🖼️ Manipulating Shim and Office for Code Injection

Office Injector - Invokes an RPC method in OfficeClickToRun service that will inject a DLL into a suspended process running as NT AUTHORITY\SYSTEM launched by the task scheduler service, thus achieving privilege escalation from administrator to SYSTEM.

Shim Injector - Writes an undocumented shim data structure into the memory of another process that causes apphelp.dll to apply the “Inject Dll” fix on the process without registering a new SDB file on the system, or even writing such file to disk.

DefCon Presentation

🔗 Source:
https://github.com/deepinstinct/ShimMe

#windows #office #rpc #inject #lpe

WiFi Exploitation Framework

Поддерживаемые атаки:

  -  Deauthentication attack
  -  WIDS Confusion attack
  -  Authentication attack
  -  Beacon Flood attack
  -  TKIP attack (Michael Shutdown Exploitation)
  -  Pixie Dust attack
  -  Null Pin attack
  -  PIN Bruteforce attack
  -  ARP Replay attack
  -  HIRTE attack
  -  Caffe Latte attack
  -  Fake Authentication attack
  -  WPA/WPA2 handshake capture attack
  -  PMKID attack
  -  EvilTwin attack

🥔 https://github.com/D3Ext/WEF

Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) shares via HTTP(s)

Dropped a new tool at DEF CON 32! Loot SCCM Distribution points via HTTP with

We've found credentials, certificates, custom apps, keystores, etc. What will you find?

🔗 https://github.com/badsectorlabs/sccm-http-looter

Introduction to Windows Kernel Exploitation for Beginners

Part 1: https://mdanilor.github.io/posts/hevd-0/

Part 2: mdanilor.github.io/posts/hevd-1/

Part 3: mdanilor.github.io/posts/hevd-2/

Part 4: mdanilor.github.io/posts/hevd-3/

Part 5: mdanilor.github.io/posts/hevd-4/

Dump #lsass using only #NTAPIS running 3 programs to create 3 JSON and 1 ZIP file... and generate the Minidump later!

https://github.com/ricardojoserf/TrickDump

#DriverJack: Turning #NTFS and Emulated Read-only Filesystems in an Infection and Persistence Vector

https://github.com/klezVirus/DriverJack

Tools from the DEFCON 32 talk "SHIM me what you got - Manipulating Shim and Office for Code Injection"

Office Injector - Invokes an RPC method in OfficeClickToRun service that will inject a DLL into a suspended process running as NT AUTHORITY\SYSTEM launched by the task scheduler service, thus achieving privilege escalation from administrator to SYSTEM.

Shim Injector - Writes an undocumented shim data structure into the memory of another process that causes apphelp.dll to apply the “Inject Dll” fix on the process without registering a new SDB file on the system, or even writing such file to disk.

https://github.com/deepinstinct/ShimMe

#Dopamine is a semi-untethered #jailbreak for #iOS 15 and 16

https://github.com/opa334/Dopamine/releases/tag/2.2.2

#SCCMSecrets.py aims at exploiting #SCCM policies distribution for credentials harvesting, initial access and lateral movement.

https://github.com/synacktiv/SCCMSecrets

#tools
#Offensive_security
1. TrickDump dumps the lsass process without creating a Minidump file
https://github.com/ricardojoserf/TrickDump
2. traceeshark - Deep Linux runtime visibility meets Wireshark
https://github.com/aquasecurity/traceeshark

#tools
#Offensive_security
1. SCCM HTTP Looter
https://github.com/badsectorlabs/sccm-http-looter
2. Stealthy Bash Tool
https://github.com/hackerschoice/hackshell
3. Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
https://github.com/klezVirus/DriverJack

#tools
#Cloud_Security
Grimoire - Generate datasets of cloud audit logs for common attacks
https://github.com/dataDog/grimoire

#Cyber_Education
Using SeTcbPrivilege for educational purposes
https://github.com/daem0nc0re/PrivFu/tree/main/PowerOfTcb

#tools
#reversing
"Taking off the blindfold:
Detecting persistent threats on Draytek edge devices", 2024.
]-> Reverse Engineering and Observability toolkit for Draytek firewalls:
https://github.com/infobyte/draytek-arsenal