Сразу две статьи от SpecterOps, можно считать, одна - продолжение другой. В блоге разбирают атаки на трасты AD, но с упором на BloodHound CE.
1. Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound
2. Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA)
Даже если не собираетесь погружаться в BHCE, стоит просто бегло почитать))
#pentest #redteam #ad #trust #lateralmovement #bloodhound
1. Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound
2. Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA)
Даже если не собираетесь погружаться в BHCE, стоит просто бегло почитать))
#pentest #redteam #ad #trust #lateralmovement #bloodhound
SpecterOps
Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound - SpecterOps
The ability of an attacker controlling one domain to compromise another through an Active Directory (AD) trust depends on the trust type and configuration. To better map these relationships and make it easier to identify cross-domain attack paths, we are…
🔥20👍5
Reads blacklist.txt and blocks dlls from loading with option to unblock subsequently. Patches LdrLoadDll in local/remote process to return dll not found.
https://github.com/cybersectroll/TrollBlacklistDLL
#pentest #redteam #av #evasion
👍10🤔9🔥5😁2😱1
Forwarded from 1N73LL1G3NC3
Abusing Chrome Remote Desktop on Red Team Operations: A Practical Guide
In this post, we’ll be exploring a practical technique for abusing Chrome Remote Desktop (also known as Google Remote Desktop) within a Red Team operation.
In this post, we’ll be exploring a practical technique for abusing Chrome Remote Desktop (also known as Google Remote Desktop) within a Red Team operation.
👍23🔥13🥰4😁3
CVE-2025-32463: sudo 1.9.14-1.9.17 LPE
Blog + exploit: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
Patched: June 28, 2025
#lpe #linux #pentest #redteam
Blog + exploit: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
Patched: June 28, 2025
#lpe #linux #pentest #redteam
3🔥44👍9🤯8😁3
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
🩸 CitrixBleed 2 — Citrix NetScaler Memory Leak (CVE-2025-5777)
Critical memory leak vulnerability in Citrix NetScaler ADC/Gateway. Sending malformed POST request with login parameter without value causes server to return ~127 bytes of uninitialized stack memory, including session tokens, enabling MFA bypass and active session hijacking.
🔗 Research:
https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206
🔗 Source:
https://github.com/win3zz/CVE-2025-5777
#citrix #netscaler #memoryleak #exploit
Critical memory leak vulnerability in Citrix NetScaler ADC/Gateway. Sending malformed POST request with login parameter without value causes server to return ~127 bytes of uninitialized stack memory, including session tokens, enabling MFA bypass and active session hijacking.
🔗 Research:
https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206
🔗 Source:
https://github.com/win3zz/CVE-2025-5777
#citrix #netscaler #memoryleak #exploit
🔥16👍10😁2
CVE-2025-48799: Windows Update Service LPE
PoC: https://github.com/Wh04m1001/CVE-2025-48799
Patched: July 8, 2025
#lpe #windows #pentest #redteam
PoC: https://github.com/Wh04m1001/CVE-2025-48799
Patched: July 8, 2025
This vulnability affects windows clients (win11/win10) with at least 2 hard drives.
#lpe #windows #pentest #redteam
GitHub
GitHub - Wh04m1001/CVE-2025-48799
Contribute to Wh04m1001/CVE-2025-48799 development by creating an account on GitHub.
🔥21👍8😁3
CVE-2025-25257: Pre-Auth SQLi to RCE - Fortinet FortiWeb
PoC: https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257
Blog: https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/
#rce #pentest #redteam #fortinet #cve
PoC: https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257
Blog: https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/
Affected:
7.6.0 through 7.6.3
7.4.0 through 7.4.7
7.2.0 through 7.2.10
7.0.0 through 7.0.10
#rce #pentest #redteam #fortinet #cve
🔥29😁12👍5🤯2😱2
Forwarded from APT
🔑 Golden DMSA
Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.
🔗 Research:
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
🔗 Source:
https://github.com/Semperis/GoldenDMSA
#ad #windows #dmsa #kerberos #persistence
Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.
🔗 Research:
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
🔗 Source:
https://github.com/Semperis/GoldenDMSA
#ad #windows #dmsa #kerberos #persistence
👍20🔥10😁3🤔3
Немного про релей с SCCM в MSSQL для получения учетных данных NAA и не только.
https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/
А обновление в SCCMHunter обещают после BlackHat в августе
#ad #sccm #pentest #redteam #relay
https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/
А обновление в SCCMHunter обещают после BlackHat в августе
#ad #sccm #pentest #redteam #relay
SpecterOps
I’d Like to Speak to Your Manager: Stealing Secrets with Management Point Relays - SpecterOps
Network Access Account, Task Sequence, and Collection Settings policies can be recovered from SCCM by relaying a remote management point site system to the site database server.
🔥13👍5😁1
CVE-2025-53770: SharePoint RCE (ToolShell)
Exploit: https://github.com/soltanali0/CVE-2025-53770-Exploit
Upd: https://github.com/irsdl/ysonet
Patched: July 20, 2025
#rce #pentest #redteam #ad #sharepoint #cve
Exploit: https://github.com/soltanali0/CVE-2025-53770-Exploit
Upd: https://github.com/irsdl/ysonet
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 1 -c "calc"
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 2 -c "C:\\temp\\ExploitClass.cs;System.dll"
Patched: July 20, 2025
#rce #pentest #redteam #ad #sharepoint #cve
GitHub
GitHub - soltanali0/CVE-2025-53770-Exploit: SharePoint WebPart Injection Exploit Tool
SharePoint WebPart Injection Exploit Tool. Contribute to soltanali0/CVE-2025-53770-Exploit development by creating an account on GitHub.
🔥22👍8😁5🤔3🎉1
У SpecterOps очередная крутая статья про сбор данных из ADWS.
https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/
Что еще полезного: как использовать утилиту SoaPy, конвертировать данные в формат BloodHound, ну и конечно как обнаружить этот самый сбор данных домена.
#ad #pentes #redteam #enum #bloodhound #soap
https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/
Что еще полезного: как использовать утилиту SoaPy, конвертировать данные в формат BloodHound, ну и конечно как обнаружить этот самый сбор данных домена.
#ad #pentes #redteam #enum #bloodhound #soap
SpecterOps
Make Sure to Use SOAP(y) - An Operators Guide to Stealthy AD Collection Using ADWS - SpecterOps
Learn how to perform stealthy recon of Active Directory environments over ADWS for Red Team Assessments
🔥20👍7😁3
Forwarded from Adaptix Framework
AdaptixC2 v0.7 is out
https://github.com/Adaptix-Framework/AdaptixC2
* Поддержка скриптов AxScript
* Менеджер учетных данных
* Поддержка BOF в агенте gopher
* Новые BOF: potato-dcom, nanodump, noconsolation
Полная информация по обновлению: https://adaptix-framework.gitbook.io/adaptix-framework/changelog-and-updates/v0.6-greater-than-v0.7
https://github.com/Adaptix-Framework/AdaptixC2
* Поддержка скриптов AxScript
* Менеджер учетных данных
* Поддержка BOF в агенте gopher
* Новые BOF: potato-dcom, nanodump, noconsolation
Полная информация по обновлению: https://adaptix-framework.gitbook.io/adaptix-framework/changelog-and-updates/v0.6-greater-than-v0.7
🔥44👍12🤔1
https://github.com/TheSleekBoyCompany/AnsibleHound
#pentest #ansible #bloodhound
Go collector for adding Ansible WorX and Ansible Tower attack paths to BloodHound with OpenGraph
#pentest #ansible #bloodhound
👍30
Ralf Hacker Channel
Несколько часов назад была сильно обновлена утилита certipy. Обратим внимание, что в документации также появилось описание техники ESC16... #redteam #pentest #ad #adcs
Три месяца назад было обновление скрипта certipy, а вот теперь вышло обновление и для Certify.
Blog: https://specterops.io/blog/2025/08/11/certify-2-0/
Wiki: https://github.com/GhostPack/Certify/wiki/4-%E2%80%90-Escalation-Techniques
#ad #pentest #redteam #adcs
Blog: https://specterops.io/blog/2025/08/11/certify-2-0/
Wiki: https://github.com/GhostPack/Certify/wiki/4-%E2%80%90-Escalation-Techniques
#ad #pentest #redteam #adcs
SpecterOps
Certify 2.0 - SpecterOps
Certify 2.0 features a suite of new capabilities and usability enhancements. This blogpost introduces changes and features additions.
3👍19🔥7
Forwarded from 1N73LL1G3NC3
Collect infrastructure and permissions data from vCenter and export it as a BloodHound‑compatible graph using Custom Nodes/Edges
Please open Telegram to view this post
VIEW IN TELEGRAM
👍27🔥8😁4😱1
Иногда DLL библиотеки не содержат реализации каких-то функций, а просто вызывают соответсивующую функцию из другой DLLки. Пример есть в следующем посте.
https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/
А еще там есть уже готовый списочек, удобно:
https://hexacorn.com/d/apis_fwd.txt
#maldev #winapi
https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/
А еще там есть уже готовый списочек, удобно:
https://hexacorn.com/d/apis_fwd.txt
#maldev #winapi
2🔥17👍9😁6🤔3
Real-time analysis of LOLDrivers against Microsoft's HVCI blocklist
https://byovd-watchdog.pwnfuzz.com/
Хороший ресурс)
#drivers #lpe #windows #lol
https://byovd-watchdog.pwnfuzz.com/
Хороший ресурс)
#drivers #lpe #windows #lol
🔥18👍6😁2
Forwarded from ByTe [ ]f Digital Life
Как за пару кнопок убить AV/EDR (разных цветов)
Из требований:
- Наличие прав админа на тачке;
- Возможность доставки procmon.
А далее всё более чем прозаично.
1. Включение функции "EnableBootLooging";
2. Создание символической ссылки:
3. Ребут тачки.
Получаем магию.
Подробнее:
https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html?m=1
Из требований:
- Наличие прав админа на тачке;
- Возможность доставки procmon.
А далее всё более чем прозаично.
1. Включение функции "EnableBootLooging";
2. Создание символической ссылки:
mklink C:\Windows\Procmon.pmb "<Полный путь до файла который требуется перезаписать>"
3. Ребут тачки.
Получаем магию.
Подробнее:
https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html?m=1
1😁37🔥24👍6🤔2😱2
Evasion-Kit for Cobalt Strike
Blog: https://rastamouse.me/crystal-kit/
Soft: https://github.com/rasta-mouse/Crystal-Kit
#maldev #cs #pentest #redteam
Blog: https://rastamouse.me/crystal-kit/
Soft: https://github.com/rasta-mouse/Crystal-Kit
#maldev #cs #pentest #redteam
Rasta Mouse
Crystal Kit
tl;dr - repo here.
The Crystal Kit is an experimental project designed to replace Cobalt Strike's Sleepmask. The Sleepmask (and BeaconGate) are key to Beacon's runtime evasion strategy - not only does it mask Beacon's memory, it also acts as an API proxy…
The Crystal Kit is an experimental project designed to replace Cobalt Strike's Sleepmask. The Sleepmask (and BeaconGate) are key to Beacon's runtime evasion strategy - not only does it mask Beacon's memory, it also acts as an API proxy…
🔥20👍8😁3🤔3
Forwarded from 1N73LL1G3NC3
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
🔗 DumpGuard
Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.
P.S. Previously, crack.sh operated a free service for performing rainbow table lookups to recover NT hashes from NTLMv1 responses, but was recently shut down due to maintenance issues. In its absence, a new free service was published at ntlmv1.com.
Please open Telegram to view this post
VIEW IN TELEGRAM
👍14🔥14😁6🥰4