Shwmae (shuh-my) is a Windows Hello abuse tool that was released during DEF CON 32 as part of the Abusing Windows Hello Without a Severed Hand talk. The purpose of the tool is to abuse Windows Hello from a privileged user context.

https://github.com/CCob/Shwmae

👻 Ghost in the PPL: BYOVDLL

This blog post explores bypassing LSA Protection in Userland through the "Bring Your Own Vulnerable DLL" (BYOVDLL) technique. It also delves into the successful exploitation of vulnerabilities in the CNG Key Isolation service and the methods employed to load vulnerable DLLs within protected processes.

🔗 Source:
https://itm4n.github.io/ghost-in-the-ppl-part-1/

#lsa #lsass #ppl #dll #maldev

🖼️ Manipulating Shim and Office for Code Injection

Office Injector - Invokes an RPC method in OfficeClickToRun service that will inject a DLL into a suspended process running as NT AUTHORITY\SYSTEM launched by the task scheduler service, thus achieving privilege escalation from administrator to SYSTEM.

Shim Injector - Writes an undocumented shim data structure into the memory of another process that causes apphelp.dll to apply the “Inject Dll” fix on the process without registering a new SDB file on the system, or even writing such file to disk.

DefCon Presentation

🔗 Source:
https://github.com/deepinstinct/ShimMe

#windows #office #rpc #inject #lpe

WiFi Exploitation Framework

Поддерживаемые атаки:

  -  Deauthentication attack
  -  WIDS Confusion attack
  -  Authentication attack
  -  Beacon Flood attack
  -  TKIP attack (Michael Shutdown Exploitation)
  -  Pixie Dust attack
  -  Null Pin attack
  -  PIN Bruteforce attack
  -  ARP Replay attack
  -  HIRTE attack
  -  Caffe Latte attack
  -  Fake Authentication attack
  -  WPA/WPA2 handshake capture attack
  -  PMKID attack
  -  EvilTwin attack

🥔 https://github.com/D3Ext/WEF

Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) shares via HTTP(s)

Dropped a new tool at DEF CON 32! Loot SCCM Distribution points via HTTP with

We've found credentials, certificates, custom apps, keystores, etc. What will you find?

🔗 https://github.com/badsectorlabs/sccm-http-looter

Introduction to Windows Kernel Exploitation for Beginners

Part 1: https://mdanilor.github.io/posts/hevd-0/

Part 2: mdanilor.github.io/posts/hevd-1/

Part 3: mdanilor.github.io/posts/hevd-2/

Part 4: mdanilor.github.io/posts/hevd-3/

Part 5: mdanilor.github.io/posts/hevd-4/

Dump #lsass using only #NTAPIS running 3 programs to create 3 JSON and 1 ZIP file... and generate the Minidump later!

https://github.com/ricardojoserf/TrickDump

#DriverJack: Turning #NTFS and Emulated Read-only Filesystems in an Infection and Persistence Vector

https://github.com/klezVirus/DriverJack

Tools from the DEFCON 32 talk "SHIM me what you got - Manipulating Shim and Office for Code Injection"

Office Injector - Invokes an RPC method in OfficeClickToRun service that will inject a DLL into a suspended process running as NT AUTHORITY\SYSTEM launched by the task scheduler service, thus achieving privilege escalation from administrator to SYSTEM.

Shim Injector - Writes an undocumented shim data structure into the memory of another process that causes apphelp.dll to apply the “Inject Dll” fix on the process without registering a new SDB file on the system, or even writing such file to disk.

https://github.com/deepinstinct/ShimMe

#Dopamine is a semi-untethered #jailbreak for #iOS 15 and 16

https://github.com/opa334/Dopamine/releases/tag/2.2.2

#SCCMSecrets.py aims at exploiting #SCCM policies distribution for credentials harvesting, initial access and lateral movement.

https://github.com/synacktiv/SCCMSecrets

#tools
#Offensive_security
1. TrickDump dumps the lsass process without creating a Minidump file
https://github.com/ricardojoserf/TrickDump
2. traceeshark - Deep Linux runtime visibility meets Wireshark
https://github.com/aquasecurity/traceeshark

#tools
#Offensive_security
1. SCCM HTTP Looter
https://github.com/badsectorlabs/sccm-http-looter
2. Stealthy Bash Tool
https://github.com/hackerschoice/hackshell
3. Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
https://github.com/klezVirus/DriverJack

#tools
#Cloud_Security
Grimoire - Generate datasets of cloud audit logs for common attacks
https://github.com/dataDog/grimoire

#Cyber_Education
Using SeTcbPrivilege for educational purposes
https://github.com/daem0nc0re/PrivFu/tree/main/PowerOfTcb