😈 [ tiraniddo, James Forshaw ]

Another of my recent Kerberos bugs has been opened, this time _another_ way of bypassing AppContainer enterprise authentication capability this time by using LsaCallAuthenticationPackage https://t.co/axda3g2XDm

🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2273

🐥 [ tweet ]

😈 [ harmj0y, Will Schroeder ]

Very cool Kerberoasting implementation using LsaCallAuthenticationPackage, all through a macro https://t.co/BswTJvqzHg

🔗 https://github.com/Adepts-Of-0xCC/VBA-macro-experiments/blob/main/kerberoast.vba

🐥 [ tweet ]

😈 [ 0xdf_, 0xdf ]

What Happens In a "Shell Upgrade" video released:

https://t.co/ql6kIj6RK5

I love this one because I learned so much making it. Hopefully that knowledge transfers to you as well.

🔗 https://youtu.be/DqE6DxqJg8Q

🐥 [ tweet ][ quote ]

😈 [ 0xBoku, Bobby Cooke ]

Dannnggggg.. @CaptMeelo has some great blog posts 🔥 Thanks @FuzzySec for directing me back there :)
https://t.co/0gbd1VHqRl

🔗 https://captmeelo.com/category/maldev

🐥 [ tweet ]

😈 [ podalirius_, Podalirius ]

Heard of #Printerbug, #PetitPotam, #ShadowCoerce and #DFSCoerce ? These are only the tip of the Iceberg and there is probably many more to find. 👀

Want to find a new call ? Here is 242 probable #RPC calls with python poc ready to be triaged! 🎉

https://t.co/WjmEzuSOcz

🔗 https://github.com/p0dalirius/windows-coerced-authentication-methods

🐥 [ tweet ]

😈 [ podalirius_, Podalirius ]

Ever wanted to trigger a #NTLM authentication to a machine using every possible RPC call ? You can do this using #Coercer 🥳🎉

This tool automatically detects available pipes and protocols and call every possible functions to trigger an #authentication.

https://t.co/6aVELSP4NC

🔗 https://github.com/p0dalirius/Coercer

🐥 [ tweet ]

😈 [ harmj0y, Will Schroeder ]

Hey, do you like tokens? Have you always wanted to "harvest" tokens for offensive purposes? If so check out my new post https://t.co/5Tr9UxYuh1 where I show I can (finally) write a technical post without memes, and then check out the Koh toolset at https://t.co/l77vlPDQrj

🔗 https://posts.specterops.io/koh-the-token-stealer-41ca07a40ed6
🔗 https://github.com/GhostPack/Koh

🐥 [ tweet ]

😈 [ theluemmel, S4U2LuemmelSec ]

Created a pull request (https://t.co/P40XZVrCrC) for @porchetta_ind 's CrackMapExec to query for LDAP Signing and Channel Binding. Big thanks to @zyn3rgy for his awesome work: https://t.co/8bfwJiSl4E which I just ported.
Thx @byt3bl33d3r and @mpgn_x64 for this awesome tool.

🔗 https://github.com/Porchetta-Industries/CrackMapExec/pull/606
🔗 https://github.com/zyn3rgy/LdapRelayScan

🐥 [ tweet ]

😈 [ an0n_r0, an0n ]

if anyone runs into "unsupported hash type MD4" (on fully updated Kali) like me (for example by using BloodHound Python ingestor), it is because openssl legacy algorithms are being dropped from config. here is the fix from FluffMe: https://t.co/E89SOZSlOu

🔗 https://gitlab.com/kalilinux/packages/kali-tweaks/-/issues/27

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

@XakepRU, спасибо за подгон 🤓📚

🐥 [ tweet ]

😈 [ TrustedSec, TrustedSec ]

Continuing with some cross-site noscripting (XSS) fun, @hoodoer demonstrates how to capture credentials from a login form using an IFrame trap.

https://t.co/q1MzMA9A9w

🔗 https://hubs.la/Q01gmrKB0

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

To summarize @NotMedic’s idea of an alternative approach for running NanoDump from memory (as a BOF) I’ve added a note on using RunOF (by @Nettitude_Labs) filelessly 👉🏻 https://t.co/SpuXr1PXQQ

#bof #nanodump #lsass

🔗 https://ppn.snovvcrash.rocks/red-team/maldev/bof-coff#runof

🐥 [ tweet ]

😈 [ M4yFly, Mayfly ]

Let's play with the ad lab, goadv2:
https://t.co/zvysxTYQlq
https://t.co/xdd4UD44TN
https://t.co/NTvxzojcAv

🔗 https://mayfly277.github.io/posts/GOADv2-pwning_part1/
🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part2/
🔗 https://mayfly277.github.io/posts/GOADv2-pwning-part3/

🐥 [ tweet ]

😈 [ mpgn_x64, mpgn ]

Dumping SAM from a live Kali Linux in 2022 🔽

1⃣ cd Windows/System32/config
2⃣ pypykatz registry --sam SAM SYSTEM

Tools like chntpw, bkhive, pwdump, samdump2 are not working on latest Windows 10 👀

https://t.co/LyHlBnvcCX

🔗 https://security.stackexchange.com/a/158174/41351

🐥 [ tweet ]

😈 [ _mohemiv, Arseniy Sharoglazov ]

🧨 Be aware, dnSpy .NET Debugger / Assembly Editor has been trojaned again!

In Google's TOP 2, there was a malicious site maintained by threat actors, who also distributed infected CPU-Z, Notepad++, MinGW, and many more.

🎯 Thanks to NameSilo, the domain has been deactivated!

🐥 [ tweet ]

😈 [ 0xdeaddood, leandro ]

Just merged to Impacket the [MS-TSTS] Terminal Services Terminal Server Runtime Interface Protocol implementation 🚀🔥

The PR also includes a new tool that allows you to run qwinsta, tasklist, taskkill, and more commands remotely!

Thanks @nopernik🎉
https://t.co/uZgHTChSPe

🔗 https://github.com/SecureAuthCorp/impacket/pull/1327

🐥 [ tweet ]

😈 [ ippsec, ippsec ]

HackTheBox RouterSpace video is now up, the tough thing with this box was getting an Android VM up and running to test the APK File. I'm always amazed at how much trouble I have with the normal Android SDK Manager, thankful for Genymotion here. https://t.co/LQ1UP6k9F3

🔗 https://youtu.be/bilgniEPOfs

🐥 [ tweet ]

😈 [ DirectoryRanger, DirectoryRanger ]

Implementing Global Injection and Hooking in Windows, by @m417z
https://t.co/ayx9cFZPdp

🔗 https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/

🐥 [ tweet ]

😈 [ DirectoryRanger, DirectoryRanger ]

Good series on AD sec by @Bhaskarpal__
(1) https://t.co/LT3oD9bqDU
(2) https://t.co/CCkeWe3Nuy
(3) https://t.co/B4egj79cUg
(4) https://t.co/zN0GkXlZfS
(5) https://t.co/kgKlIxla0I

🔗 https://0xstarlight.github.io/posts/Active-Directory-Introduction/
🔗 https://0xstarlight.github.io/posts/Offensive-PowerShell/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Local-Privilege-Escalation/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Lateral-Movement/
🔗 https://0xstarlight.github.io/posts/Active-Directory-Domain-Persistence/

🐥 [ tweet ]