😈 [ _nwodtuhs, Charlie “Shutdown” ]

Wrapping things up and pushing a pull request on Impacket, followed by https://t.co/h6yAdPK5NM guidance on the matter
- Kerberoast trough AS-REQ w/o pre-auth
- Service ticket request through AS-REQ
Again, great work by @exploitph

🔗 http://thehacker.recipes

🐥 [ tweet ][ quote ]

😈 [ _nwodtuhs, Charlie “Shutdown” ]

THR guidance done : https://t.co/y3YFN4JUFi

🔗 https://www.thehacker.recipes/ad/movement/kerberos/kerberoast#kerberoast-w-o-pre-authentication

🐥 [ tweet ][ quote ]

😈 [ carlospolopm, carlospolop ]

HackTricks Cloud (or CloudTrick) is finally public:
- https://t.co/VwgVsUKo3x
- https://t.co/kZ9XlHAsJR

Thank you again to all the supporters!
#hacktricks #cloud

🔗 https://cloud.hacktricks.xyz/
🔗 https://github.com/carlospolop/hacktricks-cloud

🐥 [ tweet ]

😈 [ DirectoryRanger, DirectoryRanger ]

DumpThatLSASS. Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk
https://t.co/wKgBmr5CR6

🔗 https://github.com/D1rkMtr/DumpThatLSASS

🐥 [ tweet ]

😈 [ zux0x3a, Lawrence 勞倫斯 ]

https://t.co/k3QhNFrV9R

🔗 https://github.com/Rvn0xsy/AsmShellcodeLoader

🐥 [ tweet ]

😈 [ aniqfakhrul, Aniq Fakhrul ]

Simple POC on exfiltrating using google translate. Also resolution is 💩, my bad.

🐥 [ tweet ]

😈 [ cnotin, Clément Notin ]

Have you ever wondered how to decrypt “encrypted stub data” 🔐 fields in Wireshark when analyzing Kerberos, RPC, LDAP... traffic?
➡️ Ask no more!
https://t.co/dkjidQt6Fv
1. get Kerberos keys
2. give keys to Wireshark in a keytab file
3. get decrypted RPC!
Works with NTLM too 😉

🔗 https://medium.com/tenable-techblog/decrypt-encrypted-stub-data-in-wireshark-deb132c076e7

🐥 [ tweet ]

😈 [ cube0x0, Cube0x0 ]

How do you work in security without having to talk?

🐥 [ tweet ]

хакеров-интровертов тред

😈 [ cube0x0, Cube0x0 ]

🐥 [ tweet ]

😈 [ NotMedic, Tim McGuffin ]

I don't know what to do with this knowledge, but today I learned that curl has a handler for LDAP URIs.

curl --user $CREDS "ldaps://ldap.foo.com/DC=ads,DC=foo,DC=com?memberOf?sub?(&(sAMAccountName=$USER)(memberOf=CN=$GROUP,OU=Distribution,OU=Groups,DC=ads,DC=foo,DC=com))"

🐥 [ tweet ]

😈 [ PortSwiggerRes, PortSwigger Research ]

Arbitrary cache poisoning on all Akamai websites via 'Connection: Content-Length' - $50k in bounties well-earned by @jacopotediosi
https://t.co/UmlKIGsgWR

https://t.co/OFHGMVA2gP

🔗 https://medium.com/@jacopotediosi/worldwide-server-side-cache-poisoning-on-all-akamai-edge-nodes-50k-bounty-earned-f97d80f3922b
🔗 https://blog.hacktivesecurity.com/index.php/2022/09/17/http/

🐥 [ tweet ]

😈 [ C5pider, 5pider ]

Have fun guys.
https://t.co/hjq5qTYgMc
https://t.co/Z2mAJIiAGQ
https://t.co/WehmmCVCsC

🔗 https://www.virustotal.com/gui/file/ec6896542e726997e4e01d11f4fce88cb97ec59243f291966fb3ce48308041d8
🔗 https://www.virustotal.com/gui/file/56d507046eaf1fcfbdaa5491679c4f7244c9ad5cc9da4a03332c6ccb2f69ee2d
🔗 https://www.virustotal.com/gui/file-analysis/ZGFhZGU5ZWIzNjcxNzA4ODhkNzdmZDljNjViODY4MzU6MTY2NDU0NTE2Mw==

🐥 [ tweet ]

эм, а где сорцы-то??

😈 [ C5pider, 5pider ]

The Havoc Framework
https://t.co/eBpOaicsI6

🔗 https://github.com/HavocFramework/Havoc

🐥 [ tweet ]

так, дождались сорцов

😈 [ codex_tf2, CodeX ]

PyHmmm - third party agent PoC for Havoc C2 - repo + blogpost
https://t.co/kolzUJHL0n
https://t.co/pzPAK77ftn

🔗 https://codex-7.gitbook.io/codexs-terminal-window/red-team/red-team-dev/extending-havoc-c2/third-party-agents
🔗 https://github.com/CodeXTF2/PyHmmm

🐥 [ tweet ]

😈 [ MrUn1k0d3r, Mr.Un1k0d3r ]

You want to use signed PowerShell scripts?

Have a look at all the signed PowerShell scripts located in C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\

Some of these can execute code and do all kind of interesting stuff.

https://t.co/7uBzACJ4JP

#redteam

🔗 https://github.com/Mr-Un1k0d3r/ATP-PowerShell-Scripts

🐥 [ tweet ]

😈 [ theluemmel, ADCluemmelSec ]

UPDATES to ADCS blog.
@ly4k_ gave so much input I had to implement.
@n00py1 gave a really good hint for ESC5 with his question.

So here goes:
ESC2 - Update how it works
ESC4 - Automation via Certipy
ESC5 - Full attack path
Bonus - Bloodhound Integration
https://t.co/iWvY9gTIAM

🔗 https://luemmelsec.github.io/Skidaddle-Skideldi-I-just-pwnd-your-PKI/

🐥 [ tweet ]