😈 [ Volexity @Volexity ]
@Volexity’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target, while the attacker was halfway around the world.
🔗 https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
🐥 [ tweet ]
@Volexity’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target, while the attacker was halfway around the world.
🔗 https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
🐥 [ tweet ]
познавательно👍5🔥3
😈 [ Yehuda Smirnov @yudasm_ ]
Excited to share a tool I've been working on - ShadowHound.
ShadowHound is a PowerShell alternative to SharpHound for Active Directory enumeration, using native PowerShell or ADModule (ADWS). As a bonus I also talk about some MDI detections and how to avoid them:
Blog:
🔗 https://blog.fndsec.net/2024/11/25/shadowhound/
Code:
🔗 https://github.com/Friends-Security/ShadowHound
🐥 [ tweet ]
Excited to share a tool I've been working on - ShadowHound.
ShadowHound is a PowerShell alternative to SharpHound for Active Directory enumeration, using native PowerShell or ADModule (ADWS). As a bonus I also talk about some MDI detections and how to avoid them:
Blog:
🔗 https://blog.fndsec.net/2024/11/25/shadowhound/
Code:
🔗 https://github.com/Friends-Security/ShadowHound
🐥 [ tweet ]
👍8
😈 [ PT SWARM @ptswarm ]
🎤✨ Our security researcher, Konstantin Polishin, presented “Red Team Social Engineering 2024: Initial Access TTP and Project Experience of Our Team” at #ROOTCON18 🚀
Recording:
🔗 https://youtube.com/watch?v=6nnZJiL0Tgk
🐥 [ tweet ]
🎤✨ Our security researcher, Konstantin Polishin, presented “Red Team Social Engineering 2024: Initial Access TTP and Project Experience of Our Team” at #ROOTCON18 🚀
Recording:
🔗 https://youtube.com/watch?v=6nnZJiL0Tgk
🐥 [ tweet ]
🔥8
😈 [ ap @decoder_it ]
I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...
GitHub:
🔗 https://github.com/decoder-it/KrbRelayEx
🐥 [ tweet ]
I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...
GitHub:
🔗 https://github.com/decoder-it/KrbRelayEx
🐥 [ tweet ]
👍11
😈 [ RedTeam Pentesting @RedTeamPT ]
So we implemented parsing the security denoscriptors of shares and files in the beautiful ✨smbclient-ng ✨ by @podalirius_
Here is our PR:
🔗 https://github.com/p0dalirius/smbclient-ng/pull/118
🐥 [ tweet ][ reply ]
So we implemented parsing the security denoscriptors of shares and files in the beautiful ✨smbclient-ng ✨ by @podalirius_
Here is our PR:
🔗 https://github.com/p0dalirius/smbclient-ng/pull/118
🐥 [ tweet ][ reply ]
👍9🔥3
😈 [ Check Point Research @_CPResearch_ ]
🚨 New Discovery! We uncovered an undocumented technique for executing commands through the #Godot #GameEngine. Exploited by #GodLoader, this method successfully bypassed most #antivirus software since June 2024, affecting over 17,000 potential victims.
🔗 https://research.checkpoint.com/2024/gaming-engines-an-undetected-playground-for-malware-loaders/
🐥 [ tweet ]
🚨 New Discovery! We uncovered an undocumented technique for executing commands through the #Godot #GameEngine. Exploited by #GodLoader, this method successfully bypassed most #antivirus software since June 2024, affecting over 17,000 potential victims.
🔗 https://research.checkpoint.com/2024/gaming-engines-an-undetected-playground-for-malware-loaders/
🐥 [ tweet ]
👍3🔥1
😈 [ S3cur3Th1sSh1t @ShitSecure ]
Seven days ago @prac_sec released a blog post about Patching CLR memory to bypass AMSI. This is now added to the AMSI Bypass Powershell repo as well:
🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#Patching-Clr
🔗 https://practicalsecurityanalytics.com/new-amsi-bypss-technique-modifying-clr-dll-in-memory/
🐥 [ tweet ]
Seven days ago @prac_sec released a blog post about Patching CLR memory to bypass AMSI. This is now added to the AMSI Bypass Powershell repo as well:
🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#Patching-Clr
🔗 https://practicalsecurityanalytics.com/new-amsi-bypss-technique-modifying-clr-dll-in-memory/
🐥 [ tweet ]
👍9🔥3
😈 [ Layle @layle_ctf ]
In a somewhat recent project we used a vulnerable driver, which worked fine...
Except: The customer had a custom rule that caused an alert when a service is created!
Decided to write a tool that creates the registry keys and calls into NtLoadDriver:
🔗 https://github.com/ioncodes/SilentLoad
🐥 [ tweet ]
In a somewhat recent project we used a vulnerable driver, which worked fine...
Except: The customer had a custom rule that caused an alert when a service is created!
Decided to write a tool that creates the registry keys and calls into NtLoadDriver:
🔗 https://github.com/ioncodes/SilentLoad
🐥 [ tweet ]
👍1
😈 [ drm @lowercase_drm ]
Coffee break thoughts: "is it possible to bruteforce RPC endpoint to perform code exec if you can't access EPM/SMB?"
99% impacket atexec + 1% "for loop" = 100% prod ready
(silent command only)
h/t @saerxcit
🌻
🔗 https://gist.github.com/ThePirateWhoSmellsOfSunflowers/3673746454aef7d55a5efed4dc4e1a61
🐥 [ tweet ]
Coffee break thoughts: "is it possible to bruteforce RPC endpoint to perform code exec if you can't access EPM/SMB?"
99% impacket atexec + 1% "for loop" = 100% prod ready
(silent command only)
h/t @saerxcit
🌻
🔗 https://gist.github.com/ThePirateWhoSmellsOfSunflowers/3673746454aef7d55a5efed4dc4e1a61
🐥 [ tweet ]
🔥3
😈 [ Mayfly @M4yFly ]
Goad v3 merged into the main branch 🥳
GitHub:
🔗 https://github.com/Orange-Cyberdefense/GOAD
Doc:
🔗 https://orange-cyberdefense.github.io/GOAD/
🐥 [ tweet ]
Goad v3 merged into the main branch 🥳
GitHub:
🔗 https://github.com/Orange-Cyberdefense/GOAD
Doc:
🔗 https://orange-cyberdefense.github.io/GOAD/
🐥 [ tweet ]
👍8😢1
😈 [ blueblue @piedpiper1616 ]
GitHub - TheN00bBuilder/cve-2024-11477-writeup: CVE-2024-11477 7Zip Code Execution Writeup and Analysis
🔗 https://github.com/TheN00bBuilder/cve-2024-11477-writeup
🐥 [ tweet ]
GitHub - TheN00bBuilder/cve-2024-11477-writeup: CVE-2024-11477 7Zip Code Execution Writeup and Analysis
🔗 https://github.com/TheN00bBuilder/cve-2024-11477-writeup
🐥 [ tweet ]
👍4
😈 [ Rasta Mouse @_RastaMouse ]
[BLOG]
This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs.
🔗 https://rastamouse.me/udrl-sleepmask-and-beacongate/
🐥 [ tweet ]
[BLOG]
This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs.
🔗 https://rastamouse.me/udrl-sleepmask-and-beacongate/
🐥 [ tweet ]
🤔1
😈 [ Fabian Bader @fabian_bader ]
🛡️Windows Firewall and WFP are only two ways to silence an #EDR agent.
📢In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it.
🔗 https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
And if you want even more, checkout part 2 released by @Cyb3rMonk
🐥 [ tweet ]
🛡️Windows Firewall and WFP are only two ways to silence an #EDR agent.
📢In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it.
🔗 https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/
And if you want even more, checkout part 2 released by @Cyb3rMonk
🐥 [ tweet ]
🔥4👍1
😈 [ Check Point Research @_CPResearch_ ]
A ransomware gang's Rust experiment naturally produced the kind of binary you "reverse-engineer" by staring at the strings and saying, "mm hm." Join us as we break through this technical barrier and gain some insight into ransomware author psychology.
🔗 https://research.checkpoint.com/2024/inside-akira-ransomwares-rust-experiment/
🐥 [ tweet ]
A ransomware gang's Rust experiment naturally produced the kind of binary you "reverse-engineer" by staring at the strings and saying, "mm hm." Join us as we break through this technical barrier and gain some insight into ransomware author psychology.
🔗 https://research.checkpoint.com/2024/inside-akira-ransomwares-rust-experiment/
🐥 [ tweet ]
👍2
😈 [ MDSec @MDSecLabs ]
Ever come across Altiris on a red team? We did.... Check out this post from @breakfix on how to extract ACC creds... Extracting Account Connectivity Credentials (ACCs) from Symantec Management Agent (aka Altiris)
🔗 https://www.mdsec.co.uk/2024/12/extracting-account-connectivity-credentials-accs-from-symantec-management-agent-aka-altiris/
🐥 [ tweet ]
Ever come across Altiris on a red team? We did.... Check out this post from @breakfix on how to extract ACC creds... Extracting Account Connectivity Credentials (ACCs) from Symantec Management Agent (aka Altiris)
🔗 https://www.mdsec.co.uk/2024/12/extracting-account-connectivity-credentials-accs-from-symantec-management-agent-aka-altiris/
🐥 [ tweet ]
👍2🍌2
😈 [ Ricardo Ruiz @RicardoJoseRF ]
Today I made public NativeBypassCredGuard, a tool to bypass Credential Guard by patching WDigest.dll using only NTAPI functions:
🔗 https://github.com/ricardojoserf/NativeBypassCredGuard
🐥 [ tweet ]
Today I made public NativeBypassCredGuard, a tool to bypass Credential Guard by patching WDigest.dll using only NTAPI functions:
🔗 https://github.com/ricardojoserf/NativeBypassCredGuard
🐥 [ tweet ]
👍12
😈 [ S3cur3Th1sSh1t @ShitSecure ]
Finally I was finally able to reproduce RemotePotat0 from @splinter_code and @decoder_it which still works perfectly fine when relaying against SMB and choosing the correct CLSID :-) Only LDAP relaying it patched and not possible anymore.
Super late but ¯\_(ツ)_/ ¯ 🤪
But you know what's even better? KrbRelay also works from a low privileged users perspective! 🔥🔥🔥
🐥 [ tweet ][ quote ]
Finally I was finally able to reproduce RemotePotat0 from @splinter_code and @decoder_it which still works perfectly fine when relaying against SMB and choosing the correct CLSID :-) Only LDAP relaying it patched and not possible anymore.
Super late but ¯\_(ツ)_/ ¯ 🤪
But you know what's even better? KrbRelay also works from a low privileged users perspective! 🔥🔥🔥
🐥 [ tweet ][ quote ]
🔥7👍4🤯1
😈 [ Rad @rad9800 ]
I figured out a new way to completely disable certain EDR products only with Admin privileges in less than 30 lines of code with native applications.
It works by deleting critical application files before they can do anything 🙃
🔗 https://github.com/rad9800/BootExecuteEDR
🐥 [ tweet ]
I figured out a new way to completely disable certain EDR products only with Admin privileges in less than 30 lines of code with native applications.
It works by deleting critical application files before they can do anything 🙃
🔗 https://github.com/rad9800/BootExecuteEDR
🐥 [ tweet ]
🥱8🔥4🤔4👍1
😈 [ Boris Larin @oct0xor ]
We've open-sourced GReAT’s plugin for the IDA Pro decompiler - an indispensable set of tools for analyzing malware, shellcodes, etc. Grab our secret ingredient for reverse engineering and check out the GIFs demonstrating its usage:
🔗 https://github.com/KasperskyLab/hrtng
🐥 [ tweet ]
We've open-sourced GReAT’s plugin for the IDA Pro decompiler - an indispensable set of tools for analyzing malware, shellcodes, etc. Grab our secret ingredient for reverse engineering and check out the GIFs demonstrating its usage:
🔗 https://github.com/KasperskyLab/hrtng
🐥 [ tweet ]
🔥4👍3