😈 [ 0gtweet, Grzegorz Tworek ]

As a fan of non-obvious persistence mechanisms I had to try to collect (and categorize!) them all. It has just started, first 10 entries appeared, and more is coming each day.
I am happy to share it. Enjoy, contribute, use freely - https://t.co/PWb2ofSZjQ

🔗 https://persistence-info.github.io/

🐥 [ tweet ]

😈 [ SkelSec, SkelSec ]

YOU👏DON'T👏NEED👏A👏REDTEAM👏
The security consultants identified that the domain controller XXX uses an outdated Apache server running as “NT/SYSTEM” which uses the default “cgi-bin” folder to host the application logic. This folder was found to be writable by any domain user..

🐥 [ tweet ]

😈 [ podalirius_, Podalirius ]

Want to play around with @Microsoft #RPC? I'm releasing a few #tools that I use in my lab 👌

Today I'm releasing a tool that lists all open #SMB #pipes remotely in live mode. With this you can easily see which pipes will open when starting services. 🥳

https://t.co/PWNQFkGDag

🔗 https://github.com/p0dalirius/microsoft-rpc-fuzzing-tools

🐥 [ tweet ]

😈 [ mariuszbit, mgeeky | Mariusz Banach ]

- "... and then he said to sign my malware.exe with faked Microsoft cert to evade AVs/EDRs. Would you believe?"

(￣y▽￣)╭ Ohohoho.....

Sign-Artifact.ps1 - based on @mattifestation research & implementation shamelessly borrowed here:

https://t.co/6LAVgCrOVN

🔗 https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/red-teaming/Self-Signed%20Threat

🐥 [ tweet ]

😈 [ an0n_r0, an0n ]

another episode of my Sliver C2 testing. off-the-shelf bypass techniques like the unhook-bof in the official Armory seems to be useful and performs well against some modern EDR/AV products. seems like it is less painful than with Cobalt Strike. :)

🐥 [ tweet ]

😈 [ harmj0y, Will Schroeder ]

After an awesome back and forth with @cnotin and @SteveSyfuhs on the effects of "TokenLeakDetectDelaySecs" and "Protected Users" for mitigating token theft, I've updated the Koh README to reflect this (and updated the post to point to the README as well) https://t.co/AGViEV0stq

🔗 https://github.com/GhostPack/Koh/blob/main/README.md#mitigations

🐥 [ tweet ]

😈 [ ptswarm, PT SWARM ]

💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE!

Read the research: https://t.co/PJZHLRM8xq

🔗 https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/

🐥 [ tweet ]

😈 [ 404death, sailay(valen) ]

I just recently found out the way
XSS <a> tag without user action
<a/autofocus/onfocus=alert(0) href>valen</a>
<a/href="#"/autofocus/onfocus=alert`valen`>you don't need user action on a tag</a>

Tested on:
https://t.co/RkGdfpNWli
https://t.co/bPvMeBlba1

🔗 https://xss-game.appspot.com/level1/frame
🔗 http://testphp.vulnweb.com/search.php?test=query

🐥 [ tweet ]

😈 [ tiraniddo, James Forshaw ]

Final LSA bug from last month is now open. An interesting one which breaks common assumptions of impersonation security over the LSA's RPC interface. Me and @monoxgas will describe a way of abusing the bug at BH next month to get SYSTEM privileges. https://t.co/v523Q1EXLD

🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2278

🐥 [ tweet ]

😈 [ aniqfakhrul, Aniq Fakhrul ]

Our version of PywerView is now publicly available. Python version or PowerView, remotely interacts with ldap server. Also included with mini interactive console with auto completion. Yeet! @h0j3n @imnirfn
https://t.co/c0cdk2fGPr

🔗 https://github.com/aniqfakhrul/PywerView

🐥 [ tweet ]

😈 [ eric_capuano, Eric Capuano ⬡ ]

Interesting API details on how a process is launched in Windows

Specifically dig the part on Protected Processes

https://t.co/V5lWrEqKaT

🔗 https://fourcore.io/blogs/how-a-windows-process-is-created-part-1

🐥 [ tweet ]

😈 [ aniqfakhrul, Aniq Fakhrul ]

TIL: If ldap/ldaps ports are blocked by firewall but gc port (3268) is accessible. In my case, kerberoasting with impacket can't be achieved. Simply switch ldap:// protocol to gc:// in impacket and win!

🐥 [ tweet ]

😈 [ citronneur, Sylvain Peyrefitte ]

Disable SSL certificate verification using #eBPF :
https://t.co/UBsT4TU43H

🔗 https://github.com/citronneur/blindssl

🐥 [ tweet ]

😈 [ 0xdf_, 0xdf ]

Acute from @hackthebox_eu was just a hard pure Windows box. I'll pivot between two hosts largely relying on credentials and enumeration to get domain admin.

https://t.co/p0Fhgak2dI

🔗 https://0xdf.gitlab.io/2022/07/16/htb-acute.html

🐥 [ tweet ]

😈 [ ippsec, ippsec ]

#HackTheBox Acute video is now up! This was a tough Windows box with all the pivots between users. I decided to try out ConPtyShell to get a full PTY on Windows, had to do some light modifications to bypass Defender. https://t.co/hey5QSjGDr

🔗 https://youtu.be/jDYte7xNY1g

🐥 [ tweet ]