Phishing. Examples of letters and analysis of attacks.

• This repository contains examples of phishing emails that were sent by APT groups to various companies around the world. In addition to examples, the repo includes presentations with analysis and description of phishing attacks. In general, the material is very interesting, especially if you do research and study various schemes:

➡ https://github.com/wddadk/Phishing-campaigns

SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement.

https://github.com/synacktiv/SCCMSecrets

TCP Reverse Shell C++

TCP reverse shell is a type of shell in which the attacker creates a connection from the target machine back to the attacker's machine, rather than the attacker connecting directly to the target. In this script, the attacker typically sets up a listener on a specified port on their own machine, and the victim machine is then compromised with malware that establishes a connection to the attacker's listener. Once the connection is established, the attacker has access to a command prompt on the victim machine, and can execute commands and interact with the system as if they were sitting at the machine itself. This technique is commonly used in cyber attacks and penetration testing

https://github.com/Untouchable17/Reverse-TCP-Shell‌‌

#Mobile_Security
Android web attack surface
https://ndevtk.github.io/writeups/2024/08/01/awas

#Research
"Like, Comment, Get Scammed: Characterizing Comment Scams on Media Platforms", 2024.
]-> https://github.com/like-comment-get-scammed/like-comment-get-scammed.github.io/tree/main/code

#exploit
1. CVE-2024-42758:
Dokuwiki (indexmenu plugin) XSS
https://github.com/1s1ldur/CVE-2024-42758

2. CVE-2024-36877:
SMM Memory Corruption in MSI firmware
https://jjensn.com/at-home-in-your-firmware

#tools
#Offensive_security
1. Loading BOF on Linux
https://github.com/trustedsec/ELFLoader
2. Ransomware Tool Matrix
https://github.com/BushidoUK/Ransomware-Tool-Matrix

#Research
"CalcuLatency: Leveraging Cross-Layer Network Latency Measurements to Detect Proxy-Enabled Abuse", 2024.
]-> https://github.com/censoredplanet/calculatency-code

#exploit
1. CVE-2024-7646:
Ingress-NGINX Annotation Validation Bypass
https://www.armosec.io/blog/cve-2024-7646-ingress-nginx-annotation-validation-bypass

2. CVE-2024-38856:
Apache OFBiz Pre-Authentication RCE (Scanner + Exploit)
https://github.com/securelayer7/CVE-2024-38856_Scanner

#tools
#Blue_Team_Techniques
1. ShellSweepX - ML-powered web shell detection and analysis platform
https://github.com/splunk/ShellSweep/wiki/ShellSweepX
2. CVE-2024-38063 mitigation script by disabling ipv6 of all interfaces
https://github.com/diegoalbuquerque/CVE-2024-38063

#exploit
CVE-2024-38063:
Windows TCP/IP RCE
]-> https://github.com/Sachinart/CVE-2024-38063-POC

#DFIR
1. DFIR PowerShell Script
https://github.com/joeavanzato/RetrievIR
2. Shellcode Delivered Through PowerShell/Python
https://isc.sans.edu/diary/Do+you+Like+Donuts+Here+is+a+Donut+Shellcode+Delivered+Through+PowerShellPython/31182

#tools
#Red_Team_Tactics
Windows Token Stealing Expert
https://github.com/BeichenDream/SharpToken

#exploit
1. CVE-2024-3183:
Kerberos FreeIPA Rosting - Use of Psw Hash With Insufficient Computational Effort
https://github.com/Cyxow/CVE-2024-3183-POC

2. CVE-2024-33895:
Use of Hard-coded Cryptographic Key in Ewon Cosy+ VPN Gateway
https://seclists.org/fulldisclosure/2024/Aug/22

#Offensive_security
Ghost in the PPL
Part 1 - BYOVDLL:
https://itm4n.github.io/ghost-in-the-ppl-part-1
Part 2 - From BYOVDLL to Arbitrary Code Execution in LSASS
https://itm4n.github.io/ghost-in-the-ppl-part-2

#Research
"Sync+Sync: A Covert Channel Built on fsync with Storage", 2024.
]-> https://github.com/toast-lab/Sync-Sync

#exploit
1. CVE-2024-41660:
Vulnerability in OpenBMC
https://tetrelsec.com/posts/cve-2024-41660-slpd-lite

2. CVE-2024-43403:
Kanister Vulnerability
https://github.com/kanisterio/kanister/security/advisories/GHSA-h27c-6xm3-mcqp

#Offensive_security
1. InfraRed AWS Project
https://github.com/0xBienCuit/InfraRed-AWS
2. AD Attacks Automation Scripts
https://github.com/VKo9/AD-attacks-automation-scripts

#Research
"Unveiling Mac Security:
A Comprehensive Exploration of Sandboxing and AppData TCC", 2024.
]-> https://github.com/guluisacat/MySlides/tree/main/BlackHatUSA2024_KCon2024