😈 [ 0xLegacyy, Jordan Jay ]
Converted @_EthicalChaos_'s novel threadless process injection project into a BOF.
Gain shellcode execution via using a relative call to hook an exported function within the remote process.
https://t.co/TLGfEmDCGs
🔗 https://github.com/iiLegacyyii/ThreadlessInject-BOF
🐥 [ tweet ]
Converted @_EthicalChaos_'s novel threadless process injection project into a BOF.
Gain shellcode execution via using a relative call to hook an exported function within the remote process.
https://t.co/TLGfEmDCGs
🔗 https://github.com/iiLegacyyii/ThreadlessInject-BOF
🐥 [ tweet ]
Offensive Xwitter
😈 [ bugch3ck, Jonas Vestberg ] Disclosed today at @Disobey_fi - psexec from #impacket expose the target system for authenticated command execution as SYSTEM. That means any user that can authenticate over the network (usually Domain Users) can run code as…
😈 [ cube0x0, Cube0x0 ]
@bugch3ck @Disobey_fi @ippsec is way ahead of you ;) https://t.co/zfbBrPEKTP
🔗 https://youtu.be/VVZZgqIyD0Q?t=2692
🐥 [ tweet ]
@bugch3ck @Disobey_fi @ippsec is way ahead of you ;) https://t.co/zfbBrPEKTP
🔗 https://youtu.be/VVZZgqIyD0Q?t=2692
🐥 [ tweet ]
хд хд😈 [ an0n_r0, an0n ]
here is the public release of the serviceDetector noscript (featuring [MS-LSAT] LsarLookupNames() for detecting the installed state and named pipe enumeration for detecting the running state of a service): https://t.co/7A0s6jfgTM
🔗 https://github.com/tothi/serviceDetector
🐥 [ tweet ][ quote ]
here is the public release of the serviceDetector noscript (featuring [MS-LSAT] LsarLookupNames() for detecting the installed state and named pipe enumeration for detecting the running state of a service): https://t.co/7A0s6jfgTM
🔗 https://github.com/tothi/serviceDetector
🐥 [ tweet ][ quote ]
😈 [ M4yFly, Mayfly ]
Major GOAD refactor and update today 🥳
Add RDP bot user
Add Webdav support
Ansible inventory was refactored, you can now find it on the lab folder (ad/sevenkingdoms.local/inventory).
And now you can easily build your own lab from the template : https://t.co/MM8H9y9ze6
🔗 https://github.com/Orange-Cyberdefense/GOAD/tree/main/ad/template.lab
🐥 [ tweet ]
Major GOAD refactor and update today 🥳
Add RDP bot user
Add Webdav support
Ansible inventory was refactored, you can now find it on the lab folder (ad/sevenkingdoms.local/inventory).
And now you can easily build your own lab from the template : https://t.co/MM8H9y9ze6
🔗 https://github.com/Orange-Cyberdefense/GOAD/tree/main/ad/template.lab
🐥 [ tweet ]
😈 [ mpgn_x64, mpgn ]
It's 2023, CrackMapExec can now dump DPAPI credentials as a core feature !🚀
This is possible thanks to the work of @_zblurx and his library dploot ! He also added a module to dump firefox passwords 🔥
Pushed on @porchetta_ind v5.4.5 Bruce Wayne 🪂
No excuse, DA everytime, 🔽
🐥 [ tweet ]
It's 2023, CrackMapExec can now dump DPAPI credentials as a core feature !🚀
This is possible thanks to the work of @_zblurx and his library dploot ! He also added a module to dump firefox passwords 🔥
Pushed on @porchetta_ind v5.4.5 Bruce Wayne 🪂
No excuse, DA everytime, 🔽
🐥 [ tweet ]
😈 [ beriberikix, Jonathan Beri ]
👀 Browser-based Telnet demo using the much-discussed Direct Sockets API: https://t.co/6YUFHdYXne
🔗 https://github.com/GoogleChromeLabs/telnet-client
🐥 [ tweet ]
👀 Browser-based Telnet demo using the much-discussed Direct Sockets API: https://t.co/6YUFHdYXne
🔗 https://github.com/GoogleChromeLabs/telnet-client
🐥 [ tweet ]
телнет в хроме? 🤔😈 [ pdiscoveryio, ProjectDiscovery.io ]
Check out the first video in our new series, “Nuclei Fundamentals.” In this series, we'll cover all of @pdnuclei – from the basics of getting started to advanced use cases for penetration testing.
https://t.co/WG1YdfskW0
🔗 https://www.youtube.com/watch?v=b5qMyQvL1ZA
🐥 [ tweet ]
Check out the first video in our new series, “Nuclei Fundamentals.” In this series, we'll cover all of @pdnuclei – from the basics of getting started to advanced use cases for penetration testing.
https://t.co/WG1YdfskW0
🔗 https://www.youtube.com/watch?v=b5qMyQvL1ZA
🐥 [ tweet ]
😈 [ FuzzySec, b33f ]
Check out the blog post I wrote for IBM @XForce. I provide an analysis of DKOM attacks on Kernel ETW providers, give technical implementation details and tie that back to in-the-wild capabilities used by Lazarus last year 🔪🔥 https://t.co/pcSGzXvYxg
🔗 https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
🐥 [ tweet ]
Check out the blog post I wrote for IBM @XForce. I provide an analysis of DKOM attacks on Kernel ETW providers, give technical implementation details and tie that back to in-the-wild capabilities used by Lazarus last year 🔪🔥 https://t.co/pcSGzXvYxg
🔗 https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
🐥 [ tweet ]
Forwarded from Netsec
A Deep Dive Into a PoshC2 Implant
https://ift.tt/ZXC31Eo
Submitted February 21, 2023 at 08:32PM by CyberMasterV
via reddit https://ift.tt/UYRiqj5
https://ift.tt/ZXC31Eo
Submitted February 21, 2023 at 08:32PM by CyberMasterV
via reddit https://ift.tt/UYRiqj5
SecurityScorecard
Resources
Explore cybersecurity white papers, data sheets, webinars, videos, informative blogs, and more with SecurityScorecard.
😈 [ N4k3dTurtl3, NA ]
New post and Impacket improvement from @Icebreaker_Team's @Crypt0s https://t.co/EaNpnK8SWL
🔗 https://icebreaker.team/blogs/dumping-passwords-from-microsoft-active-directory-lightweight-directory-services-ad-lds/
🐥 [ tweet ]
New post and Impacket improvement from @Icebreaker_Team's @Crypt0s https://t.co/EaNpnK8SWL
🔗 https://icebreaker.team/blogs/dumping-passwords-from-microsoft-active-directory-lightweight-directory-services-ad-lds/
🐥 [ tweet ]
😈 [ 0xBoku, Bobby Cooke ]
DLL module stomping and all beacon memory allocators are now supported! The options are pulled right from the malleable C2 profile!
VirtualAlloc is the only one via direct syscall. The new allocators DLL module stomping, HeapAlloc, MapViewOfFile, were https://t.co/WnolPE5YIw
🔗 https://github.com/xforcered/BokuLoader
🐥 [ tweet ]
DLL module stomping and all beacon memory allocators are now supported! The options are pulled right from the malleable C2 profile!
VirtualAlloc is the only one via direct syscall. The new allocators DLL module stomping, HeapAlloc, MapViewOfFile, were https://t.co/WnolPE5YIw
🔗 https://github.com/xforcered/BokuLoader
🐥 [ tweet ]
😈 [ yarden_shafir, Yarden Shafir ]
PPLs (aka "not a security boundary") are getting some new protections in Windows 11. One of them fixes a technique documented by @elastic last year where they "sandbox" Windows Defender by modifying its token: https://t.co/kt6bl3czjN
🔗 https://www.elastic.co/security-labs/sandboxing-antimalware-products
🐥 [ tweet ]
PPLs (aka "not a security boundary") are getting some new protections in Windows 11. One of them fixes a technique documented by @elastic last year where they "sandbox" Windows Defender by modifying its token: https://t.co/kt6bl3czjN
🔗 https://www.elastic.co/security-labs/sandboxing-antimalware-products
🐥 [ tweet ]
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Offensive Xwitter
Photo
Небольшой тизер 🙈
Пока готовится вторая часть, с первой можно ознакомиться по ссылке ⬇️
🔗 https://habr.com/ru/company/angarasecurity/blog/661341/
UPD. Произошли технические шоколадки, пока релиз переносится на неопределенный срок (сказали, что незя про такое писать в паблик). We’re sorry.
Пока готовится вторая часть, с первой можно ознакомиться по ссылке ⬇️
🔗 https://habr.com/ru/company/angarasecurity/blog/661341/
UPD. Произошли технические шоколадки, пока релиз переносится на неопределенный срок (сказали, что незя про такое писать в паблик). We’re sorry.
🔥8😢2
😈 [ 0x6d69636b, Michael Schneider ]
Use Flipper Zero to attack wireless peripherals, an article of my colleague @wr3ckralph: https://t.co/KGZ69fjUEH
🔗 https://www.scip.ch/en/?labs.20230223
🐥 [ tweet ]
Use Flipper Zero to attack wireless peripherals, an article of my colleague @wr3ckralph: https://t.co/KGZ69fjUEH
🔗 https://www.scip.ch/en/?labs.20230223
🐥 [ tweet ]
😈 [ 0gtweet, Grzegorz Tworek ]
Need an almost invisible, post-exploitation, persistent, fileless, LPE backdoor? There are many, but this one looks really beautiful for me: type "sc.exe sdset scmanager D:(A;;KA;;;WD)" from an elevated command prompt.
🐥 [ tweet ]
Проверить на предмет компрометации можно так:
Need an almost invisible, post-exploitation, persistent, fileless, LPE backdoor? There are many, but this one looks really beautiful for me: type "sc.exe sdset scmanager D:(A;;KA;;;WD)" from an elevated command prompt.
🐥 [ tweet ]
Проверить на предмет компрометации можно так:
ConvertFrom-SddlString -Sddl $(sc.exe sdshow scmanager | select -Last 1) | select -Expand DiscretionaryAcl
😈 [ BlWasp_, BlackWasp ]
I've added the last *Potato exploits to my article which follows the various developments regarding these EoP techiques. Normally up-to-date with the recents JuicyPotatoNG, CertPotato and LocalPotato : https://t.co/xRR41cr3Cm
🔗 https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all
🐥 [ tweet ]
I've added the last *Potato exploits to my article which follows the various developments regarding these EoP techiques. Normally up-to-date with the recents JuicyPotatoNG, CertPotato and LocalPotato : https://t.co/xRR41cr3Cm
🔗 https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all
🐥 [ tweet ]
😈 [ ShitSecure, S3cur3Th1sSh1t ]
This inspired me to make it Powershell Add-Type compatible:
https://t.co/RBPe0kXXhj
Easy Hardware Breakpoint AMSI bypass for everyone 🤓
🔗 https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e
🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell#Using-Hardware-Breakpoints
🐥 [ tweet ][ quote ]
This inspired me to make it Powershell Add-Type compatible:
https://t.co/RBPe0kXXhj
Easy Hardware Breakpoint AMSI bypass for everyone 🤓
🔗 https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e
🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell#Using-Hardware-Breakpoints
🐥 [ tweet ][ quote ]
😈 [ BHinfoSecurity, Black Hills Information Security ]
BHIS | Tester's Blog
Have you ever encountered a situation where port forwarding limited your pivot attempts? How did you manage to overcome this limitation?
Forwarding Traffic Through SSH
by: @nand0ps
Published: 2/23/2023
Learn more: https://t.co/mvjIz6kR5y
🔗 https://www.blackhillsinfosec.com/forwarding-traffic-through-ssh/
🐥 [ tweet ]
BHIS | Tester's Blog
Have you ever encountered a situation where port forwarding limited your pivot attempts? How did you manage to overcome this limitation?
Forwarding Traffic Through SSH
by: @nand0ps
Published: 2/23/2023
Learn more: https://t.co/mvjIz6kR5y
🔗 https://www.blackhillsinfosec.com/forwarding-traffic-through-ssh/
🐥 [ tweet ]
😈 [ Tract0r_, Tract0r ]
I've written a new blog post about Sacrificial Sessions.
If you would like to know more about how to not mess up with Kerberos tickets on your next engagement, check it out.
https://t.co/au3au48ljh
🔗 https://unshade.tech/sacrificial-session
🐥 [ tweet ]
I've written a new blog post about Sacrificial Sessions.
If you would like to know more about how to not mess up with Kerberos tickets on your next engagement, check it out.
https://t.co/au3au48ljh
🔗 https://unshade.tech/sacrificial-session
🐥 [ tweet ]