Giuseppe`Ohpe`Trotta

I'm a constant seeker and maker of troubles | InfoSec | Shortcut maniac | Virtualization junkie | Puzzles addicted

[Giuseppe`Ohpe`Trotta @Giutro]

I'm releasing with @decoder_it: Juicy Potato, another Local Privilege Escalation tool from a Windows Service Accounts to SYSTEM by abusing the golden privileges (https://t.co/whGg5G3FBp)

[Nemesis Breach and Attack Simulation @Persistent_Psi]

During @offensive_con our @marver presented his research on security aspects of embedded SIM cards.
We are releasing SMShell, an SMS based implant proof of concept for Red Teaming that can evade out of band.

Blogpost: https://t.co/3i4SieWUEm

GitHub: https://t.co/71QbSKwxYZ

[Giuseppe`Ohpe`Trotta @Giutro]

@aemkei I read LOSt

[Luca Carettoni @lucacarettoni]

What’s it like to work at @Doyensec? Read below 👇 We’re hiring again appsec engineers

[James Forshaw @tiraniddo]

As I couldn't find anyone else who'd documented it, thought I'd look at SeTrustedCredmanAccessPrivilege. https://t.co/9d4x4BT8bn

[thaddeus e. grugq @thegrugq]

This is some spectacular counterintelligence work and exploitation.
Research to discover a vulnerability, and then careful exploitation of that vulnerability so it never gets burned.
Tennis 0day

[Antonio Cocomazzi @splinter_code]

RemotePotato0 Update:

We can confirm that cross session activation works in the relay scenario too so you can get rid of session 0 limitation! Now the real fun will ensue 😈

cc @decoder_it

[Andrea P @decoder_it]

When (NTLM) relaying potatoes lead you to domain admin...
A "permanent" 0day Privilege Escalation Vulnerability in Windows RPC Protocol ;-)

cc @splinter_code
Our writeup here:
https://t.co/oIE5MFtpeb

[Giuseppe`Ohpe`Trotta @Giutro]

@buffermet @evilsocket @antisnatchor Maybe in that case you need something like muraena and then pass the session to necro for the post exploitation

[bettercap @bettercap]

v2.31.0 is out!

The number of fixes and new features is just too long to fit in a single screenshot :D

https://t.co/c75fq1yeqZ

[Giuseppe`Ohpe`Trotta @Giutro]

@smaury92 The key is there just to troll, it’s not the right one

[Simone Margaritelli @evilsocket]

a tenacious kernel panic, happening in macOS network stack when bettercap tries to inject packets in the interface in monitor mode (read only works) ... happening on M1 as well ... can somebody at Apple fix this please? https://t.co/kMtnr69Wo1

[Andrea P @decoder_it]

Following my "old" blog post https://t.co/hSHriiQhAI , I have published the very quick & dirty "juicy_2" code https://t.co/ycYI1s9eSp , maybe useful when you have impersonation privs on newer versions of Windows 10 & Server 2019 cc @splinter_code @Giutro

[Giuseppe`Ohpe`Trotta @Giutro]

@evilsocket What about using a custom PAM module to log all the attempts and eventually improve your dictionary

[antisnatchor @antisnatchor]

MuraenaTeam strikes again.
Together with @Giutro we released the new Muraena and NecroBrowser. Lots of new code+features.

Phishing and post-phishing automation at scale for all your needs. Office365 and GitHub examples added. More coming soon 🎣🪝😎

https://t.co/125mrRrYcy

[Andrea P @decoder_it]

Hands off my service account! https://t.co/OSuMW3FCwC

[Giuseppe`Ohpe`Trotta @Giutro]

@evilsocket @qwertyoruiopz I also like this idea but preparing a decent training takes time, this approach seems quicker

[@[email protected] @qwertyoruiopz]

love offensive mobile security and are looking for a job? my new company is hiring! shoot us an email at [email protected]

[Giuseppe`Ohpe`Trotta @Giutro]

@evilsocket Wondering how Cb maj looks like :)

[Dirk-jan @_dirkjan]

It has a few more prerequisites, but I finally managed to get a #Zerologon exploit working that doesn't rely on resetting passwords to exploit. Use the printerbug to make DC1 connect to you, then with lots of magic relay that to DC2 directly to DRSUAPI to DCSync 😁

[Dirk-jan @_dirkjan]

There seems to be quite some questions and confusion about the impact of exploiting Zerologon (CVE-2020-1472) on the environment. So here's a thread 👇