😈 [ JasonFossen, Jason Fossen ]
How to host the PowerShell engine inside of Python and then run PowerShell code inside Python (and not spawn an external process):
https://t.co/kDal7LhP1e
#PowerShell #Python #SEC573 #SEC505 @MarkBaggett
🔗 https://devblogs.microsoft.com/powershell/hosting-powershell-in-a-python-noscript/
🐥 [ tweet ]
How to host the PowerShell engine inside of Python and then run PowerShell code inside Python (and not spawn an external process):
https://t.co/kDal7LhP1e
#PowerShell #Python #SEC573 #SEC505 @MarkBaggett
🔗 https://devblogs.microsoft.com/powershell/hosting-powershell-in-a-python-noscript/
🐥 [ tweet ]
😈 [ Tarlogic, Tarlogic ]
#ZeroTrust is one of the trending concepts in the #cybersecurity world. But the hype around it is perhaps a bit excessive. In this article, we explain why... 👇
https://t.co/hUiMeq6bnR
🔗 https://www.tarlogic.com/blog/demystifying-zero-trust/
🐥 [ tweet ]
#ZeroTrust is one of the trending concepts in the #cybersecurity world. But the hype around it is perhaps a bit excessive. In this article, we explain why... 👇
https://t.co/hUiMeq6bnR
🔗 https://www.tarlogic.com/blog/demystifying-zero-trust/
🐥 [ tweet ]
😈 [ itm4n, Clément Labro ]
@splinter_code Yeaaaaaaaah! Love this series! 😀
Recently, I also tested this technique to evade the LSASS dump detection. cc @k4nfr3
👉 https://t.co/e0rZHBcWZN
Overriding the first occurrence of "lsass.pdb" seems to be enough but of course there are plenty of ways to achieve the same result.
🔗 https://www.bussink.net/lsass-minidump-file-seen-as-malicious-by-mcafee-av/
🐥 [ tweet ]
@splinter_code Yeaaaaaaaah! Love this series! 😀
Recently, I also tested this technique to evade the LSASS dump detection. cc @k4nfr3
👉 https://t.co/e0rZHBcWZN
Overriding the first occurrence of "lsass.pdb" seems to be enough but of course there are plenty of ways to achieve the same result.
🔗 https://www.bussink.net/lsass-minidump-file-seen-as-malicious-by-mcafee-av/
🐥 [ tweet ]
😈 [ PortSwiggerRes, PortSwigger Research ]
Bypassing Firefox's HTML Sanitizer API by @garethheyes
https://t.co/ePGrxxTVDW
🔗 https://portswigger.net/research/bypassing-firefoxs-html-sanitizer-api
🐥 [ tweet ]
Bypassing Firefox's HTML Sanitizer API by @garethheyes
https://t.co/ePGrxxTVDW
🔗 https://portswigger.net/research/bypassing-firefoxs-html-sanitizer-api
🐥 [ tweet ]
😈 [ __mez0__, 𝓂ε乙０ ]
Obfuscating Reflective DLL Memory Regions with Timers: https://t.co/dxLLXjmZui
🔗 https://mez0.cc/posts/vulpes-obfuscating-memory-regions/
🐥 [ tweet ]
Obfuscating Reflective DLL Memory Regions with Timers: https://t.co/dxLLXjmZui
🔗 https://mez0.cc/posts/vulpes-obfuscating-memory-regions/
🐥 [ tweet ]
🤯1
😈 [ NinjaParanoid, Paranoid Ninja (Brute Ratel C4) ]
Recorded a video demonstration explaining full thread stack spoofing. Video includes Process Hacker for POC. Should be useful for both analysts on hunting suspicious threads and mapped regions in memory, unless of course someone is using Brute Ratel C4 🙂
https://t.co/qB6hzJESR9
🔗 https://youtu.be/7EheXiC3MJE
🐥 [ tweet ]
Recorded a video demonstration explaining full thread stack spoofing. Video includes Process Hacker for POC. Should be useful for both analysts on hunting suspicious threads and mapped regions in memory, unless of course someone is using Brute Ratel C4 🙂
https://t.co/qB6hzJESR9
🔗 https://youtu.be/7EheXiC3MJE
🐥 [ tweet ]
😈 [ joehowwolf, William Burgess ]
Ever wanted to make your sketchy sys calls look squeaky clean? I wrote a blog demonstrating a PoC which calls NtOpenProcess to grab a handle to lsass with an arbitrary/spoofed call stack: https://t.co/SWLenJazWW
PoC: https://t.co/jChX0KJrL8
🔗 https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/
🔗 https://github.com/countercept/CallStackSpoofer
🐥 [ tweet ]
Ever wanted to make your sketchy sys calls look squeaky clean? I wrote a blog demonstrating a PoC which calls NtOpenProcess to grab a handle to lsass with an arbitrary/spoofed call stack: https://t.co/SWLenJazWW
PoC: https://t.co/jChX0KJrL8
🔗 https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/
🔗 https://github.com/countercept/CallStackSpoofer
🐥 [ tweet ]
😈 [ TJ_Null, Tony ]
Since Microsoft plans to disable macros by default, I have decided to release a proof of concept that I use on my engagements by leveraging the document properties built in Microsoft Office.
Here is the link to the article: https://t.co/ZvgDxeuIJG
🔗 https://www.offensive-security.com/offsec/macro-weaponization/
🐥 [ tweet ]
Since Microsoft plans to disable macros by default, I have decided to release a proof of concept that I use on my engagements by leveraging the document properties built in Microsoft Office.
Here is the link to the article: https://t.co/ZvgDxeuIJG
🔗 https://www.offensive-security.com/offsec/macro-weaponization/
🐥 [ tweet ]
😈 [ HackAndDo, Pixis ]
Check out new lsassy release!
🔸New dump modules
🔸Usable TGT are displayed alongside credentials
🔸DPAPI Masterkeys are retrieved
For more details you can check release 3.1.2 denoscription
https://t.co/SgnyAW6sWN
🔗 https://github.com/Hackndo/lsassy/releases/tag/v3.1.2
🐥 [ tweet ]
Check out new lsassy release!
🔸New dump modules
🔸Usable TGT are displayed alongside credentials
🔸DPAPI Masterkeys are retrieved
For more details you can check release 3.1.2 denoscription
https://t.co/SgnyAW6sWN
🔗 https://github.com/Hackndo/lsassy/releases/tag/v3.1.2
🐥 [ tweet ]
😈 [ ShitSecure, S3cur3Th1sSh1t ]
An relatively easy way to use stack encryption for your implant?
@SolomonSklash‘s SleepyCrypt can easily be used from any language:
https://t.co/IiMHZSLXY5
This for example is how to do it with Nim:
https://t.co/Pjr6MJT8hC
Can also be used for Nim C2 implants as Sleep 🔥😎
🔗 https://github.com/SolomonSklash/SleepyCrypt
🔗 https://gist.github.com/S3cur3Th1sSh1t/6022dc2050bb1b21be2105b8b0dc077d
🐥 [ tweet ]
An relatively easy way to use stack encryption for your implant?
@SolomonSklash‘s SleepyCrypt can easily be used from any language:
https://t.co/IiMHZSLXY5
This for example is how to do it with Nim:
https://t.co/Pjr6MJT8hC
Can also be used for Nim C2 implants as Sleep 🔥😎
🔗 https://github.com/SolomonSklash/SleepyCrypt
🔗 https://gist.github.com/S3cur3Th1sSh1t/6022dc2050bb1b21be2105b8b0dc077d
🐥 [ tweet ]
😈 [ theluemmel, S4U2LuemmelSec ]
Wrote a small tool to check if RBCD can be abused by checking both ms-ds-machineaccountquota & SeMachineAccountPrivilege
https://t.co/1iYoI8bTCr
Happy pentesting / defending
🔗 https://github.com/LuemmelSec/Pentest-Tools-Collection/blob/main/tools/RBCD_Abuse_Checker.ps1
🐥 [ tweet ]
Wrote a small tool to check if RBCD can be abused by checking both ms-ds-machineaccountquota & SeMachineAccountPrivilege
https://t.co/1iYoI8bTCr
Happy pentesting / defending
🔗 https://github.com/LuemmelSec/Pentest-Tools-Collection/blob/main/tools/RBCD_Abuse_Checker.ps1
🐥 [ tweet ]
😈 [ chvancooten, Cas van Cooten ]
Kicked off my "MalDev for Dummies" workshop successfully yesterday, which means the repo is now public! Slides, exercises, example code and resources to get you started on your malware development journey. C# and Nim supported for now. Enjoy!!
https://t.co/Z8aQ41QvHQ
🔗 https://github.com/chvancooten/maldev-for-dummies
🐥 [ tweet ]
Kicked off my "MalDev for Dummies" workshop successfully yesterday, which means the repo is now public! Slides, exercises, example code and resources to get you started on your malware development journey. C# and Nim supported for now. Enjoy!!
https://t.co/Z8aQ41QvHQ
🔗 https://github.com/chvancooten/maldev-for-dummies
🐥 [ tweet ]
This media is not supported in your browser
VIEW IN TELEGRAM
😈 [ _wald0, Andy Robbins ]
Today is Friday, which means it's #BloodHoundBasics day.
Too many nodes on the screen? Press space bar to bring up the spotlight, which lists all drawn nodes. Click a node to highlight and zoom into it. You can also search for drawn nodes in the spotlight:
🐥 [ tweet ]
Today is Friday, which means it's #BloodHoundBasics day.
Too many nodes on the screen? Press space bar to bring up the spotlight, which lists all drawn nodes. Click a node to highlight and zoom into it. You can also search for drawn nodes in the spotlight:
🐥 [ tweet ]
😈 [ podalirius_, Podalirius ]
I published a tool to #bruteforce the key of @CodeIgniter's session #cookies, in order to sign arbitrary attacker-controlled cookies🍪
I wrote this tool for a use case encountered in #bugbounty recently, but we can find this in #pentest too.
https://t.co/7JIiYQskoG
🔗 https://github.com/p0dalirius/CodeIgniter-session-unsign
🐥 [ tweet ]
I published a tool to #bruteforce the key of @CodeIgniter's session #cookies, in order to sign arbitrary attacker-controlled cookies🍪
I wrote this tool for a use case encountered in #bugbounty recently, but we can find this in #pentest too.
https://t.co/7JIiYQskoG
🔗 https://github.com/p0dalirius/CodeIgniter-session-unsign
🐥 [ tweet ]
😈 [ 0gtweet, Grzegorz Tworek ]
Is #SysInternals Sysmon good for discovering the full historical process tree? Of course! Bored with manual process, I have create simple (but fully working) PowerShell noscript, displaying the tree in a nicely walkable form. Enjoy: https://t.co/eZFIDBT2lN
🔗 https://github.com/gtworek/PSBits/blob/master/DFIR/GetSysmonTree.ps1
🐥 [ tweet ]
Is #SysInternals Sysmon good for discovering the full historical process tree? Of course! Bored with manual process, I have create simple (but fully working) PowerShell noscript, displaying the tree in a nicely walkable form. Enjoy: https://t.co/eZFIDBT2lN
🔗 https://github.com/gtworek/PSBits/blob/master/DFIR/GetSysmonTree.ps1
🐥 [ tweet ]
🤔2
👹 [ snovvcrash, sn🥶vvcr💥sh ]
[#HackStory 🧵] (1/4) Here’s a generic case of reaching a locked-down PC from a firewalled segment in AD. The background is: 172.16.66.6 (the target) can talk to 192.168.1.11 (a PWNed server) but not vice versa and to no one else in the foreseeable network 👀
#ad #pentest
🐥 [ tweet ]
[#HackStory 🧵] (1/4) Here’s a generic case of reaching a locked-down PC from a firewalled segment in AD. The background is: 172.16.66.6 (the target) can talk to 192.168.1.11 (a PWNed server) but not vice versa and to no one else in the foreseeable network 👀
#ad #pentest
🐥 [ tweet ]
🔥1
👹 [ snovvcrash, sn🥶vvcr💥sh ]
(2/4) Being a DA an adversary can create an evil GPO that will coerce Immediate Scheduled Task execution on the target. The task downloads and executes a PS cradle pointing to the PWNed server. Sure, there’re fancy (py|Sharp)GPOAbuse, etc… But when it’s a pentest, who cares 😒
🐥 [ tweet ]
(2/4) Being a DA an adversary can create an evil GPO that will coerce Immediate Scheduled Task execution on the target. The task downloads and executes a PS cradle pointing to the PWNed server. Sure, there’re fancy (py|Sharp)GPOAbuse, etc… But when it’s a pentest, who cares 😒
🐥 [ tweet ]
👹 [ snovvcrash, sn🥶vvcr💥sh ]
(3/4) Meanwhile, some v4tov4 port proxies are configured on the pivot point by the adversary via netsh 😈
🐥 [ tweet ]
(3/4) Meanwhile, some v4tov4 port proxies are configured on the pivot point by the adversary via netsh 😈
🐥 [ tweet ]