Mor Davidovich

Security Researcher | Red Teamer | Malware Developer

[MANSK1ES @mansk1es]

Check out my new blog post, "Weaponizing Background Images for Information Disclosure and LPE" where I walk through the AnyDesk vuln I found a few months ago (CVE-2024-12754/ZDI-24-1711):
https://t.co/Tv5y645wAn

[Samir @SBousseaden]

Elastic Security Labs has discovered a new method for initial access and evasion in the wild, termed #GrimResource, which involves arbitrary execution in mmc.exe through a crafted MSC file.

https://t.co/q4u4gTPE6O

https://t.co/usWJvhygIC

[Mor Davidovich @dec0ne]

@alisaesage I've wanted to get into fuzzers since I started in this field. Good resources are hard to find, so I always put that off. This could really help jump-start my learning process and expand my team's capabilities.

[Alisa Esage Шевченко @alisaesage]

Happy Solstice! Time to celebrate Truth and Justice. I appreciate your support; and I want to let you try one of my value-packed & expensive commercial masterclasses:

☀️ Masterclass: Hacking Fuzzers for Smarter Bughunting (on-demand video) https://t.co/yEgUXbGPXF

This class will give you a core level grasp of modern evolutionary coverage-guided fuzzing as pro hackers use it. It goes fast from fuzzing essentials to advanced customization & examining how code coverage works on CPU assembly level, 4 hours hands-on video. Free access from 21st to 23rd June (access conditions below)

[Mor Davidovich @dec0ne]

@theluemmel Congrats buddy, best of luck, I hope you crush it!

[LuemmelSec @theluemmel]

One Box To Rule Them All

Little write up of my way to tackle remote pentesting situations with a dropbox.

This is about non covert systems that will allow you to carry out full fledged pentests when implanted into the customers network.

https://t.co/qFhIwXHb1l

[Ido Veltzman @Idov31]

I usually tend to avoid politics but nowadays it is impossible.
To all the Hamas supporters that reading this post, all the people that shout "free Palestine!" take a moment to answer those questions:
Who ruled Palestine and in which year was is conquered? (hint: no answer)

[Orange Cyberdefense's SensePost Team @sensepost]

Cashing in on browser behaviour to silently download executable files. A blog post by @defte_: https://t.co/R8nWxjgewj

[Chris Thompson @_Mayyhem]

The entire SCCM hierarchy is vulnerable to takeover from any primary site because by design, there is no security boundary between sites in the same hierarchy. Check out my new post to learn more about how this can be abused, mitigated, and detected!
https://t.co/ZJPCiIVtYL

[MalDev Academy @MalDevAcademy]

Our EXE loader is now available to everyone on GitHub:
https://t.co/jMwluAqnw3

We'll be uploading more repositories on our GitHub in the future.

[Mor Davidovich @dec0ne]

Love to see our work inspires stuff like that.
Check out @sam_phisher new blog post on Automating MalRDP deployment with Terraform and Ansible.
Great Work!

[Red @sam_phisher]

I saw this the other day, and took a look at @ShorSecLtd's article. Brilliant work that I wanted to try to automate somewhat.

My blog post about deploying MalRDP to Azure with Terraform and Ansible: https://t.co/PLI6UUoICl

[Mor Davidovich @dec0ne]

@sam_phisher @ShorSecLtd Oooh this is nice! Great work!

[Mor Davidovich @dec0ne]

@dmcxblue @ShorSecLtd Thanks for sharing :)

[Adam Chester 🏴‍☠️ @_xpn_]

My Okta for Red Teamers post is up! We look at how Kerberos SSO works, how to intercept credentials via a fake AD Agent, decrypting AD Agent tokens, adding skeleton key's, and even how to deploy a janky SAML IdP server to auth as any user for good measure. https://t.co/Hs0wN5397s

[Mor Davidovich @dec0ne]

@d_xedex Myabe try it with the --forest or --legacy flags, those flags should be used according to the zone type you saw during the --print-zones command. It would help to see the command you ran.

[Mor Davidovich @dec0ne]

New blog post of mine and my first in our "The Path to DA" series where I share a cool attack path I exploited in a recent engagement to gain Domain Admin privileges.
Hope you like it :)
https://t.co/Bje5kXgzcz

[ShorSec Cyber Security @ShorSecLtd]

🔥New Blog Post Alert!
The next chapter in our "The Path to DA" series is now live: "(Relaying) To The Internet And Back".
This entry, by @dec0ne, explores yet another route to DA, focusing on the intricacies of ADIDNS Abuse, LDAP relay, RBCD, and more.
https://t.co/ChV2ZFRKO9

[Mor Davidovich @dec0ne]

@d_xedex 😆 lol
Achievement Unlocked!
Just kidding. Hopefully, it was worth it

[Mor Davidovich @dec0ne]

@Idov31 Do you ever rest?!
Always love reading your posts
Amazing work bro🔥🔥🔥

[Ido Veltzman @Idov31]

Part 5 of Lord Of The Ring0 is out!
https://t.co/ydGqmCrYSL
On this part, I explained how APC and thread injection made from the kernel to a user mode process, IRP & SSDT hook, why they don't work anymore (and their alternatives)

#infosec #CyberSecurity