Weaponization of Token Theft – A Red Team Perspective
#trustedsec

This blog is the start of several deep dives into the weaponization of token theft. The focus of this blog will be on conditional access around devices and attacker behavior on compromising Microsoft 365 users.…

via TrustedSec Blog (author: Edwin David)

ADCS ESC14 Abuse Technique
#specterops

via SpecterOps Team Medium (author: Jonas Bülow Knudsen)

Dumping LSASS Like it’s 2019
#redsiege

By Alex Reid, Current Red Siege Intern   A long-time tactic of threat actors and offensive security processionals alike, tampering with LSASS.exe in order to recover credentials remains a highly […]

via RedSiege Blog (author: Red Siege)

Behind the Code: Assessing Public Compile-Time Obfuscators for Enhanced OPSEC
#trustedsec

Recently, I’ve seen an uptick in interest in compile-time obfuscation of native code through the use of LLVM. Many of the base primitives used to perform these obfuscation methods are themselves over a year old, and…

via TrustedSec Blog (author: Christopher Paschen)

Using form hijacking to bypass CSP
#portswigger

In this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re

via PortSwigger Research

Browserless Entra Device Code Flow
#specterops

via SpecterOps Team Medium (author: Andy Robbins)

Release v1.9 - Eclipse
#bruteratel

Brute Ratel v1.9 [codename Eclipse] is now available for download. This update includes enhancements in evasion techniques, anti-debugging measures, and new encryption keying methods for the core, along with an update to the licensing algorithm. Please note that the Ratel server, Commander, and previous versions of badgers are not compatible with v1.8 or older releases due to significant changes in the core architecture.

via Brute Ratel C4 Blog (author: Chetan Nayak (chetan@bruteratel.com))

Unwelcome Guest: Abusing Azure Guest Access to Dump Users, Groups, and more
#trustedsec

Abusing Guest Access: Dumping User Lists and Group Membership with Guest Access in Azure ADThis post will walk through a user, group, and application enumeration attack against a tenant where the attacker has guest…

via TrustedSec Blog (author: nyx geek)

(Ne uvolnyay pzh)

Как часто вы сталкиваетесь с ситуацией, когда смотришь на коллегу и думаешь: "да как тебя еще не уволили"? Решил ответить на данный вопрос и разобраться, стоит ли бояться увольнений

https://teletype.in/@redteammanager/OqRhIw5ep6n

Easy cross compilation - zig
#tool #maldev

Sometimes on engagement you need to cross compile your c(++) tools, but doing it is a headache because of lots of compilers you need for every OS and architecture. I found an interesting way to do it using only one tool: Zig compiler.

Leveraging the ability of LLVM and integrated cross-os and cross-architecture support built-in to the Zig compiler, you can cross compile for lots of OS and architectures.

Here is an example for cross compiling for x64 Windows, Linux and OSX:
👉zig c++ -target x86_64-macos hello_world.cpp -o hw_mac.out
👉zig c++ -target x86_64-linux hello_world.cpp -o hw_lin.out
👉zig c++ -target x86_64-windows hello_world.cpp -o hw_win.out

Also it can be integrated into your build system (e.g. CMake or Makefile):
👉CC="zig cc -target x86_64-macos" CXX="zig c++ -target x86_64-macos" AR="zig ar" RANLIB="zig ranlib" USE_JEMALLOC=no USE_SYSTEMD=no

In addition, you also can easily leverage a power of LLVM obfuscators (e.g. https://github.com/eshard/obfuscator-llvm) to make it harder to analyze your malware.

Btw, don't forget to strip your binary 😉

Arlo: I'm watching you
#synacktiv

via Synacktiv Blog (author: Webmaster)

YARP as a C2 Redirector
#rastamouse

YARP: Yet Another Reverse Proxy is a .NET library developed by Microsoft designed to run on top of ASP.NET Core infrastructure. The intended use case for YARP is to sit between backend and frontend services to provide reverse proxy and load balancing services. The content of this blog post is to show how it can

via Rasta Mouse Blog

Misconfiguration Manager: Overlooked and Overprivileged
#specterops

via SpecterOps Team Medium (author: Duane Michael)

Introducing PCI's New Self-Assessment Questionnaire
#trustedsec

The PCI DSS 4.0 transition deadline is approaching on April 01, 2024, and we have a new type of reduced-scope self-assessment questionnaire (SAQ) to go with it: SAQ SPoC.

via TrustedSec Blog (author: Chris Camejo)

CVE-2024-21378 — Remote Code Execution in Microsoft Outlook
#netspi

NetSPI discovered that Microsoft Outlook was vulnerable to authenticated remote code execution (RCE) via synced form objects. Learn how NetSPI discovered and exploited the vulnerability.

via NetSPI Technical Blog (author: Rich Wolferd)

Summoning RAGnarok With Your Nemesis
#specterops

via SpecterOps Team Medium (author: Will Schroeder)

Failure to Restrict URL Access: It’s Still a Thing
#trustedsec

Here are some brief thoughts about an old issue. If you are a full-time application security professional, stop reading. You know all about this, you know probably five different ways to describe and talk about this,…

via TrustedSec Blog (author: Geoff Walton)

Azure Deployment Scripts: Assuming User-Assigned Managed Identities
#netspi

Learn how to use Deployment Scripts to complete faster privilege escalation with Azure User-Assigned Managed Identities.

via NetSPI Technical Blog (author: Karl Fosaaen)

Making Desync attacks easy with TRACE
#portswigger

Have you ever found an HTTP desync vulnerability that seemed impossible to exploit due to its complicated constraints? In this blogpost we will explore a new exploitation technique that can be used to

via PortSwigger Research