😈 [ SkelSec, SkelSec ]

"It's not a flat network, we have routers" - unnamed client

🐥 [ tweet ]

🤷🏻‍♂️

😈 [ dekel_paz, Dekel Paz ]

Uploaded a new noscript that adds vulnerabilities to #BloodHound by parsing scanner reports. Now you can search for vulnerable hosts in your network with paths to Domain Admins!
https://t.co/voN11IR3NL
P.S. did you catch the upcoming #BlueHound spoiler at the end?
@ZeroNetworks

🔗 https://github.com/zeronetworks/BloodHound-Tools/tree/main/VulnerabilitiesDataImport

🐥 [ tweet ]

😈 [ Six2dez1, Six2dez ]

My mate @cybersecivan has released a small golang utility to grab the latest trending CVE's from @CVEtrends to easily pipe in your workflow 🔥

Check it out!

https://t.co/6VlyN8ihxW

🔗 https://github.com/tr3ss/gofetch

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

🧵 (1/x) Reanimating ADCSPwn thread (in a simple way) ⏬

You all know this great tool by @_batsec_, but unfortunately Microsoft broke it with one of those anti-PetitPotam patches a while ago ⏬

https://t.co/LeYa5s5sfv

#lpe #adcs #petitpotam #webdav

🔗 https://github.com/bats3c/ADCSPwn/issues/3#issuecomment-901713533

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

🧵 (2/x) So that now the execution hangs like follows ⏬

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

🧵 (3/x) But guess what, there’s another super cool tool – Coercer (by @podalirius_) – which can be used to trigger the authentication with a different API that is not affected by the ad-hoc check provided in the patch ⏬

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

🧵 (4/x) And now *tada* I can get my machine account certificate on a fully patched Windows 10 ⏬

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

🧵 (5/x) Check out @Flangvik’s stream to know more about ADCSPwn usage: https://t.co/nG8gRKo3rn

🔗 https://youtu.be/W9pUCVxe59Q

🐥 [ tweet ]

😈 [ _dirkjan, Dirk-jan ]

Working on some tooling, and managed to get PRT injection during browser sign-in working with Selenium. If you steal a PRT from a hybrid/compliant device, you can use this to "upgrade" the sign-in of other users, to comply with conditional access policies requiring this status.

🐥 [ tweet ]

😈 [ m3g9tr0n, Spiros Fraganastasis ]

Similar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged processes to access malicious pipes for exploitation https://t.co/DtcR08PDTN

🔗 https://github.com/crisprss/magicNetdefs

🐥 [ tweet ]

😈 [ vxunderground, vx-underground ]

Modern day cyber security explained

🐥 [ tweet ]

😈 [ d4rckh, d4rckh ]

btw, i made a very simple http redirector (also in nim) which can be used with probably any c2 you can imagine
https://t.co/GMfRMpXrSV #redteam

🔗 https://github.com/d4rckh/http-redirector

🐥 [ tweet ]

😈 [ tifkin_, Lee Christensen ]

Users password/doc syncing in corporate environments is dangerous. I've seen many corporate users - particularly IT admins - with Chrome Password sync enabled or Last/pass/1pass installed.

The home computer the DA password is synced to that their kids use doesn't have <FancyEDR>

🐥 [ tweet ]

😈 [ vinopaljiri, Jiří Vinopal ]

Using #Powershell based on .NET >= 5 or .NET Core (so also latest Powershell Linux/Windows) you can easily natively manipulate with PE and do things like in the picture below (ML processing of .data section strings using #StringSifter) 🙃🙌👍

🐥 [ tweet ]

😈 [ an0n_r0, an0n ]

had to fix couple of bugs of the sideload cmd in Sliver, but now it loads Mimikatz DLL (using Donut behind the scenes) and even bypasses Defender without much effort. it is still not perfect, output fetching is not working for some reason, but it is almost functional.

🐥 [ tweet ]

😈 [ NinjaParanoid, Chetan Nayak (Brute Ratel C4) ]

Amongst all EDRs, SentinelOne applies the most userland hooks, not only in DLLs but also a few other places. So, I decided to make a brief video explaining it's hooks & traps in memory, & how #BruteRatel evades it. Video contains light reversing and dev!!

https://t.co/WdS0z4PSyD

🔗 https://www.youtube.com/watch?v=qakZwswi5Jw

🐥 [ tweet ]

😈 [ ORCA10K, ORCA ]

Released a poc on Perun's Fart by #sektor7, that patch ntdll, with a new one read from a suspended process, thus unhooking your syscalls

https://t.co/y3LKQrwOJL

🔗 https://gitlab.com/ORCA000/perunsfart

🐥 [ tweet ]

😈 [ BlWasp_, BlackWasp ]

PAPAPA NOUVELLE PR!
My first PR on CrackMapExec: I have implemented the read and backup functions of the https://t.co/HQleAKcVrm Impacket noscript in a LDAP module for #CME with some improvements.
For the moment, the write functions are not possible.
https://t.co/NCdsjlsStA

🔗 https://github.com/Porchetta-Industries/CrackMapExec/pull/610

🐥 [ tweet ]

😈 [ HuskyHacksMK, Matt | HuskyHacks ]

🔬A new section has been added to PMAT and it's available for everyone!

I've added a new sample to teach simple x86 binary patching methodology.

📚Lesson: https://t.co/cIuqUKd4Fw

🦠Lab Repo: https://t.co/apbskSMBkY

🔗 https://notes.huskyhacks.dev/notes/on-patching-binaries
🔗 https://github.com/HuskyHacks/PMAT-labs/tree/main/labs/2-4.BinaryPatching/SimplePatchMe

🐥 [ tweet ]