😈 [ jdu2600, John U ]

@_xpn_ 👋 Published a blog with an updated script that should detect each (known) class of bypass.

https://t.co/TmkBL2oWlE

🔗 https://www.elastic.co/security-labs/get-injectedthreadex-detection-thread-creation-trampolines

🐥 [ tweet ]

в продолжение https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/

😈 [ aceb0nd, Acebond (acebond@infosec.exchange) ]

@an0n_r0 @3gstudent https://t.co/nTA2o87ies I made this and it works with execute-assembly to stay in memory.

🔗 https://github.com/RedCursorSecurityConsulting/NTFSCopy

🐥 [ tweet ]

😈 [ ustayready, Mike Felch ]

Want to create great phishing links using an open-redirect on https://t.co/PMEpjfi11c? While they don't last forever, they are a great way to trick unsuspecting victims into clicking a legit looking URL before expiring! https://t.co/au1tGZgHQ1 Follow the 🧵for how it works..

🔗 http://www.google.com
🔗 https://gist.github.com/ustayready/3ba2e4b1a4ec3cdad188f0f7d0dc4b73

🐥 [ tweet ]

😈 [ _choisec, Sunggwan Choi ]

Finished the RTO2 course and passed the CRTL exam the during Thanksgiving break. Wrote a review blog post on the course, lab, and the exam.

https://t.co/hkxthto8wL

Thank you @_RastaMouse for yet another great course. Wonder when the "RTO3 when" meme will start.

🔗 https://blog.sunggwanchoi.com/red-team-ops-2-review/

🐥 [ tweet ]

😈 [ ShitSecure, S3cur3Th1sSh1t ]

Found an vhdx/vmdk/vhd file in a network share? Volumiser from @_EthicalChaos_ gets you covered to exfiltrate e.G. SAM/SYSTEM to compromise the system via Administrator Pass-The-Hash:

https://t.co/OMiWBOVaS8

Really easy and intuitive to use 👏

🔗 https://github.com/CCob/Volumiser

🐥 [ tweet ]

😈 [ dafthack, Beau Bullock ]

"We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo"
https://t.co/KjHlNpHbLb

🔗 https://blog.lastpass.com/2022/11/notice-of-recent-security-incident/

🐥 [ tweet ]

😈 [ mhskai2017, kiwids ]

I wrote a blog post that talks about how we can abuse yet another Chrome Remote Debugging feature to "stalk" end users. https://t.co/xPHw3j4Qrb

🔗 https://posts.specterops.io/stalking-inside-of-your-chromium-browser-757848b67949

🐥 [ tweet ]

😈 [ sensepost, Orange Cyberdefense's SensePost Team ]

In this post @Sant0rryu shows an attack chain where you can abuse ADCS to escalate from a Virtual Account / Service account to local SYSTEM. As homage to other *potato tools, it could even be called CertPotato. 👀

https://t.co/5vD4a00P0G

🔗 https://sensepost.com/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/

🐥 [ tweet ]

😈 [ _nwodtuhs, Charlie Bromberg ]

Icymi, I'm now maintaining an Impacket fork which merges PRs a bit quicker than the official repo. This fork is dedicated to the Exegol project but can be used elsewhere if needed. You can PR there as well if you'd like and I'll do my best to review asap https://t.co/1newB3iqgs

🔗 https://github.com/ThePorgs/impacket

🐥 [ tweet ]

наконец-то, блеать

👹 [ snovvcrash, sn🥶vvcr💥sh ]

[#HackTip ⚒️] A simple post-exploitation tip when you’ve added a GitLab admin from a compomised gitlab-rails console: if there’s only LDAP auth available and you cannot sign in even when you possess valid creds, do this to enable password auth for web 🤓

https://t.co/uJCcbhQZNz

🔗 https://ppn.snovvcrash.rocks/pentest/infrastructure/devops/gitlab#gitlab-rails

🐥 [ tweet ]

HR здорового человека

😈 [ byt3bl33d3r, Marcello ]

Just published some research and scripts that allow you to do DLL sideloading/proxy loading with Nim DLLs.
Also, by accident figured out how to remove the NimMain function from the export table :)
https://t.co/4BVo8uPBXc

🔗 https://github.com/byt3bl33d3r/NimDllSideload

🐥 [ tweet ]

😈 [ filip_dragovic, Filip Dragovic ]

Here is PoC for CVE-2022-41120 https://t.co/oXkBYi4bWk. I combined arb file delete and limited arb file write to get code execution as NT Authority\System.

🔗 https://github.com/Wh04m1001/SysmonEoP

🐥 [ tweet ]

😈 [ SEKTOR7net, SEKTOR7 Institute ]

Finally made some progress (w/ help from https://t.co/M9jH1yfUK0).

Interestingly the bot logs into a box via SSH and sends the commands from the user, sharing the session between different users.

This Sunday's gonna be fun...

🔗 https://www.engraved.blog/building-a-virtual-machine-inside/

🐥 [ tweet ]

😈 [ KlezVirus, d3adc0de ]

[RELEASE] After a little wait, I'm happy to present SilentMoonwalk, a PoC implementation of a TRUE call stack spoofer, result of a joint research on an original technique developed by namazso, done with my friends @trickster012 and @waldoirc.
Enjoy! ;)
https://t.co/C5QBzNawza

🔗 https://github.com/klezVirus/SilentMoonwalk

🐥 [ tweet ]

😈 [ ShitSecure, S3cur3Th1sSh1t ]

Responder does not catch NTLMv1 Hashes for "reasons"?

Try "ntlmrelayx[.]py -ntlmchallenge 1122334455667788 -of hashes.txt" instead.

🐥 [ tweet ]

😈 [ ShitSecure, S3cur3Th1sSh1t ]

Certipy throws strange Kerberos errors when using auth for NT-Hash retrieval of Computer Accounts? Like
"KRB_AP_ERR_BAD_INTEGRITY(Integrity check on decrypted field failed)" or others?

Use "-ldap-shell" instead to authenticate to LDAP and configure RBCD to take over the target.

🐥 [ tweet ]