Dynamic Shellcode Execution
https://countercept.com/blog/dynamic-shellcode-execution
@WindowsHackingLibrary
https://countercept.com/blog/dynamic-shellcode-execution
@WindowsHackingLibrary
WEF Logging Bypass for Elastic's Winlogbeat
https://blog.neu5ron.com/2019/03/wef-logging-bypass-for-elastics.html
@WindowsHackingLibrary
https://blog.neu5ron.com/2019/03/wef-logging-bypass-for-elastics.html
@WindowsHackingLibrary
Neu5Ron
WEF Logging Bypass for Elastic's Winlogbeat
Background On 2019-02-26 3:27am EST, I alerted Elastic to a reliable bypass for Winlogbeat. Thankfully, it is now fixed as of 6.6.2 I ...
Fileless UAC Bypass in Windows Store Binary
https://www.activecyber.us/activelabs/windows-uac-bypass
@WindowsHackingLibrary
https://www.activecyber.us/activelabs/windows-uac-bypass
@WindowsHackingLibrary
Development of a new Windows 10 KASLR Bypass (in One WinDBG Command)
https://www.offensive-security.com/vulndev/development-of-a-new-windows-10-kaslr-bypass-in-one-windbg-command
@WindowsHackingLibrary
https://www.offensive-security.com/vulndev/development-of-a-new-windows-10-kaslr-bypass-in-one-windbg-command
@WindowsHackingLibrary
Red Team Telemetry: Empire Edition
https://www.lares.com/red-team-telemetry-empire-edition
@WindowsHackingLibrary
https://www.lares.com/red-team-telemetry-empire-edition
@WindowsHackingLibrary
Kerbrute
A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication
https://github.com/ropnop/kerbrutehttps://github.com/ropnop/kerbrute
@WindowsHackingLibrary
A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication
https://github.com/ropnop/kerbrutehttps://github.com/ropnop/kerbrute
@WindowsHackingLibrary
Faction C2 Framework
A modern, flexible C2 framework
https://github.com/factionc2
@WindowsHackingLibrary
A modern, flexible C2 framework
https://github.com/factionc2
@WindowsHackingLibrary
GitHub
Faction C2 Framework
A modern, flexible C2 framework (currently very beta) - Faction C2 Framework
Excel4-DCOM
PowerShell and Cobalt Strike noscripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe).
https://github.com/outflanknl/Excel4-DCOM
@WindowsHackingLibrary
PowerShell and Cobalt Strike noscripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe).
https://github.com/outflanknl/Excel4-DCOM
@WindowsHackingLibrary
GitHub
GitHub - outflanknl/Excel4-DCOM: PowerShell and Cobalt Strike noscripts for lateral movement using Excel 4.0 / XLM macros via DCOM…
PowerShell and Cobalt Strike noscripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe) - outflanknl/Excel4-DCOM
CommandoVM - a fully customized, Windows-based security distribution for penetration testing and red teaming
https://github.com/fireeye/commando-vm
@WindowsHackingLibrary
https://github.com/fireeye/commando-vm
@WindowsHackingLibrary
GitHub
GitHub - mandiant/commando-vm: Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual…
Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com - mandiant/commando-vm
w0rk3r's Windows Hacking Library
CommandoVM - a fully customized, Windows-based security distribution for penetration testing and red teaming https://github.com/fireeye/commando-vm @WindowsHackingLibrary
Commando VM: The First of Its Kind Windows Offensive Distribution
https://www.fireeye.com/blog/threat-research/2019/03/commando-vm-windows-offensive-distribution.html
@WindowsHackingLibrary
https://www.fireeye.com/blog/threat-research/2019/03/commando-vm-windows-offensive-distribution.html
@WindowsHackingLibrary
Google Cloud Blog
Commando VM: The First of Its Kind Windows Offensive Distribution | Mandiant | Google Cloud Blog
SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
https://github.com/mwrlabs/SharpGPOAbuse
@WindowsHackingLibrary
https://github.com/mwrlabs/SharpGPOAbuse
@WindowsHackingLibrary
GitHub
GitHub - FSecureLABS/SharpGPOAbuse: SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's…
SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are contr...
An SMB Relay Race – How To Exploit LLMNR and SMB Message Signing for Fun and Profit
https://www.blackhillsinfosec.com/an-smb-relay-race-how-to-exploit-llmnr-and-smb-message-signing-for-fun-and-profit
@WindowsHackingLibrary
https://www.blackhillsinfosec.com/an-smb-relay-race-how-to-exploit-llmnr-and-smb-message-signing-for-fun-and-profit
@WindowsHackingLibrary
Black Hills Information Security, Inc.
An SMB Relay Race - How To Exploit LLMNR and SMB Message Signing for Fun and Profit - Black Hills Information Security, Inc.
Jordan Drysdale// This is basically a slight update and rip off of Marcello’s work out here: https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html /tl;dr – Zero to DA on an environment through…
Finding Weaknesses Before the Attackers Do
https://www.fireeye.com/blog/threat-research/2019/04/finding-weaknesses-before-the-attackers-do.html
@WindowsHackingLibrary
https://www.fireeye.com/blog/threat-research/2019/04/finding-weaknesses-before-the-attackers-do.html
@WindowsHackingLibrary
The Death Metal Suite
https://www.coalfire.com/The-Coalfire-Blog/April-2019/The-Death-Metal-Suite
@WindowsHackingLibrary
https://www.coalfire.com/The-Coalfire-Blog/April-2019/The-Death-Metal-Suite
@WindowsHackingLibrary
Coalfire
The Death Metal Suite
Death Metal is a toolkit designed to exploit AMT’s legitimate features, as the AMT framework’s functionality, designed for innocent system administration…
Bypassing AD account lockout for a compromised account
https://medium.com/@markmotig/bypassing-ad-account-lockout-for-a-compromised-account-5c908d663de8
@WindowsHackingLibrary
https://medium.com/@markmotig/bypassing-ad-account-lockout-for-a-compromised-account-5c908d663de8
@WindowsHackingLibrary
Medium
Bypassing AD account lockout for a compromised account
This is for educational purposes only. Never do security testing on a machine you do not own or have permission to test on. If you don’t…