😈 [ VirtualAllocEx, Daniel Feichter ]

Nice blog post by @Microsoft in cooperation with AV-Comparatives about "Detecting and preventing LSASS credential dumping attacks"

https://t.co/0tML7Heax5

#itsec #itsicherheit #itsecurity #endpointsecurity #antivirus #lsass

🔗 https://www.microsoft.com/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/

🐥 [ tweet ]

😈 [ Tw1sm, Matt Creel ]

Created python tooling for the "Roast in the Middle" attack demoed/described by @exploitph in his recent PoC and research. Supports ARP spoofing to targets/gateway - if you can enum usernames and sniff an AS-REQ, basically allows for "unauth kerberoast" 🤯 https://t.co/Hdn3wuIx7b

🔗 https://github.com/Tw1sm/RITM

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

Woo-hoo, there’s a new kid in town for initial access credential acquiring! As we know from @mohemiv research, we don’t necessarily need SPNs for Kerberoasting, so it’s time to get ready for RID Cycling with ntlmrelayx[.]py 🙈

https://twitter.com/snovvcrash/status/1506286522655461386

🐥 [ tweet ][ quote ]

😈 [ eversinc33, eversinc33 ]

Had some fun implementing the trampoline technique to make sure all syscalls go through NTDLL into the Nim HellsGate implementation by zimawhit3. Thank you @passthehashbrwn for the blog on hiding syscalls! (https://t.co/YfUqAglams)

https://t.co/IicLY1WkY4

🔗 https://passthehashbrowns.github.io/hiding-your-syscalls
🔗 https://github.com/eversinc33/HellsGate-Trampoline

🐥 [ tweet ]

😈 [ Alh4zr3d, Alh4zr3d ]

Red Teamers, following my previous tweet on hiding procs, now we hide SSH connections:

"ssh -o UserKnownHostsFile=/dev/null -T user@target.com 'bash -i'"

Your user:
- is not added to /var/log/utmp
- won't appear in w or who cmd
- has no .profile or .bash_profile

#redteaming

🐥 [ tweet ]

😈 [ HackingLZ, Justin Elze ]

This is awesome Meterpreter Gets BOF loader support for all your offensive needs. https://t.co/01W4UNgD1d

🔗 https://www.rapid7.com/blog/post/2022/10/07/metasploit-weekly-wrap-up-179/

🐥 [ tweet ]

😈 [ 0xcsandker, Carsten ]

Needed to find where a certain GPO was applied to during last engagement. Hadn't something ready to grab, so now I have. Inline and readable-friendly wrapped code here: https://t.co/EMJ2rJqvYn

🔗 https://gist.github.com/csandker/950d11632534c86012ab9c7cb592b7b5

🐥 [ tweet ]

😈 [ m3g9tr0n, Spiros Fraganastasis ]

PeNet is a parser for Windows Portable Executable headers. It completely written in C# and does not rely on any native Windows APIs. Furthermore it supports the creation of Import Hashes (ImpHash), which is a feature often used in malware analysis. https://t.co/MPZvqvocfO

🔗 https://github.com/secana/PeNet

🐥 [ tweet ]

😈 [ KlezVirus, d3adc0de ]

[Video] The 4th episode of my series about Inceptor is out: "Empowering Donut with Direct and Indirect Syscalls".

In this video, we'll show how it is possible to improve the donut loader by intergating it with SW3.

https://t.co/xNK4HNz9qS

🔗 https://youtu.be/ypX7N4498xE

🐥 [ tweet ]

😈 [ ippsec, ippsec ]

Starting to play more with Elastic, so just published a video installing v8 it on Ubuntu 22. Really impressed with Fleet so far, the last time I played with Elastic it was a PITA keeping all the agent configs in sync. Fleet's auto update of agents is magic https://t.co/fbQkWgbJKW

🔗 https://www.youtube.com/watch?v=Ts-ofIVRMo4

🐥 [ tweet ]

😈 [ dec0ne, Mor Davidovich ]

Introducing ShadowSpray, it's like password spray but with shadow credentials. More info in the repo.
Huge thanks to @elad_shamir for the amazing technique and to @harmj0y (and others) for the implementation in Rubeus from which a lot of code was taken.

https://t.co/nIsnmaitfw

🔗 https://github.com/Dec0ne/ShadowSpray/

🐥 [ tweet ]

😈 [ cnotin, Clément Notin ]

AdminSDHolder also has a useful SACL, with this ACE allowing to log many actions performed on privileged objects it is applied to.
It's a lesser known feature!

🐥 [ tweet ]

Довольно интересная статья, как обходить EDR с помощью python)))

https://www.naksyn.com/edr%20evasion/2022/09/01/operating-into-EDRs-blindspot.html

#redteam #pentest #bypass

Это прям пущка!

😈 [ n00py1, n00py ]

Web vulns you should look for on an internal pentest: XXE.

We often think of XXE as a way to read local files, but you can also use it to coerce auth. HTTP NTLM does not request signing so you can easily relay it to LDAP. Web service accounts are often over permissioned.

🐥 [ tweet ]

😈 [ HackerGautam, Frooti ]

Not only crawling but you can do Subdomain Enumeration using Wayback.

⬇️
curl --insecure --silent "http://web.archive.org/cdx/search/cdx" | sed -e 's_https*://__' -e "s/\/.*//" -e 's/:.*//' -e 's/^www\.//' | sed "/@/d" | sed -e 's/\.$//' | sort -u

#bugbounty #hacking #infosec

🐥 [ tweet ]

👹 [ snovvcrash, sn🥶vvcr💥sh ]

This is how easter eggs are found 😅 @_nwodtuhs @podalirius_

🐥 [ tweet ]

😈 [ ORCx41, ORCA ]

decided to release this, a highly capable pe packer, with a lot of nice features
https://t.co/iedhKbTlzm

🔗 https://github.com/ORCx41/AtomPePacker

🐥 [ tweet ]