😈 [ Andrew Oliveau @AndrewOliveau ]

💥BOOM!💥 Another privilege escalation blog, this time showcasing how to convert arbitrary file deletions 🗑️ to SYSTEM command prompt🌈 CVE-2023-27470. Learn about TOCTOU, pseudo-symlinks, MSI rollback exploits, and, of course, how to protect yourselves!

🔗 https://www.mandiant.com/resources/blog/arbitrary-file-deletion-vulnerabilities

🐥 [ tweet ]

😈 [ ShorSec Cyber Security @ShorSecLtd ]

🔥New Blog Post Alert!
The next chapter in our "The Path to DA" series is now live: "(Relaying) To The Internet And Back".
This entry, by @dec0ne, explores yet another route to DA, focusing on the intricacies of ADIDNS Abuse, LDAP relay, RBCD, and more.

🔗 https://shorsec.io/blog/the-path-to-da-part-2-relaying-to-the-internet-and-back/

🐥 [ tweet ]

😈 [ Vincent Yiu @vysecurity ]

DevTunnels, blue are going to begin searching for DevTunnels.ms. Get ready ahead of time and use domains like:

global.rel.tunnels.api.visualstudio.com
tunnels-prod-rel-tm.trafficmanager.net
*.app.github.dev

🔗 https://www.syonsecurity.com/post/devtunnels-for-c2

🐥 [ tweet ]

😈 [ Rohan Aggarwal @nahoragg ]

My talk "Bypassing Anti-Cheats & Hacking Competitive Games" from @securityfest is now available on Youtube. #game #Hacking

🔗 https://youtu.be/bTU7huCmFXA

🐥 [ tweet ]

😈 [ Antonio Cocomazzi @splinter_code ]

Excited to share my hardest research about UAC 🤯

"Bypassing UAC with SSPI Datagram Contexts" 🔥

In a nutshell:
✅ Works on latest Windows 11 down to Windows 7
✅ Works on both domain-joined and non-domain-joined machines
✅ Works without using UI hacks or any auto Works without using UI hacks or any auto elevated binary/interface
✅ Works with maximum UAC level settings *Always Notify*
✅ Not a security boundary / Won’t Fix

Enjoy the read! 👇

🔗 https://splintercod3.blogspot.com/p/bypassing-uac-with-sspi-datagram.html

🐥 [ tweet ]

😈 [ an0n @an0n_r0 ]

nothing novel, just playing with screenshot capture in PowerShell: get the screenshot to clipboard by sending PrtSc key using PS, send the image in an HTTP POST body, receive it with least effort using a CGI handler ran by Python http[.]server.

🐥 [ tweet ]

😈 [ SkelSec @SkelSec ]

Weeeee! My Defcon talk is now on Youtube!

🔗 https://www.youtube.com/watch?v=7oAZK8x_mL0
🔗 https://github.com/skelsec/wsnet
🔗 https://github.com/skelsec/wsnet-dotnet

🐥 [ tweet ]

@skelsec гений, indeed

😈 [ Adam Chester 🏴‍☠️ @_xpn_ ]

My Okta for Red Teamers post is up! We look at how Kerberos SSO works, how to intercept credentials via a fake AD Agent, decrypting AD Agent tokens, adding skeleton key's, and even how to deploy a janky SAML IdP server to auth as any user for good measure.

🔗 https://www.trustedsec.com/blog/okta-for-red-teamers/

🐥 [ tweet ]

😈 [ јаmеѕ ███████ @rotarydrone ]

Awesome stuff 🔥 The AD agent hijack here is much stealthier (and cooler) than injecting a DLL.

Here's a nim example for LogonUser hooking, ala PTASpy or @_xpn_'s blog on AADC for red teams. This also works for the AD agent:

🔗 https://gist.githubusercontent.com/rotarydrone/645f77f7e778da75800d1cde4013da2f/raw/a7a12e6e4529f4d09037ee6d908ead89500aa1ad/LogonUserSpy.nim

🐥 [ tweet ][ quote ]

😈 [ Dylan Tran @d_tranman ]

Dug into call stacks spoofing for the past few months and wrote something. Hopefully this is helpful.

🔗 https://dtsec.us/2023-09-15-StackSpoofin/

🐥 [ tweet ]

😈 [ Greg Darwin @gregdarwin ]

Cobalt Strike 4.9 is now live. This release adds UDRL support for post-ex DLLs, the ability to export Beacon without a reflective loader, support for callbacks, a Beacon data store and more. Check out the blog post for details:

🔗 https://www.cobaltstrike.com/blog/cobalt-strike-49-take-me-to-your-loader

🐥 [ tweet ]

Психанул, когда rpcclient в очередной раз сломался о старые протоколы, а сделать резолв имя↔️сид надо было здесь и сейчас:

🔗 https://github.com/fortra/impacket/pull/1618

😈 [ Omri Baso @omri_baso ]

Any new novel technique I researched for lateral movement by stealing tokens while abusing the RPC named pipe \\pipe\LSM_API_service

🔗 https://medium.com/p/a23965e8227e

🐥 [ tweet ]

😈 [ Rasta Mouse @_RastaMouse ]

Experimenting with a basic stage0 that allows you to roll your own implants and stage them from external C2 frameworks.

🔗 https://youtu.be/wvDm6Ro0g1g

🐥 [ tweet ]

😈 [ MalDev Academy @MalDevAcademy ]

Our EXE loader is now available to everyone on GitHub:

We'll be uploading more repositories on our GitHub in the future.

🔗 https://github.com/Maldev-Academy/MaldevAcademyLdr.1

🐥 [ tweet ]

Хз че это, но все постят https://news.1rj.ru/str/OffensiveTwitter?boost