😈 [ Lsec @lsecqt ]
I am happy to share a recent blogpost about weaponizing DLL Hijacking / Sideloading for getting initial access and establishing persistence:
🔗 https://www.r-tec.net/r-tec-blog-dll-sideloading.html
Hope this is useful, and as always, reach out if you have questions.
🐥 [ tweet ]
I am happy to share a recent blogpost about weaponizing DLL Hijacking / Sideloading for getting initial access and establishing persistence:
🔗 https://www.r-tec.net/r-tec-blog-dll-sideloading.html
Hope this is useful, and as always, reach out if you have questions.
🐥 [ tweet ]
🔥6👍1
Offensive Xwitter
😈 [ ap @decoder_it ] Following up on my earlier tweet regarding Kerberos relay with SMB server, I've uploaded my quick & dirty version. It's far from perfect, so feel free to improve it! 🔗 https://github.com/decoder-it/KrbRelay-SMBServer/tree/master 🐥 […
😈 [ Daniel @0x64616e ]
Kerberos relaying from SMB to ADCS. Especially great when ESC8 was mitigated by disabling NTLM auth on the ADCS server.
Powered by:
🔗 https://github.com/decoder-it/KrbRelay-SMBServer
🔗 https://github.com/wh04m1001/dfscoerce
🔗 https://github.com/CCob/gssapi-abuse
🐥 [ tweet ][ quote ]
Kerberos relaying from SMB to ADCS. Especially great when ESC8 was mitigated by disabling NTLM auth on the ADCS server.
Powered by:
🔗 https://github.com/decoder-it/KrbRelay-SMBServer
🔗 https://github.com/wh04m1001/dfscoerce
🔗 https://github.com/CCob/gssapi-abuse
🐥 [ tweet ][ quote ]
🥱7👍4🔥3🤯3
😈 [ eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33 ]
I sometimes do recreational malware analysis with random samples 4fun. In this one, I unpacked 2 stages of .NET to reveal SnakeKeylogger and subsequently enumerated info about the threat actor via his Telegram API token.
🔗 https://eversinc33.com/posts/unpacking-snake-keylogger.html
🐥 [ tweet ]
I sometimes do recreational malware analysis with random samples 4fun. In this one, I unpacked 2 stages of .NET to reveal SnakeKeylogger and subsequently enumerated info about the threat actor via his Telegram API token.
🔗 https://eversinc33.com/posts/unpacking-snake-keylogger.html
🐥 [ tweet ]
🔥9👍1
😈 [ Outflank @OutflankNL ]
New Blog Alert! 🚨
Introducing Early Cascade Injection, a stealthy process injection technique that targets Windows process creation, avoids cross-process APCs, and evades top-tier EDRs.
Learn how it combines Early Bird APC Injection & EDR-Preloading:
🔗 https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/
🐥 [ tweet ]
New Blog Alert! 🚨
Introducing Early Cascade Injection, a stealthy process injection technique that targets Windows process creation, avoids cross-process APCs, and evades top-tier EDRs.
Learn how it combines Early Bird APC Injection & EDR-Preloading:
🔗 https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/
🐥 [ tweet ]
🥱7👍6🔥2
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Интересные у них отчеты, люблю такое чтиво и всем рекомендую) и атакерам, и защитникам))
https://news.1rj.ru/str/s3Ch1n7/427
#report
https://news.1rj.ru/str/s3Ch1n7/427
#report
Telegram
README.hta
👍10🥱1
😈 [ cod @wolfcod ]
Combining RtlCreateProcessReflection plus NanoDump Writer to avoid MiniDump callback api:
🔗 https://github.com/wolfcod/lsassdump
🐥 [ tweet ]
Combining RtlCreateProcessReflection plus NanoDump Writer to avoid MiniDump callback api:
🔗 https://github.com/wolfcod/lsassdump
🐥 [ tweet ]
👍5🔥3
😈 [ Elastic Security Labs @elasticseclabs ]
Threat hunting just got easier! This new repo of detection rules is crafted by our veteran detection engineers and powered by different Elastic query languages. Get the details of what’s included and see the future of this repo here:
🔗 https://www.elastic.co/security-labs/elevate-your-threat-hunting
🐥 [ tweet ]
Threat hunting just got easier! This new repo of detection rules is crafted by our veteran detection engineers and powered by different Elastic query languages. Get the details of what’s included and see the future of this repo here:
🔗 https://www.elastic.co/security-labs/elevate-your-threat-hunting
🐥 [ tweet ]
🔥7👍2
😈 [ Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid ]
Here's my journey/blog of an entire wasted day on reversing the NTAPI call and the internals of
Blog:
🔗 https://bruteratel.com/research/2024/10/20/Exception-Junction/
PoC:
🔗 https://github.com/paranoidninja/Exception-Junction
🐥 [ tweet ]
Here's my journey/blog of an entire wasted day on reversing the NTAPI call and the internals of
ntdll!LdrpVectorHandlerList to write my own RtlpAddVectoredExceptionHandler from scratch. The code is hosted on my git.Blog:
🔗 https://bruteratel.com/research/2024/10/20/Exception-Junction/
PoC:
🔗 https://github.com/paranoidninja/Exception-Junction
🐥 [ tweet ]
🔥7👍3
😈 [ Steph @w34kp455 ]
Call it the biggest #NTLM #password database or monstrous #MD5 leak, but on, you can find precomputed datasets for various wordlists and different hashes - all free!
FYI:
🔗 http://weakpass.com
🐥 [ tweet ]
Call it the biggest #NTLM #password database or monstrous #MD5 leak, but on, you can find precomputed datasets for various wordlists and different hashes - all free!
FYI:
all_in_one.latin.txt for NTLM contains 26.5 billion pairs of hash:password inside!🔥🔗 http://weakpass.com
🐥 [ tweet ]
🔥19👍5
😈 [ CICADA8Research @CICADA8Research ]
Hi! We'd like to share our new research with you. You've probably heard about COM Hijacking, but we've found another way of persistence via COM. Typelib! Read the article here:
🔗 https://medium.com/@cicada-8/hijack-the-typelib-new-com-persistence-technique-32ae1d284661
🐥 [ tweet ]
Hi! We'd like to share our new research with you. You've probably heard about COM Hijacking, but we've found another way of persistence via COM. Typelib! Read the article here:
🔗 https://medium.com/@cicada-8/hijack-the-typelib-new-com-persistence-technique-32ae1d284661
🐥 [ tweet ]
🔥12🥱6👍4🤔3
😈 [ Chris Au @netero_1010 ]
Something interesting I found in SCCM remote control.
🔗 https://www.netero1010-securitylab.com/red-team/abuse-sccm-remote-control-as-native-vnc
🐥 [ tweet ]
Something interesting I found in SCCM remote control.
🔗 https://www.netero1010-securitylab.com/red-team/abuse-sccm-remote-control-as-native-vnc
🐥 [ tweet ]
👍3🥱2🔥1
😈 [ Octoberfest7 @Octoberfest73 ]
Happy to share another open source project- An x64 position-independent shellcode stager that validates the downloaded payload stage prior to execution. Integration with Cobalt Strike out of the box. Check out Secure_Stager here:
🔗 https://github.com/Octoberfest7/Secure_Stager
🐥 [ tweet ]
Happy to share another open source project- An x64 position-independent shellcode stager that validates the downloaded payload stage prior to execution. Integration with Cobalt Strike out of the box. Check out Secure_Stager here:
🔗 https://github.com/Octoberfest7/Secure_Stager
🐥 [ tweet ]
👍4🔥3🥱2
This media is not supported in your browser
VIEW IN TELEGRAM
😈 [ Bnb @HulkOperator ]
I'm thrilled to share my latest project: AuthStager. This is a proof-of-concept tool that generates a shellcode stager with authentication.
Shout out to @MalDevAcademy, which is hands down the best resource to learn maldev.
Blog:
🔗 https://hulkops.gitbook.io/blog/red-team/stage-but-verify
Code:
🔗 https://github.com/HulkOperator/AuthStager
🐥 [ tweet ]
I'm thrilled to share my latest project: AuthStager. This is a proof-of-concept tool that generates a shellcode stager with authentication.
Shout out to @MalDevAcademy, which is hands down the best resource to learn maldev.
Blog:
🔗 https://hulkops.gitbook.io/blog/red-team/stage-but-verify
Code:
🔗 https://github.com/HulkOperator/AuthStager
🐥 [ tweet ]
👍7🔥4
😈 [ MalDev Academy @MalDevAcademy ]
Embed an encrypted payload within a PNG file across multiple sections.
🔗 https://github.com/Maldev-Academy/EmbedPayloadInPng
🐥 [ tweet ]
Embed an encrypted payload within a PNG file across multiple sections.
🔗 https://github.com/Maldev-Academy/EmbedPayloadInPng
🐥 [ tweet ]
👍6🥱5
😈 [ TrustedSec @TrustedSec ]
It’s time to get Groovy! In our new #blog, @__mez0__ goes over a variety of post-exploitation tasks in the #Groovy programming language for the next time you’re #enumerating a network. Read it now!
🔗 https://hubs.la/Q02Vhm2G0
🐥 [ tweet ]
It’s time to get Groovy! In our new #blog, @__mez0__ goes over a variety of post-exploitation tasks in the #Groovy programming language for the next time you’re #enumerating a network. Read it now!
🔗 https://hubs.la/Q02Vhm2G0
🐥 [ tweet ]
👍3
😈 [ 0xdf @0xdf_ ]
Mist from @hackthebox_eu is just a monster active directory challenge. My favorite parts were exploiting PetitPotam with ntlmrelayx to relay into LDAP access on the DC, enumerating Defender exclusion directories, and exploiting ESC13.
🔗 https://0xdf.gitlab.io/2024/10/26/htb-mist.html
🐥 [ tweet ]
Mist from @hackthebox_eu is just a monster active directory challenge. My favorite parts were exploiting PetitPotam with ntlmrelayx to relay into LDAP access on the DC, enumerating Defender exclusion directories, and exploiting ESC13.
🔗 https://0xdf.gitlab.io/2024/10/26/htb-mist.html
🐥 [ tweet ]
👍4🔥2
😈 [ Lampros @lampnout ]
Did you know attackers can register scheduled tasks configured with a custom handler (COM) to hide the full path of their payload? In my revisited post I explore (source code) how it is possible to register a task using the
🔗 https://stmxcsr.com/persistence/scheduled-tasks.html#programmatically-register-a-scheduled-task-using-com-icomhandleraction
🐥 [ tweet ]
Did you know attackers can register scheduled tasks configured with a custom handler (COM) to hide the full path of their payload? In my revisited post I explore (source code) how it is possible to register a task using the
IComHandlerAction interface:🔗 https://stmxcsr.com/persistence/scheduled-tasks.html#programmatically-register-a-scheduled-task-using-com-icomhandleraction
🐥 [ tweet ]
👍4🔥3
😈 [ Elastic Security Labs @elasticseclabs ]
The ElasticSecurityLabs team breaks down a recent Chrome update that introduced App-Bound Encryption and how the most common infostealers have adapted:
🔗 https://www.elastic.co/security-labs/katz-and-mouse-game
🐥 [ tweet ]
The ElasticSecurityLabs team breaks down a recent Chrome update that introduced App-Bound Encryption and how the most common infostealers have adapted:
🔗 https://www.elastic.co/security-labs/katz-and-mouse-game
🐥 [ tweet ]
🔥4👍3