Devious Methods
194 subscribers
153 photos
14 videos
65 files
535 links
Underground music / Cyberpunk stories
Download Telegram
Offensive Security Defense Analyst Overview PT.1.pdf
10.5 MB
Offensive Security Defense Analyst (OSDA) Notes Part1
#Blueteam #SOC #Purpleteam #OSDA
🔥1
Forwarded from artmine
Саундтрек последних 370 дней, каждое слово. Одну часть чувствую, вторую заставляю себя не забывать.

Всегда нуждою других себя занимая
Всегда что-то красивое творя
Мы движемся в сторону рая
Через ненависти моря

https://www.youtube.com/watch?v=W7li-_sDQKg
🎵 RUDIMENTAL - SO SORRY

2021 год. Вышел 4ый LP Rudimental - Ground Control, который я как то пропустил... Сейчас слушаю и охреневаю от качества. Ребята писали альбом во время локдауна и говорят что это их самый сконцентрированный альбом. Каждый трек хит, но хочется особенно отметить этот коллаб со Skream (легенда UK dubstep). Трансовый вокал, синты, прямая бочка, брейкбит трек вне всяких жанров.

Отдельно респект за видеоряд, много деталей, игра актеров, сам месседж, можно делать отдельный разбор.

https://www.youtube.com/watch?v=V5sawgVLtjI
Тут Starkiller обновился для Empire C2, который тоже получил апгрейд до версии 5.0. Из особенностей, теперь нет необходимости ставить его отдельно, он идет "в коробке" с Empire как модуль и работает с Empire API. Также появилось много фич в удобстве использования UI.

https://github.com/BC-SECURITY/Starkiller
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Кому интересно прям погрузиться во внутрянку и теоретически, и практически, очень рекомендую данный блог! Очень стоящий материал, при том на русском)

https://ardent101.github.io/
👎1
#Redteam #lolbas #gtfobins #wadcoms #hijacklibs
🚬 What is DLL Hijacking?

DLL Hijacking is, in the broadest sense, tricking a legitimate/trusted application into loading an arbitrary DLL. Defensive measures such as AV and EDR solutions may not pick up on this activity out of the box, and allow-list applications such as AppLocker may not block the execution of the untrusted code. There are numerous examples of threat actors that have been observed to leaverage DLL Hijacking to achieve their objectives.

There are various subtypes of DLL Hijacking, such as DLL Search Order Hijacking (T1574.001) and DLL Sideloading (T1574.002). An overview of useful resources explaining various aspects of DLL Hijacking can be found here.

https://hijacklibs.net/
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from APT
🌐 DroppedConnection — Cisco ASA Anyconnect Emulator

Fake VPN server that captures credentials and executes code via the Cisco AnyConnect client.

Source:
https://github.com/nccgroup/DroppedConnection

Research:
https://research.nccgroup.com/2023/03/01/making-new-connections-leveraging-cisco-anyconnect-client-to-drop-and-run-payloads/

#cisco #asa #anyconnect #credentials #redteam
😱1
#C2 #REDTEAM #NIM #EVASION #RAT

Nimbo-C2 agent supports x64 Windows & Linux. It's written in Nim, with some usage of .NET on Windows (by dynamically loading the CLR to the process). Nim is powerful, but interacting with Windows is much easier and robust using Powershell, hence this combination is made. The Linux agent is slimer and capable only of basic commands, including ELF loading using the memfd technique.

https://github.com/itaymigdal/Nimbo-C2
#Redteam #C2 #NIM #EVASION
NimPlant - A light first-stage C2 implant written in Nim and Python

- Lightweight and configurable implant written in the Nim programming language
- Pretty web GUI that will make you look cool during all your ops
- Encryption and compression of all traffic by default, obfuscates static strings in implant artefacts
- Support for several implant types, including native binaries (exe/dll), shellcode or self-deleting executables
- Wide selection of commands focused on early-stage operations including local enumeration, file or registry management, and web interactions
- Easy deployment of more advanced functionality or payloads via inline-execute, shinject (using dynamic invocation), or in-thread execute-assembly
- Support for operations on any platform, implant only targeting x64 Windows for now
- Comprehensive logging of all interactions and file operations
- Much, much more, just see below :)

https://github.com/chvancooten/NimPlant
#Redteam #potato #privesc #windows
Любите картошку? Я тоже, особенно посвежее..)

PetitPotam does not work on newer versions of Windows due to the limitations of related patches. However, setting AuthnLevel to RPC_C_AUTHN_LEVEL_PKT_PRIVACY via RpcBindingSetAuthInfoW before calling EFS works on latest systems.

https://github.com/wh0amitz/PetitPotato