😈 [ Vincent Yiu @vysecurity ]

DevTunnels, blue are going to begin searching for DevTunnels.ms. Get ready ahead of time and use domains like:

global.rel.tunnels.api.visualstudio.com
tunnels-prod-rel-tm.trafficmanager.net
*.app.github.dev

🔗 https://www.syonsecurity.com/post/devtunnels-for-c2

🐥 [ tweet ]

😈 [ Rohan Aggarwal @nahoragg ]

My talk "Bypassing Anti-Cheats & Hacking Competitive Games" from @securityfest is now available on Youtube. #game #Hacking

🔗 https://youtu.be/bTU7huCmFXA

🐥 [ tweet ]

😈 [ Antonio Cocomazzi @splinter_code ]

Excited to share my hardest research about UAC 🤯

"Bypassing UAC with SSPI Datagram Contexts" 🔥

In a nutshell:
✅ Works on latest Windows 11 down to Windows 7
✅ Works on both domain-joined and non-domain-joined machines
✅ Works without using UI hacks or any auto Works without using UI hacks or any auto elevated binary/interface
✅ Works with maximum UAC level settings *Always Notify*
✅ Not a security boundary / Won’t Fix

Enjoy the read! 👇

🔗 https://splintercod3.blogspot.com/p/bypassing-uac-with-sspi-datagram.html

🐥 [ tweet ]

😈 [ an0n @an0n_r0 ]

nothing novel, just playing with screenshot capture in PowerShell: get the screenshot to clipboard by sending PrtSc key using PS, send the image in an HTTP POST body, receive it with least effort using a CGI handler ran by Python http[.]server.

🐥 [ tweet ]

😈 [ SkelSec @SkelSec ]

Weeeee! My Defcon talk is now on Youtube!

🔗 https://www.youtube.com/watch?v=7oAZK8x_mL0
🔗 https://github.com/skelsec/wsnet
🔗 https://github.com/skelsec/wsnet-dotnet

🐥 [ tweet ]

@skelsec гений, indeed

😈 [ Adam Chester 🏴‍☠️ @_xpn_ ]

My Okta for Red Teamers post is up! We look at how Kerberos SSO works, how to intercept credentials via a fake AD Agent, decrypting AD Agent tokens, adding skeleton key's, and even how to deploy a janky SAML IdP server to auth as any user for good measure.

🔗 https://www.trustedsec.com/blog/okta-for-red-teamers/

🐥 [ tweet ]

😈 [ јаmеѕ ███████ @rotarydrone ]

Awesome stuff 🔥 The AD agent hijack here is much stealthier (and cooler) than injecting a DLL.

Here's a nim example for LogonUser hooking, ala PTASpy or @_xpn_'s blog on AADC for red teams. This also works for the AD agent:

🔗 https://gist.githubusercontent.com/rotarydrone/645f77f7e778da75800d1cde4013da2f/raw/a7a12e6e4529f4d09037ee6d908ead89500aa1ad/LogonUserSpy.nim

🐥 [ tweet ][ quote ]

😈 [ Dylan Tran @d_tranman ]

Dug into call stacks spoofing for the past few months and wrote something. Hopefully this is helpful.

🔗 https://dtsec.us/2023-09-15-StackSpoofin/

🐥 [ tweet ]

😈 [ Greg Darwin @gregdarwin ]

Cobalt Strike 4.9 is now live. This release adds UDRL support for post-ex DLLs, the ability to export Beacon without a reflective loader, support for callbacks, a Beacon data store and more. Check out the blog post for details:

🔗 https://www.cobaltstrike.com/blog/cobalt-strike-49-take-me-to-your-loader

🐥 [ tweet ]

Психанул, когда rpcclient в очередной раз сломался о старые протоколы, а сделать резолв имя↔️сид надо было здесь и сейчас:

🔗 https://github.com/fortra/impacket/pull/1618

😈 [ Omri Baso @omri_baso ]

Any new novel technique I researched for lateral movement by stealing tokens while abusing the RPC named pipe \\pipe\LSM_API_service

🔗 https://medium.com/p/a23965e8227e

🐥 [ tweet ]

😈 [ Rasta Mouse @_RastaMouse ]

Experimenting with a basic stage0 that allows you to roll your own implants and stage them from external C2 frameworks.

🔗 https://youtu.be/wvDm6Ro0g1g

🐥 [ tweet ]

😈 [ MalDev Academy @MalDevAcademy ]

Our EXE loader is now available to everyone on GitHub:

We'll be uploading more repositories on our GitHub in the future.

🔗 https://github.com/Maldev-Academy/MaldevAcademyLdr.1

🐥 [ tweet ]

Хз че это, но все постят https://news.1rj.ru/str/OffensiveTwitter?boost

😈 [ Chris Thompson @_Mayyhem ]

The entire SCCM hierarchy is vulnerable to takeover from any primary site because by design, there is no security boundary between sites in the same hierarchy. Check out my new post to learn more about how this can be abused, mitigated, and detected!

🔗 https://posts.specterops.io/sccm-hierarchy-takeover-41929c61e087

🐥 [ tweet ]