Almond OffSec

Offensive Security team at Almond - Follow us also on

[Almond OffSec @AlmondOffSec]

A private @Burp_Suite Collaborator instance is an essential for pentesting sensitive environments, but managing TLS for it can be a pain. Today we release a Certbot plugin that automates Let’s Encrypt wildcard certificate renewals for private instances.

https://t.co/UTr8aFlDFd

[Almond OffSec @AlmondOffSec]

Are one-way trusts really one way? @lowercase_drm sums up how the TDO password lets you turn a one-way AD forest trust into bidirectional access, and releases a new tool to remotely extract these secrets.

https://t.co/jh9MRAeHk9

[Almond OffSec @AlmondOffSec]

Team member @sigabrt9 was able to bypass Apache FOP Postscript escaping to reach GhostScript engine.

https://t.co/NW441pszsS

[Almond OffSec @AlmondOffSec]

Team member @myst404_ identified a privilege escalation in WAPT caused by a DLL hijacking issue, which was promptly fixed by the vendor. Patched in version 2.6.1.
Changelog: https://t.co/H4mApCKfMV

[SAERXCIT @saerxcit]

Publishing https://t.co/QlL5L05Ps6!
It's a generalisation of LibTPLoadLib to proxy APIs with an arbitrary number of args.
Provided as a Crystal Palace shared library. API made compatible with @_RastaMouse 's LibTP.
Hooks are provided to show off the newest Crystal Palace features

[Almond OffSec @AlmondOffSec]

Callstacks are largely used by the Elastic EDR to detect malicious activity. @SAERXCIT details a technique to evade a callstack-based detection and allow shellcode to load a network module without getting detected.
Post: https://t.co/hckL3n8it5
PoC: https://t.co/0dqBDQeKWm

[S3cur3Th1sSh1t @ShitSecure]

The Blog post about "Revisiting Cross Session Activation attacks" is now also public. Lateral Movement with code execution in the context of an active session? 😎 Here you go:

https://t.co/FkljGCquGF

[Almond OffSec @AlmondOffSec]

Following @ShitSecure's TROOPERS talk and release of BitlockMove, we're releasing our internal DCOMRunAs PoC made by @SAERXCIT last year.
It uses a similar technique with a few differences, such as DLL hijacking to avoid registry modification.
https://t.co/yq80EAtSEo

[Almond OffSec @AlmondOffSec]

Did you know deleting a file in Wire doesn’t remove it from servers?

Team member @myst404_ took a closer look at Wire's asset handling and identified 5 cases where behaviors may diverge from user expectations.

https://t.co/jYyZJ3on8b

[Orange Cyberdefense's SensePost Team @sensepost]

Attacks against AD CS are de rigueur these days, but sometimes a working attack doesn’t work somewhere else, and the inscrutable error messages are no help. Jacques replicated the most infuriating and explains what’s happening under the hood in this post https://t.co/eF5nhHfPuS

[Almond OffSec @AlmondOffSec]

To escape a locked-down Citrix environnement, team member @saerxcit wrote a basic shellcode loader in OpenEdge ABL, a 40 years old english-like programming language. We're sharing it in the off chance someone else might one day need it:

https://t.co/elT14mb8Ss

[Almond OffSec @AlmondOffSec]

This issue was assigned CVE-2024-52531. While the CVE description states that the vulnerability cannot be reached from the network, it seems, in fact, possible (check the blogpost for details).

[Almond OffSec @AlmondOffSec]

Team member @sigabrt9 describes a fuzzing methodology he used to find a heap overflow in a public @yeswehack bug bounty program for Gnome: https://t.co/BFibCnOTaF

[Almond OffSec @AlmondOffSec]

You can now also follow us on Mastodon : https://t.co/tQt8SiWEFU

[Almond OffSec @AlmondOffSec]

You can now also follow us on Bluesky:

https://t.co/4ZGiTzbRRB

[YesWeHack ⠵ @yeswehack]

📢 Hunter Alert! Here's an excellent write-up by @sigabrt9 - who recently uncovered a bug in @gnome’s #BugBounty program. Perfect to expand your knowledge about finding bugs in open-source programs 👉 https://t.co/QQOnmdWRvw

Thank you @sigabrt9 for this valuable contribution!

[Almond OffSec @AlmondOffSec]

Team member @sigabrt9 describes a fuzzing methodology he used to find a heap overflow in a public @yeswehack bug bounty program for Gnome: https://t.co/BFibCnOTaF

[Almond OffSec @AlmondOffSec]

New article on F5! A write-up on CVE-2024-45844, a privilege escalation vulnerability in BIG-IP by team member @myst404_

https://t.co/44CishyuHT

[Almond OffSec @AlmondOffSec]

If you are lucky enough to have a Windows Server Datacenter with Hyper-V, you can automatically activate @M4yFly 's GOAD VMs, so rebuilding the lab every 180 days is no longer needed. We POCed a Vagrant-style script here:

https://t.co/9Jk3cutl85

[Almond OffSec @AlmondOffSec]

How does F5's Secure Vault, its "super-secure SSL-encrypted storage system" work? Response in this article by team member @myst404_

https://t.co/RRfcA3sJY6

[Almond OffSec @AlmondOffSec]

Got root, what now? Practical post-exploitation steps on an F5 Big-IP appliance, by team members @lowercase_drm and @myst404_

https://t.co/5YD46wKCMC