😈 [ Oddvar Moe @Oddvarmoe ]

Created a noscript using ADExplorersnapshot for dumping interesting information from AD into text files. Info such as active server accounts, sccm, printers, laps passwords, asreproast, plaintext password attributes +++

🔗 https://github.com/c3c/ADExplorerSnapshot.py/pull/43

Decided to go with || as a separator on the out files. Should be easy to parse with cut -d "|"

🐥 [ tweet ]

😈 [ Grzegorz Tworek @0gtweet ]

Making my computer unhackable after realizing "Security questions" are actually UTF-16LE JSON stored as ResetData REG_BINARY in HKLM\SAM\SAM\Domains\Account\Users\...

🐥 [ tweet ]

В отпуске зашел спокойно поиграть в компуктер, но, будучи шизом, не справился и в итоге играл не в игрульку, а с Cheat Engine, ведь гейм-читеры круче редтимеров. Спойлер: эта заметка не для чит-мейкеров, а для людей, которые первый раз открыли Cheat Engine и наугад тыкают кнопки в его интерфейсе (таких, как я):

🔗 https://snovvcrash.rocks/2024/05/10/newbies-game-hacking-notes.html

😈 [ Rasta Mouse @_RastaMouse ]

[BLOG]
I built a .NET web app to help test and analyse Kerberos delegation configurations.

🔗 https://rastamouse.me/kerberos-delegation-test-app/

🐥 [ tweet ]

😈 [ Matt Creel @Tw1sm ]

Was inspired by @vendetce to dig into Kerberos TGT renewal with Impacket this morning. Short example noscript in a PR here to do just that ⤵️

🔗 https://github.com/fortra/impacket/pull/1744

🐥 [ tweet ]

Теперь я понимаю, почему Маска так хейтят за реформы в Твиттере на X - 100$ и 5000$ в месяц за Basic и Pro подписки соответственно на Twitter API v2 это просто абсурд (на бесплатном тарифе, если что, можно только постить твиты и смотреть информацию о собственном профиле). Скажем, если бы автор некоего сферического бота в тг, завязанного на Твиттер апи, уже давно использовал ликнутые на GH токены, то при аннулировании очередного из них новый искать стало бы все более и более проблематично, потому что люди начинают следить более ответственно за подпиской ценой в 💯 бачей.

К счастью, функциональность API для получения информации в красивом json-е о том или ином твите на удивление легко эмулируется средствами веб-тестировки, например, с помощью playwright 😉

😈 [ pfiatde @pfiatde ]

As ntlm leaking is still a thing, made a showcase for elevating via ldap relaying with some little tricks.

Relaying is done with a Win Client without admin privs and an active Windows firewall (default config), by using HTTP.SYS and SSH.
Details here:

🔗 https://badoption.eu/blog/2024/04/25/netntlm.html

🐥 [ tweet ]

😈 [ LLM Security @llm_sec ]

Remote Code Execution by Server-Side Template Injection in Model Metadata

CVSS 9.7 in llama_cpp_python

found by @retr0reg

🔗 https://github.com/abetlen/llama-cpp-python/security/advisories/GHSA-56xg-wfcc-g829

🐥 [ tweet ]

😈 [ Nicolas Krassas @Dinosn ]

PoC for using MS Windows printers for persistence / command and control via Internet Printing

🔗 https://github.com/Diverto/IPPrintC2

🐥 [ tweet ]

😈 [ CravateRouge @rouge_cravate ]

Performing kerberos cross domain authentication with impacket is not straightforward!
If you want to authenticate on domain A (trusting domain B) with a userB you must ask a ST to domain B for krbtgt/domainA and then use this ST to request new ST to domainA, e.g.:

🐥 [ tweet ]

Б for Баян

😈 [ sinusoid @the_bit_diddler ]

I'm intending to release an open-source Visual Studio Code extension to make writing BOFs easier for the community:

- Complete Nt/Zw function prototypes with tab completion (and correct typecasting for placeholder variables)
- MSDN header searching

PoC:

🔗 https://www.youtube.com/watch?v=oWss4Ac9Pl8

🐥 [ tweet ]

😈 [ Steve S. @0xTriboulet ]

@vxunderground

BSides Talk on Writing malware in Nim w/o the Nim Runtime

🔗 https://github.com/m4ul3r/writing_nimless/blob/main/Writing%20Nimless%20nim.pdf

🐥 [ tweet ]

😈 [ CravateRouge @rouge_cravate ]

Having an AD with trusts you can reach?
bloodyAD can now retrieve the trusts of the trusts where you can connect to and print them as a nice ascii tree

🐥 [ tweet ]

😈 [ Binni Shah @binitamshah ]

Hooking System Calls in Windows 11 22H2 like Avast Antivirus. Research, analysis and bypass : credits @Denis_Skvortcov

🔗 https://the-deniss.github.io/posts/2022/12/08/hooking-system-calls-in-windows-11-22h2-like-avast-antivirus.html

🐥 [ tweet ]

😈 [ Jonny Johnson @jsecurity101 ]

Without further ado - here is EtwInspector!

This is a C++ tool to help users interact with ETW providers. This tool supports the enumeration of providers, their events, and capture events.

🔗 https://github.com/jsecurity101/ETWInspector

🐥 [ tweet ][ quote ]

😈 [ eversinc33 🩸🗡️ @eversinc33 ]

If you are facing an EDR with PEB protection/obf which makes Ldr inaccessible & want to inject shellcode, just pass the VA of LoadLibrary (which is consistent across processes) to the shellcode via egg-hunting from your injector, enabling lib resolution without touching the PEB.

🐥 [ tweet ]

*смешной срач в треде*

😈 [ NCV @nickvourd ]

This is my first article! Special thanks to @LAripping and @S1ckB0y1337 for the inspiration!

🔗 https://nickvourd.github.io/what-if-no-pkinit-still-the-same-fun/

🐥 [ tweet ]

#для_самых_маленьких