NEW BOT Телеграм, страница - 9444820

w0rk3r's Windows Hacking Library

@windowshackinglibrary

1.55K subscribers

10 photos

577 links

Manual job, I'm not a bot ;)

@BlueTeamLibrary
@W0rk3r

Download Telegram

About

Blog

Apps

Platform

w0rk3r's Windows Hacking Library

1.55K subscribers

w0rk3r's Windows Hacking Library

Group Policies Going Rogue

GPSVC exposes all domain-joined Windows machines to an escalation of privileges (EoP) vulnerability.

https://www.cyberark.com/resources/threat-research-blog/group-policies-going-rogue

@WindowsHackingLibrary

Group Policies Going Rogue

This blog –part of a year-long research project that uncovered 60 different vulnerabilities across major vendors – discusses a vulnerability in the Windows group policy object (GPO) mechanism....

1.49K viewsJonhnathan Jonhnathan Jonhnathan, 03:57

w0rk3r's Windows Hacking Library

PE Parsing and Defeating AV/EDR API Hooks in C++

https://www.solomonsklash.io/pe-parsing-defeating-hooking.html

@WindowsHackingLibrary

www.solomonsklash.io

PE Parsing and Defeating AV/EDR API Hooks in C++ - SolomonSklash.io

A look at code to parse the PE header and remove API hooks placed by AV/EDR.

2.39K viewsJonhnathan Jonhnathan Jonhnathan, 04:25

w0rk3r's Windows Hacking Library

"Heresy's Gate": Kernel Zw*/NTDLL Scraping +
"Work Out": Ring 0 to Ring 3 via Worker Factories

https://zerosum0x0.blogspot.com/2020/06/heresys-gate-kernel-zwntdll-scraping.html

@WindowsHackingLibrary

"Heresy's Gate": Kernel Zw*/NTDLL Scraping + <br />"Work Out": Ring 0 to Ring 3 via Worker Factories

Introduction Heresy's Gate Closing Nebbett's Gate Meltdown KVA Shadow Page Fault Loop NTDLL ...

1.78K viewsJonhnathan Jonhnathan Jonhnathan, 15:41

w0rk3r's Windows Hacking Library

Sysmon Image File Name Evasion

https://undev.ninja/sysmon-image-file-name-evasion

@WindowsHackingLibrary

Sysmon Image File Name Evasion

Abusing a bug in Sysmon's driver to fake source processes' image file names.

1.71K viewsJonhnathan Jonhnathan Jonhnathan, 00:26

w0rk3r's Windows Hacking Library

Engineering antivirus evasion

https://blog.scrt.ch/2020/06/19/engineering-antivirus-evasion

@WindowsHackingLibrary

2.46K viewsJonhnathan Jonhnathan Jonhnathan, 22:24

w0rk3r's Windows Hacking Library

Persistence: “the continued or prolonged existence of something” Series

Part 1 – Microsoft Office

https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-1-microsoft-office

Part 2 – COM Hijacking

https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-2-com-hijacking

Part 3 – WMI Event Subnoscription

https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-3-wmi-event-subnoscription

@WindowsHackingLibrary

Persistence: "the continued or prolonged existence of something": Part 1 - Microsoft Office - MDSec

During a red team engagement, one of the first things you may want to do after obtaining initial access is establish reliable persistence on the endpoint. Being able to streamline...

2.86K viewsJonhnathan Jonhnathan Jonhnathan, 03:01

w0rk3r's Windows Hacking Library

Automating DLL Hijack Discovery

https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0

@WindowsHackingLibrary

Automating DLL Hijack Discovery

A dive into Windows DLLs, DLL hijacking, automation, WinAPI, and finding the root cause of shared DLL hijacks.

2.72K viewsJonhnathan Jonhnathan Jonhnathan, 03:16

w0rk3r's Windows Hacking Library

A Guide to Reversing and Evading EDRs

Part 1: Introduction

http://jackson-t.ca/edr-reversing-evading-01.html

Part 2: Sensor Reconnaissance

http://jackson-t.ca/edr-reversing-evading-02.html

Part 3: Diverting EDR Telemetry to Private Infrastructure

http://jackson-t.ca/edr-reversing-evading-03.html

@WindowsHackingLibrary

1.83K viewsJonhnathan Jonhnathan Jonhnathan, 07:28

w0rk3r's Windows Hacking Library

SIGRed – Resolving Your Way into Domain Admin: Exploiting a 17 Year-old Bug in Windows DNS Servers

https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers

@WindowsHackingLibrary

Check Point Research

SIGRed - Resolving Your Way into Domain Admin: Exploiting a 17 Year-old Bug in Windows DNS Servers - Check Point Research

Research by: Sagi Tzadik Introduction DNS, which is often described as the “phonebook of the internet”, is a network protocol for translating human-friendly computer hostnames into IP addresses. Because it is such a core component of the internet, there are…

1.48K viewsJonhnathan Jonhnathan Jonhnathan, 06:45

w0rk3r's Windows Hacking Library

Bypassing LSA Protection (aka Protected Process Light) without Mimikatz on Windows 10

https://www.redcursor.com.au/blog/bypassing-lsa-protection-aka-protected-process-light-without-mimikatz-on-windows-10

@WindowsHackingLibrary

Bypassing LSA Protection without Mimikatz on Windows 10 - Red Cursor

Starting with Windows 8.1 (and Server 2012 R2) Microsoft introduced a feature termed LSA Protection. This feature is based on the ...

1.67K viewsJonhnathan Jonhnathan Jonhnathan, 21:08

w0rk3r's Windows Hacking Library

Extending the Exploration and Analysis of Windows RPC Methods Calling other Functions with Ghidra, Jupyter Notebooks and Graphframes

https://medium.com/threat-hunters-forge/extending-the-exploration-and-analysis-of-windows-rpc-methods-calling-other-functions-with-ghidra-e4cdaa9555bd

@WindowsHackingLibrary

Extending the Exploration and Analysis of Windows RPC Methods Calling other Functions with Ghidra 🐉, Jupyter Notebooks 📓 and Graphframes…

A few weeks ago, I was going over some of the research topics in my to-do list, and the one that sounded interesting to work on during 4th…

1.71K viewsJonhnathan Jonhnathan Jonhnathan, 05:11

w0rk3r's Windows Hacking Library

Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows.

https://github.com/jthuraisamy/TelemetrySourcerer

@WindowsHackingLibrary

GitHub - jthuraisamy/TelemetrySourcerer: Enumerate and disable common sources of telemetry used by AV/EDR.

Enumerate and disable common sources of telemetry used by AV/EDR. - jthuraisamy/TelemetrySourcerer

1.65K viewsJonhnathan Jonhnathan Jonhnathan, 12:51

w0rk3r's Windows Hacking Library

Attacking MS Exchange Web Interfaces

https://swarm.ptsecurity.com/attacking-ms-exchange-web-interfaces

@WindowsHackingLibrary

Attacking MS Exchange Web Interfaces

Describing all the techniques for attacking MS Exchange in Q2 2020 and introducing a new one: the LDAP via Exchange attack

2.6K viewsJonhnathan Jonhnathan Jonhnathan, 17:01

w0rk3r's Windows Hacking Library

CVE-2020-1337 – PrintDemon is dead, long live PrintDemon!

https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon

@WindowsHackingLibrary

1.54K viewsJonhnathan Jonhnathan Jonhnathan, 18:31

w0rk3r's Windows Hacking Library

Death from Above: Lateral Movement from Azure to On-Prem AD

https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d

@WindowsHackingLibrary

Death from Above: Lateral Movement from Azure to On-Prem AD

I’ve been looking into Azure attack primitives over the past couple of months to gain a better understanding of how the system works, what…

1.41K viewsJonhnathan Jonhnathan Jonhnathan, 09:11

w0rk3r's Windows Hacking Library

FireWalker: A New Approach to Generically Bypass User-Space EDR Hooking

https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking

@WindowsHackingLibrary

FireWalker: A New Approach to Generically Bypass User-Space EDR Hooking - MDSec

Introduction During red team engagements, it is not uncommon to encounter Endpoint Defence & Response (EDR) / Prevention (EDP) products that implement user-land hooks to gain insight in to a...

1.64K viewsJonhnathan Jonhnathan Jonhnathan, 12:19

w0rk3r's Windows Hacking Library

Death from Above: Lateral Movement from Azure to On-Prem AD

https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d

@WindowsHackingLibrary

Death from Above: Lateral Movement from Azure to On-Prem AD

I’ve been looking into Azure attack primitives over the past couple of months to gain a better understanding of how the system works, what…

1.8K viewsJonhnathan Jonhnathan Jonhnathan, 21:57

w0rk3r's Windows Hacking Library

Pwning Windows Event Logging with YARA rules

https://blog.dylan.codes/pwning-windows-event-logging

@WindowsHackingLibrary

2.04K viewsJonhnathan Jonhnathan Jonhnathan, 04:31

w0rk3r's Windows Hacking Library

Zerologon: Unauthenticated domain controller compromise by subverting Netlogon cryptography (CVE-2020-1472)

https://www.secura.com/pathtoimg.php?id=2055

@WindowsHackingLibrary

Unfortunately, this page cannot be found.

1.64K viewsJonhnathan Jonhnathan Jonhnathan, 14:19

w0rk3r's Windows Hacking Library

w0rk3r's Windows Hacking Library

Zerologon: Unauthenticated domain controller compromise by subverting Netlogon cryptography (CVE-2020-1472) https://www.secura.com/pathtoimg.php?id=2055 @WindowsHackingLibrary

Test tool: https://github.com/SecuraBV/CVE-2020-1472
PoC: https://github.com/dirkjanm/CVE-2020-1472

@WindowsHackingLibrary

GitHub - SecuraBV/CVE-2020-1472: Test tool for CVE-2020-1472

Test tool for CVE-2020-1472. Contribute to SecuraBV/CVE-2020-1472 development by creating an account on GitHub.

2.26K viewsJonhnathan Jonhnathan Jonhnathan, 18:29

w0rk3r's Windows Hacking Library

Forwarded from w0rk3r's Blue team Library (Jonhnathan Jonhnathan Jonhnathan)

Mitre's Center Releases FIN6 Adversary Emulation Plan

Blogpost: https://medium.com/mitre-engenuity/center-releases-fin6-adversary-emulation-plan-775d8c5ebe9b

Github: https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/fin6

@BlueTeamLibrary

Center Releases FIN6 Adversary Emulation Plan

Written by Jon Baker and Forrest Carver.

1.32K viewsJonhnathan Jonhnathan Jonhnathan, 13:52