Copying Files via WMI and PowerShell
https://www.fortynorthsecurity.com/copying-files-via-wmi-and-powershell
@WindowsHackingLibrary
https://www.fortynorthsecurity.com/copying-files-via-wmi-and-powershell
@WindowsHackingLibrary
Using WinRM Through Meterpreter
https://www.trustedsec.com/2017/09/using-winrm-meterpreter
@WindowsHackingLibrary
https://www.trustedsec.com/2017/09/using-winrm-meterpreter
@WindowsHackingLibrary
TrustedSec
Cybersecurity Education from the Experts | TrustedSec Blog Posts
Learn more about how to safeguard your company through our educational blog posts on everything from updated tech to the newest scams infiltrating organizations today.
Forwarded from w0rk3r's Blue team Library (Jonhnathan Jonhnathan Jonhnathan)
TBAL: an (accidental?) DPAPI Backdoor for local users
https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor
@BlueTeamLibrary
https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor
@BlueTeamLibrary
VztekOverflow
TBAL: an (accidental?) DPAPI Backdoor for local users
a.k.a how a convenience feature undermined a security feature
Forwarded from w0rk3r's Blue team Library (Jonhnathan Jonhnathan Jonhnathan)
YouTube
TBAL: an (accidental?) DPAPI Backdoor for local users
The Data Protection API (DPAPI) provided by Windows is a way of protecting secrets used by a lot of popular software solutions, most famously by Google Chrome when storing passwords and cookies. A lot has been said recently about the security of this API…
P0wnedShell:
PowerShell Runspace Post Exploitation Toolkit
https://github.com/Cn33liz/p0wnedShell
@WindowsHackingLibrary
PowerShell Runspace Post Exploitation Toolkit
https://github.com/Cn33liz/p0wnedShell
@WindowsHackingLibrary
GitHub
GitHub - Cn33liz/p0wnedShell: PowerShell Runspace Post Exploitation Toolkit
PowerShell Runspace Post Exploitation Toolkit. Contribute to Cn33liz/p0wnedShell development by creating an account on GitHub.
mimiDbg:
PowerShell oneliner to retrieve wdigest passwords from the memory
https://github.com/giMini/mimiDbg
@WindowsHackingLibrary
PowerShell oneliner to retrieve wdigest passwords from the memory
https://github.com/giMini/mimiDbg
@WindowsHackingLibrary
GitHub
GitHub - giMini/mimiDbg: PowerShell oneliner to retrieve wdigest passwords from the memory
PowerShell oneliner to retrieve wdigest passwords from the memory - giMini/mimiDbg
Golden Ticket Attack Execution Against AD-Integrated SSO providers
https://www.fractalindustries.com/newsroom/blog/gt-attacks-and-sso
@WindowsHackingLibrary
https://www.fractalindustries.com/newsroom/blog/gt-attacks-and-sso
@WindowsHackingLibrary
Fractalindustries
GT Attacks and SSO - Fractal Industries
Cloud and SaaS offerings have accelerated the need to understand Golden Ticket Attacks and Single Sign-On issues, as well as the ways to quickly solve these problems at scale
BloodHound 2.0 released!
https://github.com/BloodHoundAD/BloodHound/releases/tag/2.0
@WindowsHackingLibrary
https://github.com/BloodHoundAD/BloodHound/releases/tag/2.0
@WindowsHackingLibrary
GitHub
Release BloodHound 2.0 · BloodHoundAD/BloodHound
This is a major feature release for BloodHound, introducing several new features, optimizations, and bugfixes. For a full changelog, see the blog post at https://blog.cptjesus.com/posts/bloodhound2...
Windows Privilege Escalation Fundamentals
http://www.fuzzysecurity.com/tutorials/16.html
@WindowsHackingLibrary
http://www.fuzzysecurity.com/tutorials/16.html
@WindowsHackingLibrary
Disabling AMSI in JScript with One Simple Trick
https://tyranidslair.blogspot.com/2018/06/disabling-amsi-in-jnoscript-with-one.html
@WindowsHackingLibrary
https://tyranidslair.blogspot.com/2018/06/disabling-amsi-in-jnoscript-with-one.html
@WindowsHackingLibrary
www.tiraniddo.dev
Disabling AMSI in JScript with One Simple Trick
This blog contains a very quick and dirty way to disable AMSI in the context of Windows Scripting Host which doesn't require admin privilege...
Unstoppable Service:
A pattern for a self-installing Windows service in C# with the unstoppable attributes in C#.
https://github.com/malcomvetter/UnstoppableService
@WindowsHackingLibrary
A pattern for a self-installing Windows service in C# with the unstoppable attributes in C#.
https://github.com/malcomvetter/UnstoppableService
@WindowsHackingLibrary
GitHub
GitHub - malcomvetter/UnstoppableService: A pattern for a self-installing Windows service in C# with the unstoppable attributes…
A pattern for a self-installing Windows service in C# with the unstoppable attributes in C#. - malcomvetter/UnstoppableService
Driver loader for bypassing Windows x64 Driver Signature Enforcement
https://github.com/hfiref0x/TDL
@WindowsHackingLibrary
https://github.com/hfiref0x/TDL
@WindowsHackingLibrary
GitHub
GitHub - hfiref0x/TDL: Driver loader for bypassing Windows x64 Driver Signature Enforcement
Driver loader for bypassing Windows x64 Driver Signature Enforcement - hfiref0x/TDL
Subverting Sysmon:
Application of a Formalized Security Product Evasion Methodology
Code:
https://github.com/mattifestation/BHUSA2018_Sysmon/tree/master/Code
Slides:
https://github.com/mattifestation/BHUSA2018_Sysmon/blob/master/Slides_Subverting_Sysmon.pdf
Whitepaper:
https://github.com/mattifestation/BHUSA2018_Sysmon/blob/master/Whitepaper_Subverting_Sysmon.pdf
@WindowsHackingLibrary
Application of a Formalized Security Product Evasion Methodology
Code:
https://github.com/mattifestation/BHUSA2018_Sysmon/tree/master/Code
Slides:
https://github.com/mattifestation/BHUSA2018_Sysmon/blob/master/Slides_Subverting_Sysmon.pdf
Whitepaper:
https://github.com/mattifestation/BHUSA2018_Sysmon/blob/master/Whitepaper_Subverting_Sysmon.pdf
@WindowsHackingLibrary
GitHub
BHUSA2018_Sysmon/Code at master · mattifestation/BHUSA2018_Sysmon
All materials from our Black Hat 2018 "Subverting Sysmon" talk - mattifestation/BHUSA2018_Sysmon
SMBetray: Backdooring and Breaking Signatures
https://quickbreach.io/2018/08/12/smbetray-backdooring-and-breaking-signatures
https://github.com/QuickBreach/SMBetray.git
@WindowsHackingLibrary
https://quickbreach.io/2018/08/12/smbetray-backdooring-and-breaking-signatures
https://github.com/QuickBreach/SMBetray.git
@WindowsHackingLibrary
ADRecon: Active Directory Recon Blackhat Arsenal 2018
https://www.slideshare.net/mobile/prashant3535/adrecon-bh-usa-2018-arsenal-and-def-con-26-demo-labs-presentation
https://github.com/sense-of-security/adrecon
@WindowsHackingLibrary
https://www.slideshare.net/mobile/prashant3535/adrecon-bh-usa-2018-arsenal-and-def-con-26-demo-labs-presentation
https://github.com/sense-of-security/adrecon
@WindowsHackingLibrary
www.slideshare.net
ADRecon BH USA 2018 : Arsenal and DEF CON 26 Demo Labs Presentation
Demo of ADRecon presented on 08th and 12th August at BlackHat USA 2018 Arsenal and DEF CON 26 Demo Labs. https://www.blackhat.com/us-18/arsenal/schedule/index.…
Ps1jacker:
A tool for generating COM Hijacking payload.
https://github.com/darkw1z/Ps1jacker
@WindowsHackingLibrary
A tool for generating COM Hijacking payload.
https://github.com/darkw1z/Ps1jacker
@WindowsHackingLibrary
GitHub
GitHub - cybercitizen7/Ps1jacker: Ps1jacker is a tool for generating COM Hijacking payload.
Ps1jacker is a tool for generating COM Hijacking payload. - GitHub - cybercitizen7/Ps1jacker: Ps1jacker is a tool for generating COM Hijacking payload.
DEF CON 26 (2018) – Exploiting Active Directory Administrator Insecurities
https://adsecurity.org/wp-content/uploads/2018/08/2018-DEFCON-ExploitingADAdministratorInsecurities-Metcalf.pdf
@WindowsHackingLibrary
https://adsecurity.org/wp-content/uploads/2018/08/2018-DEFCON-ExploitingADAdministratorInsecurities-Metcalf.pdf
@WindowsHackingLibrary
From Workstation to Domain Admin: Why Secure Administration isn’t Secure and How to Fix it
https://adsecurity.org/wp-content/uploads/2018/08/us-18-Metcalf-From-Workstation-To-Domain-Admin-Why-Secure-Administration-Isnt-Secure-Final.pdf
@WindowsHackingLibrary
https://adsecurity.org/wp-content/uploads/2018/08/us-18-Metcalf-From-Workstation-To-Domain-Admin-Why-Secure-Administration-Isnt-Secure-Final.pdf
@WindowsHackingLibrary