😈 [ lowercase_drm, drm ]

I created a PR that adds TLS Channel Binding compatibility to ldap3 library when used with NTLM authentication: https://t.co/sb3QB7sd1c

🔗 https://github.com/cannatag/ldap3/pull/1087

🐥 [ tweet ]

наконец-то, боже

😈 [ M4yFly, Mayfly ]

Goad pwning part13, let's have fun with file coerce (lnk,url), webclient, impersonate and the old one rdphijack.

https://t.co/we7MA67sfX

🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part13/

🐥 [ tweet ]

😈 [ BoreanJordan, Jordan Borean ]

Just merged in some RPC/DCE changes to pyspnego https://t.co/lDdBqUetLa. I also created a new blob post around some of the details of RPC encryption used by Microsoft that will hopefully be useful for other people implementing their own client https://t.co/clj7oi6eAL

🔗 https://github.com/jborean93/pyspnego/pull/63
🔗 https://wp.me/p9gmIx-ax

🐥 [ tweet ]

😈 [ 0gtweet, Grzegorz Tworek ]

A keylogger/sniffer for the on-screen-keyboard? Sure, ETW is happy to help here with {4F768BE8-9C69-4BBC-87FC-95291D3F9D0C}😁
Enjoy the C source code, and the compiled exe, as usual - https://t.co/FT73HaxM1c

🔗 https://github.com/gtworek/PSBits/tree/master/ETW

🐥 [ tweet ]

Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707)

👤 by testanull

While analyzing CVE-2022-41082, also known as Proxy Not Shell, researcher discovered CVE-2023-21707 vulnerability which he has detailed in this blog.
The vulnerability allows a privileged user to trigger RCE during a deserialization of untrusted data.

📝 Contents:
● Introduction
● The new variant
● Payload delivery
● Demo
● References

https://starlabs.sg/blog/2023/04-microsoft-exchange-powershell-remoting-deserialization-leading-to-rce-cve-2023-21707/

😈 [ s4ntiago_p, S4ntiagoP ]

🔥 Big update!
Nanodump now supports the PPLMedic exploit!
meaning you can dump LSASS on an up-to-date system with PPL enabled 😃

https://t.co/Ki22xU5P4a

🔗 https://github.com/fortra/nanodump

🐥 [ tweet ]

😈 [ rootsecdev, rootsecdev ]

Enjoyed this medium post. It has some excellent recommendations for studying Active Directory. Chisel stuff is spot on. 👇

“AD FOR OSCP (Active Directory Guide)” by Abhishekgk
https://t.co/QSWTosQvlI

🔗 https://link.medium.com/SSaz6xsdqzb

🐥 [ tweet ]

😈 [ mpgn_x64, mpgn ]

The sponsor version of CrackMapExec just receive an update from @MJHallenbeck 🚀

▶️ cme is now using rich logging from @willmcgugan
▶️ a progress bar has been added 🚄🚃🚃
▶️ protocol ssh is now working with a key
▶️ cmedb now store creds found with ssh

@porchetta_ind 🪂

🐥 [ tweet ]

😈 [ kleiton0x7e, Kleiton Kurti ]

Created a blogpost & a PoC for a custom Sleep Mask Kit that obfuscates data within a beacon's stack, prior to custom sleeping, by leveraging CPU cycles.
A great approach against memory investigation.

🗒️Blog: https://t.co/sop7XnF5tc

#cybersecurity #redteam #infosec

🔗 https://whiteknightlabs.com/2023/05/02/masking-the-implant-with-stack-encryption/

🐥 [ tweet ]

😈 [ Nettitude_Labs, Nettitude Labs ]

Introducing ETWHash!

ETWHash is a new method and tool by @lefterispan for consuming SMB events from Event Tracing for Windows (ETW) and extracting NetNTLMv2 hashes for cracking offline.

https://t.co/wLmsQf71J8

🔗 https://labs.nettitude.com/blog/etwhash-he-who-listens-shall-receive/
🔗 https://github.com/nettitude/ETWHash

🐥 [ tweet ]

😈 [ vxunderground, vx-underground ]

Amazon recommended Russian ransomware operator essentials

🐥 [ tweet ]

😈 [ garrfoster, Garrett ]

Sharing a tool I wrote to streamline attacking SCCM. Some features include profiling target servers for admin smb relay attacks, site server takeover, http enrollment, and leveraging the adminservice api.

https://t.co/aiJzWIJNDR

🔗 https://github.com/garrettfoster13/sccmhunter

🐥 [ tweet ]

😈 [ PenTestPartners, Pen Test Partners ]

Our @_EthicalChaos_ found a vuln in Kape's CyberGhost VPN affecting ~3m users & reported it to them. It didn't go well. VDPs cannot be exclusively outsourced to bug bounty platforms. Bullied by Bugcrowd: https://t.co/xT4wJXMqMh

🔗 https://www.pentestpartners.com/security-blog/bullied-by-bugcrowd-over-kape-cyberghost-disclosure/

🐥 [ tweet ]

По мотивам ISCRA | InfoSec Club "Ra" – Введение в специальность: Internal Pentest

😈 [ deadvolvo, I am d3d (dead, мёртв, 死了) ]

@NinjaParanoid They can literally change out Cobalt Strike for BRc4 in my paper, which should add a few more layers of obfuscation from direct detection methods.

https://t.co/8eilbLSKfO

🔗 https://blog.malicious.group/automating-c2-infrastructure-with-terraform-nebula-caddy-and-cobalt-strike/

🐥 [ tweet ]

😈 [ r_redteamsec, /r/redteamsec ]

Building a Red Team Infrastructure in 2023 https://t.co/NiysJBE3EC #redteamsec

🔗 https://www.reddit.com/r/redteamsec/comments/13bkzrh/building_a_red_team_infrastructure_in_2023/

🐥 [ tweet ]

😈 [ its_a_feature_, Cody Thomas ]

It's official! Mythic 3.0 is LIVE! Check out the blog post about it here: https://t.co/LJb77jLqQZ. Highlights include: rpfwds, graph groupings, jupyter notebook, custom webhooks, tags, docker updates, and an entirely new back end!

🔗 https://posts.specterops.io/c2-and-the-docker-dance-mythic-3-0s-marvelous-microservice-moves-f6e6e91356e2

🐥 [ tweet ]

😈 [ _RastaMouse, Rasta Mouse ]

I wrote a little BOF that enumerates the protection level of a PP/PPL process.

https://t.co/98PxBX56OF

🔗 https://github.com/rasta-mouse/PPEnum

🐥 [ tweet ]

😈 [ rootsecdev, rootsecdev ]

“Writing a Sliver C2 Powershell Stager with Shellcode Compression and AES Encryption” by Ycf-Kel
https://t.co/pFI88KOvIX

🔗 https://link.medium.com/MluhuP9NKzb

🐥 [ tweet ]

😈 [ freefirex2, freefirex ]

Converting PPLFault (original: https://t.co/SjSmi2MYJa) has been one of the more difficult BOF converts, but was still pretty fun to tackle :)

🔗 https://github.com/gabriellandau/PPLFault

🐥 [ tweet ]

к теме про https://news.1rj.ru/str/RalfHackerChannel/1330