Forwarded from haxx
Media is too big
VIEW IN TELEGRAM
Всем привет. Выпустил в паблик Sploitify (https://sploitify.haxx.it) - агрегатор эксплойтов/поков/райтапов с тегами по уязвимостям. Что-то вроде GTFOBins, но для эксплойтов. Сейчас в нем можно найти чекеры от nuclei (тысячи их), некоторые эксплойты на эскалацию привилегий и удаленное выполнение кода в винде и никсах. Еще много чего добавлять, но пользоваться уже можно. Надеюсь пригодится и сделает вашу жизнь немножко легче, по крайней мере такая была цель :)
Forwarded from 1N73LL1G3NC3
Living off the VPN — Exploring VPN Post-Exploitation Techniques
What can an attacker accomplish while using only the VPN management interface?
Executive summary:
What can an attacker accomplish while using only the VPN management interface?
Executive summary:
• In this blog post, Akamai researchers highlight the overlooked threat of VPN post-exploitation; that is, we address techniques that can be used by threat actors after compromising a VPN server to further escalate their intrusion.
• Our findings include several vulnerabilities that affected Ivanti Connect Secure and FortiGate VPNs.
• In addition to the vulnerabilities, we detail a set of no-fix techniques that can affect the Ivanti Connect Secure and FortiGate products, and potentially other VPN servers, as well.
• Our research shows that, in many cases, a compromised VPN server could allow attackers to easily gain control over other critical assets in the network.
• This blog post aims to raise awareness of these risks, and presents best practices that should be followed by defenders to minimize the risks of VPN post-exploitation techniques.
Forwarded from 1N73LL1G3NC3
This media is not supported in your browser
VIEW IN TELEGRAM
Tempest
A C2 framework written in rust.
Server: Anvil
Implant: Imp
TUI Client: conduit
Slides: https://teach2breach.io/defcon/TEMPEST.pptx
Blog: https://teach2breach.io/tempest-intro/
A C2 framework written in rust.
Server: Anvil
• actix.rs & tokio
• https
• api for imps (implants)
• api for conduit (hacker TUI client)
• internal functions (implant builder + shellcode generation)
• sqlite db (rusqlite)
Implant: Imp
• platform-specific imps (windows, linux, mac)
• payload options as executable, dll, or shellcode (shellcode - windows only)
• simple, yet effective design
• designed with OPSEC in mind. no post-ex module bloat
• modular builds, moving toward giving operators control over granular options
TUI Client: conduit
• main way of interacting with the server
• Terminal User Interface (TUI) with realtime dashboard display
• user friendly
• cross-platform
• looks cool to your old hacker friends
• scrollable fields (PgUp + PgDn on implants field. Up + Down for output field)
Slides: https://teach2breach.io/defcon/TEMPEST.pptx
Blog: https://teach2breach.io/tempest-intro/
Forwarded from 1N73LL1G3NC3
Oops I UDL'd it Again
This post is about a new phishing technique based on some legacy knowledge I had that can be used to get past email filters and such.
Script to generate UDL files for phishing: https://github.com/api0cradle/RedTeamScripts/blob/main/generate-udl.ps1
This post is about a new phishing technique based on some legacy knowledge I had that can be used to get past email filters and such.
Script to generate UDL files for phishing: https://github.com/api0cradle/RedTeamScripts/blob/main/generate-udl.ps1
Forwarded from 1N73LL1G3NC3
This media is not supported in your browser
VIEW IN TELEGRAM
Creating malicious atlassian plugin
Atlassian does not offer any direct protection against malicious plugins. A plugin can access all content inside a Confluence instance, access the database directly, and execute arbitrary commands on the underlying Linux server. It is only limited by what the Java version can offer.
A PoC for a malicious Confluence plugin: https://github.com/cyllective/malfluence
Atlassian does not offer any direct protection against malicious plugins. A plugin can access all content inside a Confluence instance, access the database directly, and execute arbitrary commands on the underlying Linux server. It is only limited by what the Java version can offer.
A PoC for a malicious Confluence plugin: https://github.com/cyllective/malfluence
Forwarded from Proxy Bar
This media is not supported in your browser
VIEW IN TELEGRAM
Олимпийские игры в Париже ? Отстой ! 🤮
Мы за SpeedRun по активации windows ! 👍
Мы за SpeedRun по активации windows ! 👍
Forwarded from Proxy Bar
Proxy Bar
Олимпийские игры в Париже ? Отстой ! 🤮 Мы за SpeedRun по активации windows ! 👍
This media is not supported in your browser
VIEW IN TELEGRAM
Поднимем ставки !
*
ArchLinux SpeedRun
PS про Gentoo тоже есть ))😁
*
ArchLinux SpeedRun
PS про Gentoo тоже есть ))😁
Forwarded from /g/'s Tech Memes (Gianmarco Gargiulo)
ah yes please run
powershell.exe -EncodedCommand fgb459yfg782hntg934jh95= it's totally not a dangerous command disguised as a base64 stringForwarded from Offensive Xwitter
Forwarded from nu11z
Всем привет, в связи с тем что последнее время приходится часто пентестить FreeIPA мы начали разрабатывать либу по типу impacket заточенную под особенности ипы. Пока начали реализовывать kerberos и написали пок для CVE-2024-3183. Если у кого-то будет желание как-то помочь в разработке - welcome.
https://github.com/c2micro/ipapocket
https://github.com/c2micro/ipapocket
Forwarded from Offensive Xwitter
😈 [ nc @thoughtfault ]
In a 2021 study, Jensen et al. observed a pronounced concentration of anime girl profile pictures among the most obscure accounts during a social network analysis of "infosec twitter" and associated subcommunities. As part of the study, a visualization was generated:
🐥 [ tweet ]
In a 2021 study, Jensen et al. observed a pronounced concentration of anime girl profile pictures among the most obscure accounts during a social network analysis of "infosec twitter" and associated subcommunities. As part of the study, a visualization was generated:
🐥 [ tweet ]
сойдетForwarded from APT
🔐 FreeIPA Rosting (CVE-2024-3183)
A vulnerability recently discovered by my friend @Im10n in FreeIPA involves a Kerberos TGS-REQ being encrypted using the client’s session key. If a principal’s key is compromised, an attacker could potentially perform offline brute-force attacks to decrypt tickets by exploiting the encrypted key and associated salts.
🔗Source:
https://github.com/Cyxow/CVE-2024-3183-POC
#freeipa #kerberos #hashcat #cve
———
Добавляем доклад Миши в вишлист на Offzone🚶♂️
A vulnerability recently discovered by my friend @Im10n in FreeIPA involves a Kerberos TGS-REQ being encrypted using the client’s session key. If a principal’s key is compromised, an attacker could potentially perform offline brute-force attacks to decrypt tickets by exploiting the encrypted key and associated salts.
🔗Source:
https://github.com/Cyxow/CVE-2024-3183-POC
#freeipa #kerberos #hashcat #cve
———
Добавляем доклад Миши в вишлист на Offzone
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from Offensive Xwitter
Кайфанул с доклада, особенно с того, что импакетовский
В свое время я эту проблему решал так 👇🏻
Полный патч 👇🏻
getTGT.py, оказывается, можно починить одной строкой, разрешив ошибки декодирования ASN.1.В свое время я эту проблему решал так 👇🏻
Из коробки сценарий getTGT[.]py конечно же не работает, кто бы мог подумать (Рис. 1).
Почему-то FreeIPA думает, что номер операции (aka application tag) EncASRepPart это 26 (хотя в RFC он 25). Другие люди прикола тоже не оценили.
Если изменить спеку ASN.1, как того хочет ИПА, getTGT[.]py начинает работать (Рис. 2). Удобно, что Overpass-the-Key для этой темы тоже работает.
Полный патч 👇🏻
diff --git a/impacket/krb5/asn1.py b/impacket/krb5/asn1.py
index 24963824..393ac9bb 100644
--- a/impacket/krb5/asn1.py
+++ b/impacket/krb5/asn1.py
@@ -283,9 +283,9 @@ class EncKDCRepPart(univ.Sequence):
_sequence_optional_component('key-expiration', 3, KerberosTime()),
_sequence_component('flags', 4, TicketFlags()),
_sequence_component('authtime', 5, KerberosTime()),
- _sequence_optional_component('starttime', 6, KerberosTime()),
+ _sequence_optional_component('starttime', 6, KerberosTime()), # can be empty, so worth try-excepting
_sequence_component('endtime', 7, KerberosTime()),
- _sequence_optional_component('renew-till', 8, KerberosTime()),
+ _sequence_optional_component('renew-till', 8, KerberosTime()), # can be empty, so worth try-excepting
_sequence_component('srealm', 9, Realm()),
_sequence_component('sname', 10, PrincipalName()),
_sequence_optional_component('caddr', 11, HostAddresses()),
diff --git a/impacket/krb5/ccache.py b/impacket/krb5/ccache.py
index 915ea268..01c7f2f8 100644
--- a/impacket/krb5/ccache.py
+++ b/impacket/krb5/ccache.py
@@ -25,6 +25,7 @@ from six import b, PY2
from pyasn1.codec.der import decoder, encoder
from pyasn1.type.univ import noValue
+from pyasn1.error import PyAsn1Error
from binascii import hexlify
from impacket.structure import Structure
@@ -493,9 +494,12 @@ class CCache:
credential['time'] = Times()
credential['time']['authtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['authtime']))
- credential['time']['starttime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['starttime']))
+ try:
+ credential['time']['starttime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['starttime']))
+ except PyAsn1Error:
+ pass
credential['time']['endtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['endtime']))
- credential['time']['renew_till'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['renew-till']))
+ #credential['time']['renew_till'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['renew-till']))
flags = self.reverseFlags(encASRepPart['flags'])
credential['tktflags'] = flags
diff --git a/impacket/krb5/constants.py b/impacket/krb5/constants.py
index 60f1776c..581b5007 100644
--- a/impacket/krb5/constants.py
+++ b/impacket/krb5/constants.py
@@ -42,7 +42,7 @@ class ApplicationTagNumbers(Enum):
KRB_SAFE = 20
KRB_PRIV = 21
KRB_CRED = 22
- EncASRepPart = 25
+ EncASRepPart = 26 # WTF ??? https://mailman.mit.edu/pipermail/kerberos/2006-July/010040.html
EncTGSRepPart = 26
EncApRepPart = 27
EncKrbPrivPart = 28
Forwarded from KnightPentest🛡
This media is not supported in your browser
VIEW IN TELEGRAM
- Ребят, это база. Вот они настоящие пендосы!
- Артем! Тихо=)
Лучшие российские хакеры в центре Лас-Вегаса на амерском #defcon (какие-то соревнования хакерские)😁
- Артем! Тихо=)
Лучшие российские хакеры в центре Лас-Вегаса на амерском #defcon (какие-то соревнования хакерские)😁
Forwarded from 1N73LL1G3NC3
Teach a Man to Phish: A Decade of Distilled Phishing Wisdom
I decided to give away all of my phishing secrets for free. I realized at some point that I have been giving away phishing secrets for years, but only to select individuals, and only one at a time. That method of knowledge dissemination is terribly inefficient! So here it is, I’ve written it down for you instead.
I decided to give away all of my phishing secrets for free. I realized at some point that I have been giving away phishing secrets for years, but only to select individuals, and only one at a time. That method of knowledge dissemination is terribly inefficient! So here it is, I’ve written it down for you instead.
Medium
Teach a Man to Phish
A Decade of Distilled Phishing Wisdom
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Cobalt Strike - CDN & Reverse Proxy Setup. Подробно описанный мануал по подготовке C2 инфраструктуры CS на примере Azure.
https://redops.at/en/blog/cobalt-strike-cdn-reverse-proxy-setup
#redteam #infra #bypass
https://redops.at/en/blog/cobalt-strike-cdn-reverse-proxy-setup
#redteam #infra #bypass