This media is not supported in your browser
VIEW IN TELEGRAM
😈 [ EmpireC2Project, Empire ]
How about pop-out windows and a process tab? Only 6 more days until Empire 5.0.
🐥 [ tweet ]
How about pop-out windows and a process tab? Only 6 more days until Empire 5.0.
🐥 [ tweet ]
выглядит круто, конечно, но такой он «игрушечный» все-таки👹 [ snovvcrash, sn🥶vvcr💥sh ]
Feeling guilty about steeling #DInvoke version of #RunPE from @_RastaMouse’s #SharpC2 for DInjector, but man this looks so 🔥🤤
🐥 [ tweet ][ quote ]
Feeling guilty about steeling #DInvoke version of #RunPE from @_RastaMouse’s #SharpC2 for DInjector, but man this looks so 🔥🤤
🐥 [ tweet ][ quote ]
🔥5
😈 [ 0x6d69636b, Michael Schneider ]
I wrote about the Microsoft Defender configuration with Microsoft Intune and what's different compared to GPO.
Surprise: Non-admin users can read exclusion lists! https://t.co/50zkrFKkSC
🔗 https://www.scip.ch/en/?labs.20230216
🐥 [ tweet ]
I wrote about the Microsoft Defender configuration with Microsoft Intune and what's different compared to GPO.
Surprise: Non-admin users can read exclusion lists! https://t.co/50zkrFKkSC
🔗 https://www.scip.ch/en/?labs.20230216
🐥 [ tweet ]
😈 [ decoder_it, ap ]
Short blog post on security issue in Windows group policy processing, fixed in CVE-2022-37955 https://t.co/fhoYftdOhQ
🔗 http://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955/
🐥 [ tweet ]
Short blog post on security issue in Windows group policy processing, fixed in CVE-2022-37955 https://t.co/fhoYftdOhQ
🔗 http://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955/
🐥 [ tweet ]
😈 [ pdiscoveryio, ProjectDiscovery.io ]
Our very own @olearycrew is new to the security engineering game - but he was able to use ProjectDiscovery tools to get his first bug bounty (from a Fortune 50 company no less).
Learn how: https://t.co/G64avj7AFM
#hackwithautomation #pdteam
🔗 https://blog.projectdiscovery.io/using-pd-tools-to-find-my-first-subdomain-takeover/
🐥 [ tweet ]
Our very own @olearycrew is new to the security engineering game - but he was able to use ProjectDiscovery tools to get his first bug bounty (from a Fortune 50 company no less).
Learn how: https://t.co/G64avj7AFM
#hackwithautomation #pdteam
🔗 https://blog.projectdiscovery.io/using-pd-tools-to-find-my-first-subdomain-takeover/
🐥 [ tweet ]
😈 [ biskopp3n, biskopp3n ]
Released a new Backup Operator to Domain Admin tool. It contains 4 different methods for escalation, more methods will be added: https://t.co/UytiiAipIO
🔗 https://github.com/improsec/BackupOperatorToolkit
🐥 [ tweet ]
Released a new Backup Operator to Domain Admin tool. It contains 4 different methods for escalation, more methods will be added: https://t.co/UytiiAipIO
🔗 https://github.com/improsec/BackupOperatorToolkit
🐥 [ tweet ]
😈 [ 0x0SojalSec, Md Ismail Šojal ]
#oneliner
✅ Subdomain enumeration
✅ Full port scan
✅ HTTP web server detection
#security #bugbountytips #portscan #subdomain #chaos
🐥 [ tweet ]
#oneliner
✅ Subdomain enumeration
✅ Full port scan
✅ HTTP web server detection
#security #bugbountytips #portscan #subdomain #chaos
🐥 [ tweet ]
😈 [ _RastaMouse, Rasta Mouse ]
ThreadlessInject updated with Nt APIs
https://t.co/GFghBMLedm
🔗 https://github.com/CCob/ThreadlessInject
🐥 [ tweet ]
ThreadlessInject updated with Nt APIs
https://t.co/GFghBMLedm
🔗 https://github.com/CCob/ThreadlessInject
🐥 [ tweet ]
😈 [ bugch3ck, Jonas Vestberg ]
Disclosed today at @Disobey_fi - psexec from #impacket expose the target system for authenticated command execution as SYSTEM. That means any user that can authenticate over the network (usually Domain Users) can run code as SYSTEM over the network.
🐥 [ tweet ]
Disclosed today at @Disobey_fi - psexec from #impacket expose the target system for authenticated command execution as SYSTEM. That means any user that can authenticate over the network (usually Domain Users) can run code as SYSTEM over the network.
🐥 [ tweet ]
Forwarded from RedTeam brazzers
После компрометации домена встала задача: проанализировать, проводились ли какие нибудь атаки на ACL в AD и остались ли какие нибудь закладки? Беглый взгляд на текущие состояние домена привел меня в ужас. Было совершенно не понятно какие ACL появились после компрометации, а какие были до. При этом под рукой был бэкап контроллера домена до взлома. Оказывается в инструменте ADExplorer есть режим сравнения двух дампов LDAP схемы. Этот функционал просто прекрасен! Сравнив 2 дампа я выявил странные аномалии и изменения в атрибуте NtSecurityDenoscriptor, которые удобее было уже посмотреть в BloodHound (напомню, можно дамп ADExplorer удобно конвертировать в json для BloodHound с помощью скрипта). Зачем смотреть в BloodHound? Дело в том, что ACL в ADExplorer представляются в формате Security Denoscriptor Definition Language (SDDL) , к тому же не все ACL нам интересны, а только опасные (Generic'и и специфичные), а их нам подсветит именно BloodHound.
Так же данный приём по сравнению схем LDAP удобно использовать BlueTeam: уходя в отпуск сделайте один дамп, а вернувшись - второй. А потом сравните что и где наделали админы, пока вас не было на рабочем месте))
Так же данный приём по сравнению схем LDAP удобно использовать BlueTeam: уходя в отпуск сделайте один дамп, а вернувшись - второй. А потом сравните что и где наделали админы, пока вас не было на рабочем месте))
🔥3
😈 [ ustayready, Mike Felch (Stay Ready) ]
Dropped a small utility that splits a large BloodHound/AzureHound JSON file into a bunch of smaller files. Is helpful when you encounter a large environment and have a multi-gb JSON file. https://t.co/Fh91IEVrPO
🔗 https://github.com/ustayready/ShredHound
🐥 [ tweet ]
Dropped a small utility that splits a large BloodHound/AzureHound JSON file into a bunch of smaller files. Is helpful when you encounter a large environment and have a multi-gb JSON file. https://t.co/Fh91IEVrPO
🔗 https://github.com/ustayready/ShredHound
🐥 [ tweet ]
😈 [ _Kudaes_, Kurosh Dabbagh ]
This was such a simple and "stupid" idea, but at the end it seems it's working. Apply a divide and conquer approach to perform remote process injection (or any other activity) bypassing some of the most common EDRs out there.
https://t.co/CIGsgZ447q
🔗 https://github.com/Kudaes/Split
🐥 [ tweet ]
This was such a simple and "stupid" idea, but at the end it seems it's working. Apply a divide and conquer approach to perform remote process injection (or any other activity) bypassing some of the most common EDRs out there.
https://t.co/CIGsgZ447q
🔗 https://github.com/Kudaes/Split
🐥 [ tweet ]
😈 [ 0xLegacyy, Jordan Jay ]
Converted @_EthicalChaos_'s novel threadless process injection project into a BOF.
Gain shellcode execution via using a relative call to hook an exported function within the remote process.
https://t.co/TLGfEmDCGs
🔗 https://github.com/iiLegacyyii/ThreadlessInject-BOF
🐥 [ tweet ]
Converted @_EthicalChaos_'s novel threadless process injection project into a BOF.
Gain shellcode execution via using a relative call to hook an exported function within the remote process.
https://t.co/TLGfEmDCGs
🔗 https://github.com/iiLegacyyii/ThreadlessInject-BOF
🐥 [ tweet ]
Offensive Xwitter
😈 [ bugch3ck, Jonas Vestberg ] Disclosed today at @Disobey_fi - psexec from #impacket expose the target system for authenticated command execution as SYSTEM. That means any user that can authenticate over the network (usually Domain Users) can run code as…
😈 [ cube0x0, Cube0x0 ]
@bugch3ck @Disobey_fi @ippsec is way ahead of you ;) https://t.co/zfbBrPEKTP
🔗 https://youtu.be/VVZZgqIyD0Q?t=2692
🐥 [ tweet ]
@bugch3ck @Disobey_fi @ippsec is way ahead of you ;) https://t.co/zfbBrPEKTP
🔗 https://youtu.be/VVZZgqIyD0Q?t=2692
🐥 [ tweet ]
хд хд😈 [ an0n_r0, an0n ]
here is the public release of the serviceDetector noscript (featuring [MS-LSAT] LsarLookupNames() for detecting the installed state and named pipe enumeration for detecting the running state of a service): https://t.co/7A0s6jfgTM
🔗 https://github.com/tothi/serviceDetector
🐥 [ tweet ][ quote ]
here is the public release of the serviceDetector noscript (featuring [MS-LSAT] LsarLookupNames() for detecting the installed state and named pipe enumeration for detecting the running state of a service): https://t.co/7A0s6jfgTM
🔗 https://github.com/tothi/serviceDetector
🐥 [ tweet ][ quote ]
😈 [ M4yFly, Mayfly ]
Major GOAD refactor and update today 🥳
Add RDP bot user
Add Webdav support
Ansible inventory was refactored, you can now find it on the lab folder (ad/sevenkingdoms.local/inventory).
And now you can easily build your own lab from the template : https://t.co/MM8H9y9ze6
🔗 https://github.com/Orange-Cyberdefense/GOAD/tree/main/ad/template.lab
🐥 [ tweet ]
Major GOAD refactor and update today 🥳
Add RDP bot user
Add Webdav support
Ansible inventory was refactored, you can now find it on the lab folder (ad/sevenkingdoms.local/inventory).
And now you can easily build your own lab from the template : https://t.co/MM8H9y9ze6
🔗 https://github.com/Orange-Cyberdefense/GOAD/tree/main/ad/template.lab
🐥 [ tweet ]
😈 [ mpgn_x64, mpgn ]
It's 2023, CrackMapExec can now dump DPAPI credentials as a core feature !🚀
This is possible thanks to the work of @_zblurx and his library dploot ! He also added a module to dump firefox passwords 🔥
Pushed on @porchetta_ind v5.4.5 Bruce Wayne 🪂
No excuse, DA everytime, 🔽
🐥 [ tweet ]
It's 2023, CrackMapExec can now dump DPAPI credentials as a core feature !🚀
This is possible thanks to the work of @_zblurx and his library dploot ! He also added a module to dump firefox passwords 🔥
Pushed on @porchetta_ind v5.4.5 Bruce Wayne 🪂
No excuse, DA everytime, 🔽
🐥 [ tweet ]