ArtikSec

The strongest offence forges the best defence

[Compass Security @compasssecurity]

At @BlackAlpsConf, our analyst Sylvain Heiniger @sploutchy presented a new attack path to AD CS. Read his blog post for details and tools updates. #adcs #esc11 #ntlmrelay #rpc #msrpc

https://t.co/UiRDilU9TS

[mpgn @mpgn_x64]

We worked together with @_zblurx to pull this new feature on CME ! CrackMapExec can now authenticate using kerberos with login/pass/nthash/aeskey without the need of a KRB5CCNAME ticket env 🚀

But wait there is more! by adding this feature we can now mimic kerbrute features 🔥🫡

[mpgn @mpgn_x64]

New update on CrackMapExec 🔽

➡️ Upload/download with MSSQL -guervild
➡️ Exploit KeePass (discover, trigger) @d3lb3_ 🔥
➡️ ACL read with LDAP @BlWasp_
➡️ Check ntlmv1 (postex) @Tw1sm
➡️ Check alwayselevated (postex) -bogey3
➡️ Improved export on cmedb @gray_sec

🪂

[Outflank @OutflankNL]

Yeah!🤘@OutflankNL joins the @HelpSystemsMN family!

We're super excited about the new possibilities that lay ahead. Here's to even more R&D for our community, awesome offensive tools in OST and the most exciting red teaming gigs.

Details: https://t.co/TWo4ln0IZT

[pre.empt @preemptdev]

🧵In part 5 of the blog series we're looking at implementing and bypassing common EDR functionality. As a part of this we look at Kernel Callbacks, Hooks, and Thread Call Stacks: https://t.co/l5C7jnBYTw 1/3

[mgeeky | Mariusz Banach @mariuszbit]

☢️ I'm so excited - just issued my first blog post☢️
As promised - sharing my @WarConPL slides deck on:

https://t.co/mynQW0aXsF

Power of positive feedback made me publish them during my first day of holidays (●'◡'●)

Let me know if you like it 🔥

[5pider @C5pider]

Ekko
Sleep Obfuscation by using CreateTimerQueueTimer to queue the ROP Chain that performs the sleep obfuscation.
https://t.co/DiZt4NDDVn

[Rasta Mouse @_RastaMouse]

[BLOG]
Short post on how to use Firefox to access internal web apps over SOCKS using NTLM authentication.

https://t.co/8jpKGfWiZW

[Rasta Mouse @_RastaMouse]

How many 1337 omg 0-days would be mitigated if orgs already just followed basic security practices... :kappa:

[Cube0x0 @cube0x0]

I'll start adding NTLM support to KrbRelay
RemotePotato0 like with a local capture server for all OS versions
https://t.co/jgxCviqE8b

[Rémi GASCOU (Podalirius) @podalirius_]

[#thread 🧵] ⚠️ Fellow #pentesters, please be careful. Do not run these two #PoC targeting #Windows #Servers from GitHub, these are actually #beacons connecting to a remote command and control server:

- https://t.co/pIi1JsamBD
- https://t.co/Wn6rRWifK8

[ArtikSec @ArtikSec]

@jaredcatkinson @threader_app comp

[cyber8knight @AravGarg3]

CVE-2021-40443: oob write of NULL bytes and 1 QWORD (0xffffffff00000000) => LPE in clfs.sys

[Nikhil Mittal @nikhil_mitt]

Never tried this before! 200 RTs and I will do an 'Introduction to Azure Penetration Testing' class for FREE sometime during the Holiday season. #Azure #Pentesting #redteam

[Rasta Mouse @_RastaMouse]

Just finished writing up a blog post detailing my methodology for implementing the Cobalt Strike External C2 spec in .NET.

The post is Patron-only for a while, but here's a video of the end result.

https://t.co/3zejYKLCe2

[ArtikSec @ArtikSec]

@_nwodtuhs @threadreaderapp unroll

[Jean @Jean_Maes_1994]

Excited to announce that (if covid plays nicely) I've invited @KlezVirus to take the stage with me @brucon. The OG plan was to present Dinvoke, but thanks to @KlezVirus 's recent work, we'll be expanding it to include a practical case study!

[klez @KlezVirus]

Having done the previous RTO and tested the new version I can say this is one of the best RT courses ever!
Free access to CobaltStrike and Splunk, you can test in real-time what's detected, what's not, and why!
Just awesome! 👍👍 up for @_RastaMouse!

[klez @KlezVirus]

[BLOG POST + TOOL RELEASE]
And so it's finally the time to release Inceptor, a new AV/EDR bypass framework designed around evasive PE packing, DLL manual mapping, and direct Syscall invocation. More info in the blog, hope you'll enjoy it!
https://t.co/CODszSVn0L

[klez @KlezVirus]

Just updated https://t.co/vAKGRr78YQ with CheeseSQL, a new MSSQL attacking tool designed to handle tricky MSSQL impersonation configuration