Information Security

New LDAP & RDP Relay Vulnerabilities in NTLM

https://blog.preempt.com/new-ldap-rdp-relay-vulnerabilities-in-ntlm

https://www.youtube.com/watch?v=pKt9IJJOM3I

72 views19:17

Invisi-Shell

Hide your powershell script in plain sight! Invisi-Shell bypasses all of Powershell security features (ScriptBlock logging, Module logging, Transcription, AMSI) by hooking .Net assemblies. The hook is performed via CLR Profiler API.

https://github.com/OmerYa/Invisi-Shell

GitHub

GitHub - OmerYa/Invisi-Shell: Hide your Powershell script in plain sight. Bypass all Powershell security features

Hide your Powershell script in plain sight. Bypass all Powershell security features - OmerYa/Invisi-Shell

68 views19:19

Information Security

Something special for the weekend...: A nice writeup on Universal #RCE #exploit by exploiting #Ruby 2.x #serialization

https://www.elttam.com.au/blog/ruby-deserialization/

61 views19:27

Information Security

Feature, not bug: DNSAdmin to DC compromise in one line

https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83

Medium

Feature, not bug: DNSAdmin to DC compromise in one line

Background

66 views19:34

Information Security

Invoke-ADLabDeployer

https://github.com/outflanknl/Invoke-ADLabDeployer

GitHub

GitHub - outflanknl/Invoke-ADLabDeployer: Automated deployment of Windows and Active Directory test lab networks. Useful for red…

Automated deployment of Windows and Active Directory test lab networks. Useful for red and blue teams. - outflanknl/Invoke-ADLabDeployer

65 views19:37

Information Security

https://www.youtube.com/watch?v=QYAl-XMWlpU

YouTube

Cracking Hashes From a Meterpreter Session with Hashcat

67 views12:23

Information Security

Have you checked your PSReadline history lately? Do you know it stores the commands in clear-text and is persistent across reboots? This is on a Domain Controller. #PowerShell #RedTeam

62 views19:54

Information Security

https://media.rootcon.org/ROOTCON%2012/Talks/Exploiting%20ActionScript3%20Interpreter.pdf

71 views21:48

Information Security

https://twitter.com/pyn3rd/status/1062734592476622848

Twitter

pyn3rd

#CVE-2018-14667 RichFaces Framework 3.X through 3.3.4 Expression Language (EL) injection CC:@joaomatosf nice 👍 https://t.co/sSG7Vb7f6s

64 views19:01

Information Security

LethalHTA - A new lateral movement technique using DCOM and HTA

https://codewhitesec.blogspot.com/2018/07/lethalhta.html

Blogspot

CODE WHITE | Blog: LethalHTA - A new lateral movement technique using DCOM and HTA

The following blog post introduces a new lateral movement technique that combines the power of DCOM and HTA. The research on this t...

60 views19:16

Information Security

PHP_imap_open_exploit

Bypassing disabled exec functions in PHP via imap_open (Debian & Ubuntu)

https://github.com/Bo0oM/PHP_imap_open_exploit

GitHub

GitHub - Bo0oM/PHP_imap_open_exploit: Bypassing disabled exec functions in PHP (c) CRLF

Bypassing disabled exec functions in PHP (c) CRLF. Contribute to Bo0oM/PHP_imap_open_exploit development by creating an account on GitHub.

68 views19:24

Information Security

Exploiting internal tomcat server with SSRF - Insomnihack teaser 2017 Web 50 writeup

https://blog.0daylabs.com/2017/01/22/smart-tomcat/

0Daylabs

Exploiting internal tomcat server with SSRF - Insomnihack teaser 2017 Web 50 writeup

Exploiting internal tomcat server (with default credentials) using SSRF (Insomnihack teaser 2017 Web 50 writeup)

67 views19:25

Information Security

Known command-lines of fileless malicious executions.

https://github.com/chenerlich/FCL

GitHub

GitHub - chenerlich/FCL: FCL (Fileless Command Lines) - Known command lines of fileless malicious executions

FCL (Fileless Command Lines) - Known command lines of fileless malicious executions - chenerlich/FCL

69 views19:27

Information Security

Red teamers, you can turn off Defender from admin powershell with ‘Set-MpPreference -DisableRealTimeMonitoring $true’ but it will result in a balloon notification for anyone logged on. Instead, use ‘Add-MpPreference -ExclusionPath “c:\temp”’ to silently add an exclusions folder.

74 views19:28

Information Security

#CVE-2018-14667 RichFaces Framework 3.X through 3.3.4 Expression Language (EL) injection

https://www.youtube.com/watch?v=HR7-nL5G91w

YouTube

Poc of CVE-2018-14667 - Remote Code Execution in WebApps using Richfaces

PoC presented at Hackers to Hackers Conference 2018 (H2HC 2018)
More details in slides: https://www.slideshare.net/mobile/joaomatosff/a-little-bit-about-code-injection-in-webapplication-frameworks-cve201814667-h2hc-2018
CVE-2018-14667 is a Expression Language…

78 views18:47

Information Security

Active Directory Firewall Ports – Let’s Try To Make This Simple

https://blogs.msmvps.com/acefekay/2011/11/01/active-directory-firewall-ports-let-s-try-to-make-this-simple/

78 views18:47

Information Security

JSgen.py – bind and reverse shell JS code generator for SSJI in Node.js with filter bypass encodings

https://pentesterslife.blog/2018/06/28/jsgen/