Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰)

Cyber Security | Red Teaming | Offensive operations
رَبِّ إِنِّي لِمَا أَنزَلْتَ إِلَيَّ مِنْ خَيْرٍ فَقِيرٌ

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

https://t.co/BCn0LDVFUx

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

You don't always attack the target directly.

Sometimes, the real challenge is finding a path through the network.

That's exactly what I explored while completing the Pivoting, Tunneling & Port Forwarding module from CPTS Path Check comments for notes

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

I just published SSH Pivoting Lab: Local Port Forwarding, SOCKS Proxy, and Reverse Port Forwarding https://t.co/eITmyEFdxb

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

@N1NJ10_ Awesome infrastructure design! Looking forward to seeing the final lab

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

While studying Pivoting in CPTS, I created this one-page cheat sheet to summarize the difference between SSH Local Port Forwarding (-L) and Dynamic Port Forwarding (-D), along with SOCKS tunneling and Proxychains usage.

Feedback is welcome!

[Fady Moheb @N1NJ10_]

Tools like Snaffler are great, but crawling SMB shares creates a telemetry nightmare. You instantly light up the SIEM with :

- 5140 / 5145 (Network Share Access)
- 4656 / 4663 (Object & File Access)

So I built Invoke-WindowsSearch to query the native Windows Search DB (OLE DB) directly via WinRM/RPC, It extracts the targets without touching the actual files, completely bypassing the 4663 and 5145 detection footprint.

Trade-offs: Requires the WSearch service (disabled by default on Server OS) and lacks complex regex capabilities. Know your environment before execution.

#RedTeam #ActiveDirectory #OPSEC #ThreatHunting #PowerShell

[Fady Moheb @N1NJ10_]

Dumping the Linux Keyring from the Kernel.

Process injection (ptrace) into sssd/sshd is loud. Modern EDRs catch it instantly but like Symbiote malware tried user-space LD_PRELOAD evasion so I went the opposite route.

Built a fileless CO-RE eBPF implant:

- Hooks sys_enter_add_key
- Masquerades as a benign kworker thread
- Intercepts LUKS/Kerberos secrets in transit (PoC below)
- Smuggles AES-256 encrypted payloads via HTTPS C2

Zero disk I/O. Invisible to user-space telemetry.

h/t Eloy (zer1t0) & @Nightbanes for the foundational ptrace research.

#eBPF #RedTeam #Linux #MalwareDevelopment

[Fady Moheb @N1NJ10_]

Stop burning RDP persistence with 4732 alerts. Bypass the "Remote Desktop Users" group entirely.
GUI access only requires:

- SeRemoteInteractiveLogonRight (Inject SID via secedit)
- RDP-Tcp listener permissions (Modify CIM class)

OPSEC: Trades 4732 for 4704. Most SOCs don't tune 4704 with the same aggression.

h/t @Cptjesus for the concept.

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

Deep dive into the Linux Authentication Process and credential handling mechanisms.

Points which Covered:

PAM Architecture
passwd vs shadow
Hash algorithms
Password policies
Credential cracking workflow

#Linux #CyberSecurity #PAM #HTB #CPTS

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

Windows credential dumping mind map

[Aya.md (𝔐𝔦𝔯𝔞𝔠𝔲𝔩𝔬𝔲𝔰) @Aya_Elbaz__]

إِذْ أَوَى الْفِتْيَةُ إِلَى الْكَهْفِ فَقَالُوا رَبَّنَا آتِنَا مِن لَّدُنكَ رَحْمَةً وَهَيِّئْ لَنَا مِنْ أَمْرِنَا رَشَدًا (10)