😈 [ Octoberfest73, Octoberfest7 ]
Happy early 4th- TeamsPhisher is out now! Send messages + attachments to external Teams users for the purpose of phishing for access.
This short project was a fun departure from all of the BOF and Post-ex stuff I typically focus on.
#redteam #Malware
🔗 https://github.com/Octoberfest7/TeamsPhisher
🐥 [ tweet ]
Happy early 4th- TeamsPhisher is out now! Send messages + attachments to external Teams users for the purpose of phishing for access.
This short project was a fun departure from all of the BOF and Post-ex stuff I typically focus on.
#redteam #Malware
🔗 https://github.com/Octoberfest7/TeamsPhisher
🐥 [ tweet ]
🔥3😁1
😈 [ SEKTOR7net, SEKTOR7 Institute ]
A guide to building your engagement infrastructure, by André Tschapeller (@hipstertrojan)
#redteam
🔗 https://www.securesystems.de/blog/building-a-red-team-infrastructure-in-2023/
🐥 [ tweet ]
A guide to building your engagement infrastructure, by André Tschapeller (@hipstertrojan)
#redteam
🔗 https://www.securesystems.de/blog/building-a-red-team-infrastructure-in-2023/
🐥 [ tweet ]
🔥1
😈 [ r1cksec, r1cksec ]
New cheatsheets pushed 🕵️♂️
🔗 https://github.com/r1cksec/cheatsheets
Including:
A well written blog post on how to read and parse LSASS memory dumps with PowerShell 🔍
#infosec #cybersecurity #pentesting #redteam #lsass #windows
🔗 https://powerseb.github.io/posts/LSASS-parsing-without-a-cat
🐥 [ tweet ]
New cheatsheets pushed 🕵️♂️
🔗 https://github.com/r1cksec/cheatsheets
Including:
A well written blog post on how to read and parse LSASS memory dumps with PowerShell 🔍
#infosec #cybersecurity #pentesting #redteam #lsass #windows
🔗 https://powerseb.github.io/posts/LSASS-parsing-without-a-cat
🐥 [ tweet ]
👍4
Media is too big
VIEW IN TELEGRAM
😈 [ fortunato lodari @flodari ]
Are you tired of failing to create DNS Entry for DavRelay?
LPE with:
no AV/EDR detection, only SIEM (if) checks on LDAP changes
#redteam #LPE #DAVRelay #FUD
🐥 [ tweet ]
+ демо на кобе:
🔗 https://threadreaderapp.com/thread/1697922181684936753.html
Are you tired of failing to create DNS Entry for DavRelay?
LPE with:
ssh -R +
addcomputer.py +
Proxychains +
Proxylite +
PetitPotam +
rbcd_relayno AV/EDR detection, only SIEM (if) checks on LDAP changes
#redteam #LPE #DAVRelay #FUD
🐥 [ tweet ]
+ демо на кобе:
🔗 https://threadreaderapp.com/thread/1697922181684936753.html
🔥10
😈 [ Louis Dion-Marcil @ldionmarcil ]
Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain + left-to-right mark (U+200E)
Links in <a> tags will show the fake domain, but open the real domain.
No need to buy .zip! :) Convincing #phishing #redteam
🐥 [ tweet ]
Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain + left-to-right mark (U+200E)
Links in <a> tags will show the fake domain, but open the real domain.
No need to buy .zip! :) Convincing #phishing #redteam
🐥 [ tweet ]
🔥5👍1🥱1
😈 [ HADESS @Hadess_security ]
The Art Of Hiding In Windows: techniques used by malicious actors to obscure their activities, making detection and analysis significantly more challenging for security professionals.
Article:
🔗 https://hadess.io/the-art-of-hiding-in-windows/
EBook:
🔗 https://hadess.io/the-art-of-hiding-in-windows-ebook/
#windows #redteam
🐥 [ tweet ]
The Art Of Hiding In Windows: techniques used by malicious actors to obscure their activities, making detection and analysis significantly more challenging for security professionals.
Article:
🔗 https://hadess.io/the-art-of-hiding-in-windows/
EBook:
🔗 https://hadess.io/the-art-of-hiding-in-windows-ebook/
#windows #redteam
🐥 [ tweet ]
(pdf-ка в комментах)👍2🔥2
😈 [ Kleiton Kurti @kleiton0x7e ]
Spent some time reversing undocumented Syscalls residing in Kernel32/Ntdll and created a PoC for proxying DLL loads. This leads to a clean call stack as the return address pointing to shellcode won't be pushed to stack.
#CyberSecurity #redteam #infosec
🔗 https://github.com/kleiton0x00/Proxy-DLL-Loads
🐥 [ tweet ]
Spent some time reversing undocumented Syscalls residing in Kernel32/Ntdll and created a PoC for proxying DLL loads. This leads to a clean call stack as the return address pointing to shellcode won't be pushed to stack.
#CyberSecurity #redteam #infosec
🔗 https://github.com/kleiton0x00/Proxy-DLL-Loads
🐥 [ tweet ]
👍4🔥1
😈 [ Panagiotis Chartas @t3l3machus ]
For your #redteam enumeration and brute forcing needs, use babelstrike to transliterate and generate usernames from full names in various non-English languages (common issue from scraped employee data) 🌐 Currently, it covers Greek, Hindi, Spanish, French, Polish, and Hungarian:
🔗 https://github.com/t3l3machus/BabelStrike
Combine it with #psudohash, a password list generator that imitates password creation patterns commonly used by humans, like substituting a word's letters with symbols or numbers (leet), using char-case variations, adding a common padding before or after the main passphrase and more:
🔗 https://github.com/t3l3machus/psudohash
🐥 [ tweet ]
For your #redteam enumeration and brute forcing needs, use babelstrike to transliterate and generate usernames from full names in various non-English languages (common issue from scraped employee data) 🌐 Currently, it covers Greek, Hindi, Spanish, French, Polish, and Hungarian:
🔗 https://github.com/t3l3machus/BabelStrike
Combine it with #psudohash, a password list generator that imitates password creation patterns commonly used by humans, like substituting a word's letters with symbols or numbers (leet), using char-case variations, adding a common padding before or after the main passphrase and more:
🔗 https://github.com/t3l3machus/psudohash
🐥 [ tweet ]
👍1
😈 [ HackerRalf @hacker_ralf ]
Everyone takes a lot from the community... it's time to give something back yourself.
Kerbeus - BOF implementation of Rubeus (not all).
🔗 https://github.com/RalfHacker/Kerbeus-BOF
P. S. PM me about all bugs
#redteam #kerberos #havoc #cobaltstrike #bof
🐥 [ tweet ]
Everyone takes a lot from the community... it's time to give something back yourself.
Kerbeus - BOF implementation of Rubeus (not all).
🔗 https://github.com/RalfHacker/Kerbeus-BOF
P. S. PM me about all bugs
#redteam #kerberos #havoc #cobaltstrike #bof
🐥 [ tweet ]
👍10
😈 [ WHOAMI @wh0amitz ]
To audit the security of read-only domain controllers, I created the SharpRODC project, a simple .NET tool for RODC-related misconfigurations.
🔗 https://github.com/wh0amitz/SharpRODC
#infosec #redteam #cybersecurity #pentesting
🐥 [ tweet ]
To audit the security of read-only domain controllers, I created the SharpRODC project, a simple .NET tool for RODC-related misconfigurations.
🔗 https://github.com/wh0amitz/SharpRODC
#infosec #redteam #cybersecurity #pentesting
🐥 [ tweet ]
🔥3
😈 [ Matt Eidelberg @Tyl0us ]
Long overdue but SourcePoint v3.0 is out now, with a ton of new features and bug fixes. With these changes, Initial access and Post-Ex activities with CobaltStrike can fly under the radar.
Check it out !
#redteam #netsec
🔗 https://github.com/Tylous/SourcePoint/releases/tag/v3.0
🐥 [ tweet ]
Long overdue but SourcePoint v3.0 is out now, with a ton of new features and bug fixes. With these changes, Initial access and Post-Ex activities with CobaltStrike can fly under the radar.
Check it out !
#redteam #netsec
🔗 https://github.com/Tylous/SourcePoint/releases/tag/v3.0
🐥 [ tweet ]
🔥5
Offensive Xwitter
😈 [ SafeBreach @safebreach ] This is huge. As presented at #BlackHatEurope today, see how SafeBreach Labs researcher Alon Leviev developed a brand new set of highly flexible process injection techniques that are able to completely bypass leading EDR solutions.…
😈 [ Shashwat Shah 🇮🇳 @0xEr3bus ]
Just crafted a beacon object file for the 8th variant of the powerful process injection technique by @_0xDeku. An exciting journey into the Windows Thread Pool!
#cybersecurity #redteam #infosec #cobaltstrike
🔗 https://github.com/0xEr3bus/PoolPartyBof
🐥 [ tweet ]
Just crafted a beacon object file for the 8th variant of the powerful process injection technique by @_0xDeku. An exciting journey into the Windows Thread Pool!
#cybersecurity #redteam #infosec #cobaltstrike
🔗 https://github.com/0xEr3bus/PoolPartyBof
🐥 [ tweet ]
👍2
😈 [ SchrodingersAV @SchrodingersAV ]
Read about a technique involving tampering with scheduled tasks, and was inspired to build a powershell script to edit scheduled tasks via the registry keys.
Can be used in memory with powershell!
#redteam #cybersecurity #hacking
🔗 https://gist.github.com/Workingdaturah/991de2d176b4b8c8bafd29cc957e20c2
🐥 [ tweet ]
Read about a technique involving tampering with scheduled tasks, and was inspired to build a powershell script to edit scheduled tasks via the registry keys.
Can be used in memory with powershell!
#redteam #cybersecurity #hacking
🔗 https://gist.github.com/Workingdaturah/991de2d176b4b8c8bafd29cc957e20c2
🐥 [ tweet ]
🔥3👍1
Offensive Xwitter
😈 [ SchrodingersAV @SchrodingersAV ] Read about a technique involving tampering with scheduled tasks, and was inspired to build a powershell script to edit scheduled tasks via the registry keys. Can be used in memory with powershell! #redteam #cybersecurity…
😈 [ David @dmcxblue ]
Managed to port to C# the Invoke-GhostTask from @SchrodingersAV, added a little bit more details on what is going on.
#redteam
🔗 https://github.com/dmcxblue/SharpGhostTask
🐥 [ tweet ]
Managed to port to C# the Invoke-GhostTask from @SchrodingersAV, added a little bit more details on what is going on.
#redteam
🔗 https://github.com/dmcxblue/SharpGhostTask
🐥 [ tweet ]
🔥4👍2
😈 [ NCV @nickvourd ]
Proudly Announcing Windows Local Privilege Escalation Cookbook
#pentest #redteam #windows #privesc
🔗 https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook
🐥 [ tweet ]
Proudly Announcing Windows Local Privilege Escalation Cookbook
#pentest #redteam #windows #privesc
🔗 https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook
🐥 [ tweet ]
🔥4
😈 [ NVISO @NVISOsecurity ]
We've expanded our #RedTeam arsenal with a new awesome Windows LPE BOF for #CobaltStrike and #BruteRatel thanks to the original exploit author @varwara.
Get your copy here!
🔗 https://github.com/NVISOsecurity/CVE-2024-26229-BOF
🐥 [ tweet ]
We've expanded our #RedTeam arsenal with a new awesome Windows LPE BOF for #CobaltStrike and #BruteRatel thanks to the original exploit author @varwara.
Get your copy here!
🔗 https://github.com/NVISOsecurity/CVE-2024-26229-BOF
🐥 [ tweet ]
🔥4🥱3
Offensive Xwitter
😈 [ LuemmelSec @theluemmel ] New blog by @itm4n is a must read for blue and red alike: 🔗 https://itm4n.github.io/printnightmare-exploitation/ Quality stuff as always. Thanks I updated my Client-Checker to evaluate the affected reg keys so you can quickly…
😈 [ parzel @parzel2 ]
During a #redteam at @mod0 we discovered a limited but neat bypass for #printnightmare. I talked to @itm4n about it and he had an indepth look. Read about it here:
🔗 https://itm4n.github.io/printnightmare-not-over/
🐥 [ tweet ]
During a #redteam at @mod0 we discovered a limited but neat bypass for #printnightmare. I talked to @itm4n about it and he had an indepth look. Read about it here:
🔗 https://itm4n.github.io/printnightmare-not-over/
🐥 [ tweet ]
👍2
Forwarded from APT
🔍 Exploring WinRM plugins for lateral movement
In this blog, the process of leveraging WinRM plugins to perform lateral movement to other systems is explored. Additionally, the use of the
🔗 Research:
https://falconforce.nl/exploring-winrm-plugins-for-lateral-movement/
🔗 Source:
https://github.com/FalconForceTeam/bof-winrm-plugin-jump
#ad #winrm #cobaltstrike #bof #redteam
In this blog, the process of leveraging WinRM plugins to perform lateral movement to other systems is explored. Additionally, the use of the
CIM_LogicFile WMI class to bypass certain tricky detections by Microsoft Defender is examined. Finally, all the logic is incorporated into a Cobalt Strike BOF.🔗 Research:
https://falconforce.nl/exploring-winrm-plugins-for-lateral-movement/
🔗 Source:
https://github.com/FalconForceTeam/bof-winrm-plugin-jump
#ad #winrm #cobaltstrike #bof #redteam
FalconForce
Exploring WinRM plugins for lateral movement - FalconForce
We explore how to leverage WinRM plugins to perform lateral movement to other systems and put all the logic in a Cobalt Strike BOF.
👍7🔥2
Forwarded from Ralf Hacker Channel (Ralf Hacker)
Простая реализация
https://gist.github.com/S3cur3Th1sSh1t/8294ec59d1ef38cba661697edcfacb9b
#soft #ad #pentest #redteam #dev
ts::multirdphttps://gist.github.com/S3cur3Th1sSh1t/8294ec59d1ef38cba661697edcfacb9b
#soft #ad #pentest #redteam #dev
👍6🥱2
Forwarded from Pentester`s Notes
Всем привет!
Все сталкивались с ситуациями, когда в корпоративной среде используются в качестве ядра DFS (Distributed File System). Стандартный базовый инструмент для прогулки по корпоративным ресурсам (в обычном пентесте, про redteam ничего не говорю) - smbclient.py в impacket. Соответственно при попытке перейти в DFS-директорию (когда папка физически располагается на другом файловом ресурсе) получали ошибку
Так вот, доработал его для полноценной поддержки DFS
Что умеет:
- ls помечает DFS-ссылки как [DFS]
- dfs_info <dir> показывает referral: targets + TTL
- cd <DFS-папка> (в режиме follow) сам делает переподключение к target и продолжает навигацию
- Nested DFS любой глубины (стек контекстов)
- Multi-target failover: упал target → пробуем следующий
- Health-check + auto-reconnect для кэшированных коннектов
- Корректная навигация через границы DFS-root: cd .., cd ../.., cd ../../other
- Работает и с Kerberos, и с NTLM (учётки переиспользуются)
- Кэширование подключений
OPSEC (важно):
Включение:
Мини-пример:
Реализация на уровне протокола: FSCTL_DFS_GET_REFERRALS (MS-DFSC).
https://github.com/durck/impacket
https://github.com/durck/impacket
https://github.com/durck/impacket
#impacket #smb #dfs #pentest #redteam
Все сталкивались с ситуациями, когда в корпоративной среде используются в качестве ядра DFS (Distributed File System). Стандартный базовый инструмент для прогулки по корпоративным ресурсам (в обычном пентесте, про redteam ничего не говорю) - smbclient.py в impacket. Соответственно при попытке перейти в DFS-директорию (когда папка физически располагается на другом файловом ресурсе) получали ошибку
STATUS_PATH_NOT_COVERED.Так вот, доработал его для полноценной поддержки DFS
Что умеет:
- ls помечает DFS-ссылки как [DFS]
- dfs_info <dir> показывает referral: targets + TTL
- cd <DFS-папка> (в режиме follow) сам делает переподключение к target и продолжает навигацию
- Nested DFS любой глубины (стек контекстов)
- Multi-target failover: упал target → пробуем следующий
- Health-check + auto-reconnect для кэшированных коннектов
- Корректная навигация через границы DFS-root: cd .., cd ../.., cd ../../other
- Работает и с Kerberos, и с NTLM (учётки переиспользуются)
- Кэширование подключений
OPSEC (важно):
Автоматическое подключение к другому файловому хранилицу по-умолчанию выключено — чтобы не шуметь лишний раз.
Включение:
# CLI:
-dfs-follow # (разрешить автоматический переход по DFS при cd)
# В шелле:
dfs_mode on # (включить follow-режим в интерактивной сессии)
Мини-пример:
# ls
Projects [DFS]
# dfs_info Projects
Target: \\fileserver-01\Projects$ (TTL: 300)
# dfs_mode on
# cd Projects
[*] DFS target: \\fileserver-01\Projects$
Реализация на уровне протокола: FSCTL_DFS_GET_REFERRALS (MS-DFSC).
https://github.com/durck/impacket
https://github.com/durck/impacket
https://github.com/durck/impacket
#impacket #smb #dfs #pentest #redteam
🔥18