CVE-2025-48799: Windows Update Service LPE
PoC: https://github.com/Wh04m1001/CVE-2025-48799
Patched: July 8, 2025
#lpe #windows #pentest #redteam
PoC: https://github.com/Wh04m1001/CVE-2025-48799
Patched: July 8, 2025
This vulnability affects windows clients (win11/win10) with at least 2 hard drives.
#lpe #windows #pentest #redteam
GitHub
GitHub - Wh04m1001/CVE-2025-48799
Contribute to Wh04m1001/CVE-2025-48799 development by creating an account on GitHub.
🔥21👍8😁3
CVE-2025-25257: Pre-Auth SQLi to RCE - Fortinet FortiWeb
PoC: https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257
Blog: https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/
#rce #pentest #redteam #fortinet #cve
PoC: https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257
Blog: https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/
Affected:
7.6.0 through 7.6.3
7.4.0 through 7.4.7
7.2.0 through 7.2.10
7.0.0 through 7.0.10
#rce #pentest #redteam #fortinet #cve
🔥29😁12👍5🤯2😱2
Forwarded from APT
🔑 Golden DMSA
Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.
🔗 Research:
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
🔗 Source:
https://github.com/Semperis/GoldenDMSA
#ad #windows #dmsa #kerberos #persistence
Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.
🔗 Research:
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
🔗 Source:
https://github.com/Semperis/GoldenDMSA
#ad #windows #dmsa #kerberos #persistence
👍20🔥10😁3🤔3
Немного про релей с SCCM в MSSQL для получения учетных данных NAA и не только.
https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/
А обновление в SCCMHunter обещают после BlackHat в августе
#ad #sccm #pentest #redteam #relay
https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/
А обновление в SCCMHunter обещают после BlackHat в августе
#ad #sccm #pentest #redteam #relay
SpecterOps
I’d Like to Speak to Your Manager: Stealing Secrets with Management Point Relays - SpecterOps
Network Access Account, Task Sequence, and Collection Settings policies can be recovered from SCCM by relaying a remote management point site system to the site database server.
🔥13👍5😁1
CVE-2025-53770: SharePoint RCE (ToolShell)
Exploit: https://github.com/soltanali0/CVE-2025-53770-Exploit
Upd: https://github.com/irsdl/ysonet
Patched: July 20, 2025
#rce #pentest #redteam #ad #sharepoint #cve
Exploit: https://github.com/soltanali0/CVE-2025-53770-Exploit
Upd: https://github.com/irsdl/ysonet
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 1 -c "calc"
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 2 -c "C:\\temp\\ExploitClass.cs;System.dll"
Patched: July 20, 2025
#rce #pentest #redteam #ad #sharepoint #cve
GitHub
GitHub - soltanali0/CVE-2025-53770-Exploit: SharePoint WebPart Injection Exploit Tool
SharePoint WebPart Injection Exploit Tool. Contribute to soltanali0/CVE-2025-53770-Exploit development by creating an account on GitHub.
🔥22👍8😁5🤔3🎉1
У SpecterOps очередная крутая статья про сбор данных из ADWS.
https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/
Что еще полезного: как использовать утилиту SoaPy, конвертировать данные в формат BloodHound, ну и конечно как обнаружить этот самый сбор данных домена.
#ad #pentes #redteam #enum #bloodhound #soap
https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/
Что еще полезного: как использовать утилиту SoaPy, конвертировать данные в формат BloodHound, ну и конечно как обнаружить этот самый сбор данных домена.
#ad #pentes #redteam #enum #bloodhound #soap
SpecterOps
Make Sure to Use SOAP(y) - An Operators Guide to Stealthy AD Collection Using ADWS - SpecterOps
Learn how to perform stealthy recon of Active Directory environments over ADWS for Red Team Assessments
🔥20👍7😁3
Forwarded from Adaptix Framework
AdaptixC2 v0.7 is out
https://github.com/Adaptix-Framework/AdaptixC2
* Поддержка скриптов AxScript
* Менеджер учетных данных
* Поддержка BOF в агенте gopher
* Новые BOF: potato-dcom, nanodump, noconsolation
Полная информация по обновлению: https://adaptix-framework.gitbook.io/adaptix-framework/changelog-and-updates/v0.6-greater-than-v0.7
https://github.com/Adaptix-Framework/AdaptixC2
* Поддержка скриптов AxScript
* Менеджер учетных данных
* Поддержка BOF в агенте gopher
* Новые BOF: potato-dcom, nanodump, noconsolation
Полная информация по обновлению: https://adaptix-framework.gitbook.io/adaptix-framework/changelog-and-updates/v0.6-greater-than-v0.7
🔥44👍12🤔1
https://github.com/TheSleekBoyCompany/AnsibleHound
#pentest #ansible #bloodhound
Go collector for adding Ansible WorX and Ansible Tower attack paths to BloodHound with OpenGraph
#pentest #ansible #bloodhound
👍30
Ralf Hacker Channel
Несколько часов назад была сильно обновлена утилита certipy. Обратим внимание, что в документации также появилось описание техники ESC16... #redteam #pentest #ad #adcs
Три месяца назад было обновление скрипта certipy, а вот теперь вышло обновление и для Certify.
Blog: https://specterops.io/blog/2025/08/11/certify-2-0/
Wiki: https://github.com/GhostPack/Certify/wiki/4-%E2%80%90-Escalation-Techniques
#ad #pentest #redteam #adcs
Blog: https://specterops.io/blog/2025/08/11/certify-2-0/
Wiki: https://github.com/GhostPack/Certify/wiki/4-%E2%80%90-Escalation-Techniques
#ad #pentest #redteam #adcs
SpecterOps
Certify 2.0 - SpecterOps
Certify 2.0 features a suite of new capabilities and usability enhancements. This blogpost introduces changes and features additions.
3👍19🔥7
Forwarded from 1N73LL1G3NC3
Collect infrastructure and permissions data from vCenter and export it as a BloodHound‑compatible graph using Custom Nodes/Edges
Please open Telegram to view this post
VIEW IN TELEGRAM
👍27🔥8😁4😱1
Иногда DLL библиотеки не содержат реализации каких-то функций, а просто вызывают соответсивующую функцию из другой DLLки. Пример есть в следующем посте.
https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/
А еще там есть уже готовый списочек, удобно:
https://hexacorn.com/d/apis_fwd.txt
#maldev #winapi
https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/
А еще там есть уже готовый списочек, удобно:
https://hexacorn.com/d/apis_fwd.txt
#maldev #winapi
2🔥17👍9😁6🤔3
Real-time analysis of LOLDrivers against Microsoft's HVCI blocklist
https://byovd-watchdog.pwnfuzz.com/
Хороший ресурс)
#drivers #lpe #windows #lol
https://byovd-watchdog.pwnfuzz.com/
Хороший ресурс)
#drivers #lpe #windows #lol
🔥18👍6😁2
Forwarded from ByTe [ ]f Digital Life
Как за пару кнопок убить AV/EDR (разных цветов)
Из требований:
- Наличие прав админа на тачке;
- Возможность доставки procmon.
А далее всё более чем прозаично.
1. Включение функции "EnableBootLooging";
2. Создание символической ссылки:
3. Ребут тачки.
Получаем магию.
Подробнее:
https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html?m=1
Из требований:
- Наличие прав админа на тачке;
- Возможность доставки procmon.
А далее всё более чем прозаично.
1. Включение функции "EnableBootLooging";
2. Создание символической ссылки:
mklink C:\Windows\Procmon.pmb "<Полный путь до файла который требуется перезаписать>"
3. Ребут тачки.
Получаем магию.
Подробнее:
https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html?m=1
1😁38🔥24👍6🤔2😱2
Evasion-Kit for Cobalt Strike
Blog: https://rastamouse.me/crystal-kit/
Soft: https://github.com/rasta-mouse/Crystal-Kit
#maldev #cs #pentest #redteam
Blog: https://rastamouse.me/crystal-kit/
Soft: https://github.com/rasta-mouse/Crystal-Kit
#maldev #cs #pentest #redteam
Rasta Mouse
Crystal Kit
tl;dr - repo here.
The Crystal Kit is an experimental project designed to replace Cobalt Strike's Sleepmask. The Sleepmask (and BeaconGate) are key to Beacon's runtime evasion strategy - not only does it mask Beacon's memory, it also acts as an API proxy…
The Crystal Kit is an experimental project designed to replace Cobalt Strike's Sleepmask. The Sleepmask (and BeaconGate) are key to Beacon's runtime evasion strategy - not only does it mask Beacon's memory, it also acts as an API proxy…
🔥20👍8😁3🤔3
Forwarded from 1N73LL1G3NC3
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
🔗 DumpGuard
Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.
P.S. Previously, crack.sh operated a free service for performing rainbow table lookups to recover NT hashes from NTLMv1 responses, but was recently shut down due to maintenance issues. In its absence, a new free service was published at ntlmv1.com.
Please open Telegram to view this post
VIEW IN TELEGRAM
👍14🔥14😁6🥰4
Персист на уровне системы через DLL Hijacking в экранном дикторе Windows. Срабатывает при входе и выходе из системы.
https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers
#pentest #redteam #persist
https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers
#pentest #redteam #persist
TrustedSec
Hack-cessibility: When DLL Hijacks Meet Windows Helpers
🔥20👍14🤔7
Как круто развивается BloodHound... Теперь и сетевые ресурсы можно отображать
Blog: https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/
Soft: https://github.com/p0dalirius/sharehound
#pentest #ad #bloodhound
Blog: https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/
Soft: https://github.com/p0dalirius/sharehound
#pentest #ad #bloodhound
🔥61👍14🤔3😢2
Forwarded from 1N73LL1G3NC3
Conquest
A feature-rich and malleable command & control/post-exploitation framework developed in Nim.
Blog: https://jakobfriedl.github.io/blog/nim-c2-traffic/
A feature-rich and malleable command & control/post-exploitation framework developed in Nim.
Blog: https://jakobfriedl.github.io/blog/nim-c2-traffic/
👍12🔥9🤔1
Определенно стоит почитать
https://www.synacktiv.com/en/publications/site-unseen-enumerating-and-attacking-active-directory-sites
#ad #pentest #redteam #bloodhound
https://www.synacktiv.com/en/publications/site-unseen-enumerating-and-attacking-active-directory-sites
Sites did not receive much attention by the Active Directory offensive research community, comparatively to other ACL-based attack vectors. This article aims to demonstrate that not only do attack vectors targeting Active Directory sites exist, but that they can lead to impactful privilege escalation scenarios and to domain(s) compromise.
#ad #pentest #redteam #bloodhound
👍24🔥17
Недавно у моего любимого инструмента bloodyAD появился новый модуль
https://github.com/CravateRouge/bloodyAD/wiki/User-Guide#msldap-commands
Кто юзает, обновляйтесь. А если не слышали о bloodyAD, советую попробовать)
#ad #pentest #redteam
msldap. https://github.com/CravateRouge/bloodyAD/wiki/User-Guide#msldap-commands
Кто юзает, обновляйтесь. А если не слышали о bloodyAD, советую попробовать)
#ad #pentest #redteam
👍25🔥15🤔5