😈 [ freefirex @freefirex2 ]

Saw some other folks realize its actually really easy to use certificates to authenticate as other users on windows if you have access to the API.

We're now releasing our previously internal make_token_cert bof to auth using only a .pfx file :)

🔗 https://github.com/trustedsec/CS-Remote-OPs-BOF/blob/bc0cdd7997ebbf37a1cfee26be97eb3faa06ab50/src/Remote/make_token_cert/entry.c#L69

🐥 [ tweet ]

😈 [ Daniel @0x64616e ]

Hash-based driver blocklists are insecure, because of how Authenticode signatures are computed. Nothing new, but not as well known as it should be.

🔗 https://github.com/akkuman/gSigFlip

🐥 [ tweet ]

😈 [ Synacktiv @Synacktiv ]

Oh, you didn't know? Cool kids are now relaying Kerberos over SMB 😏
Check out our latest blogpost by @hugow_vincent to discover how to perform this attack:

🔗 https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx

🐥 [ tweet ]

😈 [ silentwarble @silentwarble ]

Something Emerges:

🔗 https://github.com/MythicAgents/Hannibal

🐥 [ tweet ]

красивое

😈 [ Matt Ehrnschwender @M_alphaaa ]

I'm trying to get better at keeping up with and publishing more on my blog. Here's a new post I just released on "Writing Beacon Object Files Without DFR"

🔗 https://blog.cybershenanigans.space/posts/writing-bofs-without-dfr/

🐥 [ tweet ]

😈 [ @ChrisTruncer@infosec.exchange @christruncer ]

It’s always awesome when we (@CISAGov) gets to release a red team report that we worked on, and today is another one of those days!

Go check out our latest report and hopefully you can apply some of the same lessons to your environment!

🔗 https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-326a

🐥 [ tweet ]

😈 [ Gigel Vrancea @GigelV41464 ]

Someone on my team asked me if there was a way I could prevent in-proc tools like a BOF from crashing the process

After some research, I came to the conclusion that using RtlSetUnhandledExceptionFilter is the most elegant way to achieve this

Read here:

🔗 https://luci4.net/blog/2024/11/13/EternalLife/

🐥 [ tweet ]

😈 [ Volexity @Volexity ]

@Volexity’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target, while the attacker was halfway around the world.

🔗 https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/

🐥 [ tweet ]

познавательно

😈 [ Yehuda Smirnov @yudasm_ ]

Excited to share a tool I've been working on - ShadowHound.
ShadowHound is a PowerShell alternative to SharpHound for Active Directory enumeration, using native PowerShell or ADModule (ADWS). As a bonus I also talk about some MDI detections and how to avoid them:

Blog:
🔗 https://blog.fndsec.net/2024/11/25/shadowhound/

Code:
🔗 https://github.com/Friends-Security/ShadowHound

🐥 [ tweet ]

😈 [ PT SWARM @ptswarm ]

🎤✨ Our security researcher, Konstantin Polishin, presented “Red Team Social Engineering 2024: Initial Access TTP and Project Experience of Our Team” at #ROOTCON18 🚀

Recording:
🔗 https://youtube.com/watch?v=6nnZJiL0Tgk

🐥 [ tweet ]

😈 [ ap @decoder_it ]

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...

GitHub:
🔗 https://github.com/decoder-it/KrbRelayEx

🐥 [ tweet ]

😈 [ RedTeam Pentesting @RedTeamPT ]

So we implemented parsing the security descriptors of shares and files in the beautiful ✨smbclient-ng ✨ by @podalirius_

Here is our PR:
🔗 https://github.com/p0dalirius/smbclient-ng/pull/118

🐥 [ tweet ][ reply ]

😈 [ Check Point Research @_CPResearch_ ]

🚨 New Discovery! We uncovered an undocumented technique for executing commands through the #Godot #GameEngine. Exploited by #GodLoader, this method successfully bypassed most #antivirus software since June 2024, affecting over 17,000 potential victims.

🔗 https://research.checkpoint.com/2024/gaming-engines-an-undetected-playground-for-malware-loaders/

🐥 [ tweet ]

😈 [ S3cur3Th1sSh1t @ShitSecure ]

Seven days ago @prac_sec released a blog post about Patching CLR memory to bypass AMSI. This is now added to the AMSI Bypass Powershell repo as well:

🔗 https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#Patching-Clr
🔗 https://practicalsecurityanalytics.com/new-amsi-bypss-technique-modifying-clr-dll-in-memory/

🐥 [ tweet ]

😈 [ Layle @layle_ctf ]

In a somewhat recent project we used a vulnerable driver, which worked fine...

Except: The customer had a custom rule that caused an alert when a service is created!

Decided to write a tool that creates the registry keys and calls into NtLoadDriver:

🔗 https://github.com/ioncodes/SilentLoad

🐥 [ tweet ]

😈 [ drm @lowercase_drm ]

Coffee break thoughts: "is it possible to bruteforce RPC endpoint to perform code exec if you can't access EPM/SMB?"

99% impacket atexec + 1% "for loop" = 100% prod ready
(silent command only)
h/t @saerxcit
🌻

🔗 https://gist.github.com/ThePirateWhoSmellsOfSunflowers/3673746454aef7d55a5efed4dc4e1a61

🐥 [ tweet ]

😈 [ Mayfly @M4yFly ]

Goad v3 merged into the main branch 🥳

GitHub:
🔗 https://github.com/Orange-Cyberdefense/GOAD

Doc:
🔗 https://orange-cyberdefense.github.io/GOAD/

🐥 [ tweet ]

😈 [ blueblue @piedpiper1616 ]

GitHub - TheN00bBuilder/cve-2024-11477-writeup: CVE-2024-11477 7Zip Code Execution Writeup and Analysis

🔗 https://github.com/TheN00bBuilder/cve-2024-11477-writeup

🐥 [ tweet ]

😈 [ Rasta Mouse @_RastaMouse ]

[BLOG]
This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs.

🔗 https://rastamouse.me/udrl-sleepmask-and-beacongate/

🐥 [ tweet ]

😈 [ Fabian Bader @fabian_bader ]

🛡️Windows Firewall and WFP are only two ways to silence an #EDR agent.

📢In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it.

🔗 https://cloudbrothers.info/en/edr-silencers-exploring-methods-block-edr-communication-part-1/

And if you want even more, checkout part 2 released by @Cyb3rMonk

🐥 [ tweet ]

😈 [ Check Point Research @_CPResearch_ ]

A ransomware gang's Rust experiment naturally produced the kind of binary you "reverse-engineer" by staring at the strings and saying, "mm hm." Join us as we break through this technical barrier and gain some insight into ransomware author psychology.

🔗 https://research.checkpoint.com/2024/inside-akira-ransomwares-rust-experiment/

🐥 [ tweet ]