Octoberfest7

Red Team | Offensive Tool Dev | 2x Course Author @ Zero-Point Security

[Octoberfest7 @Octoberfest73]

After over a year of work my second course with @_ZeroPointSec is now available! In it students will apply low level windows tradecraft in the writing of Cobalt Strike’s UDRL and Sleepmask components. To celebrate, the BOF course is 25% off thru Jan 12th!
https://t.co/WFcoj2rQaq

[Octoberfest7 @Octoberfest73]

“No your Honor you see I didn’t kill them, my killer robot I built and then released into public killed them. No malice intended.”

[Jake @jakerunzer]

@JustJake @joshmanders @Railway @ngeloxyz Ah yup. That was indeed me. No mallace intended. I've been running some agents to do signups + agentic testing on similar platforms. Just halted the harness I was designing around this as it was definitely going off the rails and reaching too far

[Octoberfest7 @Octoberfest73]

@_JohnHammond

[Octoberfest7 @Octoberfest73]

@simplylurking2 All kinds of little traps like this

[Octoberfest7 @Octoberfest73]

So when a SOCKS proxy is configured in BurpSuite with DNS forwarding enabled, Burp will forward all of its https://t.co/MkjhJjniME and https://t.co/J6fpBjPORJ telemetry traffic thru the configured proxy (i.e out into a target environment…) from process start to exit 🤦‍♂️🤦‍♂️🤦‍♂️

[Octoberfest7 @Octoberfest73]

@ConverseDuck__ @xopp1e @Salsa12__ SeDebugPriv does not grant access to PPL processes

[Octoberfest7 @Octoberfest73]

@Salsa12__ Is the technique accomplishing the same as toggling g_IsCredGuardEnabled off within wdigest off though? I know UseLogonCredential controls the plain text piece, but my understanding was the above var also toggled cred guard off

[Octoberfest7 @Octoberfest73]

@Salsa12__ Also, how does this compare to the well-known wdigest toggle/manipulation to also recover future logon sessions?

[Octoberfest7 @Octoberfest73]

@Salsa12__ Very cool. I wonder what the crossover is between cred guard usage and PPL protection of lsass; if both are used there are still some hurdles to get past

[Octoberfest7 @Octoberfest73]

@xopp1e @Salsa12__ Hashes CAN be cracked to recover plaintext, but they can also be used directly in a variety of “pass the hash” workflows wherein you can auth with the hash without requiring the plaintext

[Octoberfest7 @Octoberfest73]

@xopp1e @Salsa12__ Pop a jump server or any other device high value accounts might log into, use this tool, regain ability to extract credentials for said high value accounts for use elsewhere

[0x12 Dark Development @papadelospapas_]

Credential Guard Runtime Shutdown
VBS is supposed to keep your NT hashes locked in VTL1 forever. Turns out LsaIso.exe exposes a named event that tears it all down at runtime.
Steal a SYSTEM token, signal it and extract NT hashes straight from LSASS

https://t.co/aBc4Ug2uTV

[Elastic Security Labs @elasticseclabs]

Microsoft wants EDR out of the Windows kernel. We checked the binaries

They even come with public symbols. Full write-up from @zodiacon : https://t.co/9w3mFPIufM

Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.

What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues

[Octoberfest7 @Octoberfest73]

@abdo_mhanni How else are they going to squeeze dollars out of the hype before the bubble goes pop?

[Octoberfest7 @Octoberfest73]

@unsigned_sh0rt And that’s from a spell of burnout / lack of inspiration on my end, not that I’m hoarding tons of great research

[Octoberfest7 @Octoberfest73]

@unsigned_sh0rt I definitely prefer reading the original research and do not hand it off to AI to summarize. I feel you in general about people not sharing research as much, myself included

[Octoberfest7 @Octoberfest73]

Great reminder that Twitter is a bubble. All we see on here is the bleeding edge, normal people (including MANY in tech) could give two shits about the latest models performance, benchmarking, etc let alone the glue sniffers talking about AI sentience.

[Basel Musharbash @musharbash_b]

I’m a competent adult. Why do I need an “AI agent” to check into a flight for me?

I’m literate. Why do I need an “AI agent” to read and write emails for me? Also, I don’t get so many emails that I can’t answer them myself.

The reason “no one uses AI” is that there’s no serious utility here for the vast majority of people.

[GOŁƊ @vidxn_]

NAOMI KLIEIN to SAM ALTMAN:

"...you ingested the entire written output of human civilization without consent, without compensation and without credit to build a system whose primary commercial application is eliminating the jobs of the people whose work you consumed.

You are not 'liberating human creativity' -- you are strip-mining it and selling it back at a markup while calling the theft 'training data'."

[Octoberfest7 @Octoberfest73]

@vxunderground Here’s a question for you, do you see real value in elaborate chains like this? It strikes me that in today’s age of process heritage correlation that the 5 different file types being pulled and executed is just creating additional noise/detection surface for products. Thoughts?

[Octoberfest7 @Octoberfest73]

@vxunderground You must not have been tuning into this season of Jackass or you’d know exactly how it’s possible