's not remotely suitable for a PR as I'm just using Rubeus as a surrogate Kerberos client. Knock yourselves out.
🔗 https://github.com/tyranid/Rubeus/commit/3092e1f11164bf379708b815a05061783653e834
🐥 [ tweet ][ quote ]
😈 [ Alh4zr3d, Alh4zr3d ]
Red Teamers, few Linux tips today:
Disable history (do first) -
"export HISTFILE=/dev/null"
Hide a command by masking it as syslogd -
"(exec -a syslogd nmap -T0 10.0.2.1/24)"
Start a background hidden process as syslogd -
"exec -a syslogd nmap -T0 10.0.2.1/24 &>nmap.log &"
🐥 [ tweet ]
Red Teamers, few Linux tips today:
Disable history (do first) -
"export HISTFILE=/dev/null"
Hide a command by masking it as syslogd -
"(exec -a syslogd nmap -T0 10.0.2.1/24)"
Start a background hidden process as syslogd -
"exec -a syslogd nmap -T0 10.0.2.1/24 &>nmap.log &"
🐥 [ tweet ]
😈 [ theluemmel, ADCluemmelSec ]
Added a minor flag to the OfficeMemScraper.ps1 from @424f424f so you can dump e.g. msedge.exe with several running processes. The tool would otherwise overwrite the results on each iteration.
Based on the research from @mrd0x
https://t.co/PenD7ywK7X
https://t.co/5D3PMU5skf
🔗 https://mrd0x.com/stealing-tokens-from-office-applications/
🔗 https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/master/OfficeMemScraper.ps1
🐥 [ tweet ]
Added a minor flag to the OfficeMemScraper.ps1 from @424f424f so you can dump e.g. msedge.exe with several running processes. The tool would otherwise overwrite the results on each iteration.
Based on the research from @mrd0x
https://t.co/PenD7ywK7X
https://t.co/5D3PMU5skf
🔗 https://mrd0x.com/stealing-tokens-from-office-applications/
🔗 https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/master/OfficeMemScraper.ps1
🐥 [ tweet ]
😈 [ _RastaMouse, Rasta Mouse ]
I made an experimental fork of @_EthicalChaos_'s https://t.co/DxNcYHEY9r project. Basically, just replaced the use of P/Invoke with D/Invoke and Win32 APIs with Nt APIs.
There are lots of untested code paths, so YMMV.
https://t.co/dnmgRborgD
🔗 http://MinHook.NET
🔗 https://github.com/rasta-mouse/MinHook.NET
🐥 [ tweet ]
I made an experimental fork of @_EthicalChaos_'s https://t.co/DxNcYHEY9r project. Basically, just replaced the use of P/Invoke with D/Invoke and Win32 APIs with Nt APIs.
There are lots of untested code paths, so YMMV.
https://t.co/dnmgRborgD
🔗 http://MinHook.NET
🔗 https://github.com/rasta-mouse/MinHook.NET
🐥 [ tweet ]
😈 [ VirtualAllocEx, Daniel Feichter ]
Nice blog post by @Microsoft in cooperation with AV-Comparatives about "Detecting and preventing LSASS credential dumping attacks"
https://t.co/0tML7Heax5
#itsec #itsicherheit #itsecurity #endpointsecurity #antivirus #lsass
🔗 https://www.microsoft.com/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/
🐥 [ tweet ]
Nice blog post by @Microsoft in cooperation with AV-Comparatives about "Detecting and preventing LSASS credential dumping attacks"
https://t.co/0tML7Heax5
#itsec #itsicherheit #itsecurity #endpointsecurity #antivirus #lsass
🔗 https://www.microsoft.com/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/
🐥 [ tweet ]
😈 [ Tw1sm, Matt Creel ]
Created python tooling for the "Roast in the Middle" attack demoed/described by @exploitph in his recent PoC and research. Supports ARP spoofing to targets/gateway - if you can enum usernames and sniff an AS-REQ, basically allows for "unauth kerberoast" 🤯 https://t.co/Hdn3wuIx7b
🔗 https://github.com/Tw1sm/RITM
🐥 [ tweet ]
Created python tooling for the "Roast in the Middle" attack demoed/described by @exploitph in his recent PoC and research. Supports ARP spoofing to targets/gateway - if you can enum usernames and sniff an AS-REQ, basically allows for "unauth kerberoast" 🤯 https://t.co/Hdn3wuIx7b
🔗 https://github.com/Tw1sm/RITM
🐥 [ tweet ]
🔥1
👹 [ snovvcrash, sn🥶vvcr💥sh ]
Woo-hoo, there’s a new kid in town for initial access credential acquiring! As we know from @mohemiv research, we don’t necessarily need SPNs for Kerberoasting, so it’s time to get ready for RID Cycling with ntlmrelayx[.]py 🙈
https://twitter.com/snovvcrash/status/1506286522655461386
🐥 [ tweet ][ quote ]
Woo-hoo, there’s a new kid in town for initial access credential acquiring! As we know from @mohemiv research, we don’t necessarily need SPNs for Kerberoasting, so it’s time to get ready for RID Cycling with ntlmrelayx[.]py 🙈
https://twitter.com/snovvcrash/status/1506286522655461386
🐥 [ tweet ][ quote ]
😈 [ eversinc33, eversinc33 ]
Had some fun implementing the trampoline technique to make sure all syscalls go through NTDLL into the Nim HellsGate implementation by zimawhit3. Thank you @passthehashbrwn for the blog on hiding syscalls! (https://t.co/YfUqAglams)
https://t.co/IicLY1WkY4
🔗 https://passthehashbrowns.github.io/hiding-your-syscalls
🔗 https://github.com/eversinc33/HellsGate-Trampoline
🐥 [ tweet ]
Had some fun implementing the trampoline technique to make sure all syscalls go through NTDLL into the Nim HellsGate implementation by zimawhit3. Thank you @passthehashbrwn for the blog on hiding syscalls! (https://t.co/YfUqAglams)
https://t.co/IicLY1WkY4
🔗 https://passthehashbrowns.github.io/hiding-your-syscalls
🔗 https://github.com/eversinc33/HellsGate-Trampoline
🐥 [ tweet ]
😈 [ Alh4zr3d, Alh4zr3d ]
Red Teamers, following my previous tweet on hiding procs, now we hide SSH connections:
"ssh -o UserKnownHostsFile=/dev/null -T user@target.com 'bash -i'"
Your user:
- is not added to /var/log/utmp
- won't appear in w or who cmd
- has no .profile or .bash_profile
#redteaming
🐥 [ tweet ]
Red Teamers, following my previous tweet on hiding procs, now we hide SSH connections:
"ssh -o UserKnownHostsFile=/dev/null -T user@target.com 'bash -i'"
Your user:
- is not added to /var/log/utmp
- won't appear in w or who cmd
- has no .profile or .bash_profile
#redteaming
🐥 [ tweet ]
🔥1
😈 [ HackingLZ, Justin Elze ]
This is awesome Meterpreter Gets BOF loader support for all your offensive needs. https://t.co/01W4UNgD1d
🔗 https://www.rapid7.com/blog/post/2022/10/07/metasploit-weekly-wrap-up-179/
🐥 [ tweet ]
This is awesome Meterpreter Gets BOF loader support for all your offensive needs. https://t.co/01W4UNgD1d
🔗 https://www.rapid7.com/blog/post/2022/10/07/metasploit-weekly-wrap-up-179/
🐥 [ tweet ]
😈 [ 0xcsandker, Carsten ]
Needed to find where a certain GPO was applied to during last engagement. Hadn't something ready to grab, so now I have. Inline and readable-friendly wrapped code here: https://t.co/EMJ2rJqvYn
🔗 https://gist.github.com/csandker/950d11632534c86012ab9c7cb592b7b5
🐥 [ tweet ]
Needed to find where a certain GPO was applied to during last engagement. Hadn't something ready to grab, so now I have. Inline and readable-friendly wrapped code here: https://t.co/EMJ2rJqvYn
🔗 https://gist.github.com/csandker/950d11632534c86012ab9c7cb592b7b5
🐥 [ tweet ]
😈 [ m3g9tr0n, Spiros Fraganastasis ]
PeNet is a parser for Windows Portable Executable headers. It completely written in C# and does not rely on any native Windows APIs. Furthermore it supports the creation of Import Hashes (ImpHash), which is a feature often used in malware analysis. https://t.co/MPZvqvocfO
🔗 https://github.com/secana/PeNet
🐥 [ tweet ]
PeNet is a parser for Windows Portable Executable headers. It completely written in C# and does not rely on any native Windows APIs. Furthermore it supports the creation of Import Hashes (ImpHash), which is a feature often used in malware analysis. https://t.co/MPZvqvocfO
🔗 https://github.com/secana/PeNet
🐥 [ tweet ]
😈 [ KlezVirus, d3adc0de ]
[Video] The 4th episode of my series about Inceptor is out: "Empowering Donut with Direct and Indirect Syscalls".
In this video, we'll show how it is possible to improve the donut loader by intergating it with SW3.
https://t.co/xNK4HNz9qS
🔗 https://youtu.be/ypX7N4498xE
🐥 [ tweet ]
[Video] The 4th episode of my series about Inceptor is out: "Empowering Donut with Direct and Indirect Syscalls".
In this video, we'll show how it is possible to improve the donut loader by intergating it with SW3.
https://t.co/xNK4HNz9qS
🔗 https://youtu.be/ypX7N4498xE
🐥 [ tweet ]
😈 [ ippsec, ippsec ]
Starting to play more with Elastic, so just published a video installing v8 it on Ubuntu 22. Really impressed with Fleet so far, the last time I played with Elastic it was a PITA keeping all the agent configs in sync. Fleet's auto update of agents is magic https://t.co/fbQkWgbJKW
🔗 https://www.youtube.com/watch?v=Ts-ofIVRMo4
🐥 [ tweet ]
Starting to play more with Elastic, so just published a video installing v8 it on Ubuntu 22. Really impressed with Fleet so far, the last time I played with Elastic it was a PITA keeping all the agent configs in sync. Fleet's auto update of agents is magic https://t.co/fbQkWgbJKW
🔗 https://www.youtube.com/watch?v=Ts-ofIVRMo4
🐥 [ tweet ]
😈 [ dec0ne, Mor Davidovich ]
Introducing ShadowSpray, it's like password spray but with shadow credentials. More info in the repo.
Huge thanks to @elad_shamir for the amazing technique and to @harmj0y (and others) for the implementation in Rubeus from which a lot of code was taken.
https://t.co/nIsnmaitfw
🔗 https://github.com/Dec0ne/ShadowSpray/
🐥 [ tweet ]
Introducing ShadowSpray, it's like password spray but with shadow credentials. More info in the repo.
Huge thanks to @elad_shamir for the amazing technique and to @harmj0y (and others) for the implementation in Rubeus from which a lot of code was taken.
https://t.co/nIsnmaitfw
🔗 https://github.com/Dec0ne/ShadowSpray/
🐥 [ tweet ]