Dram4ck

Red Team Operator | Sharing notes & summaries on offensive TTPs and adversary emulation.

[Dram4ck @Dram4ck]

I just published a new blog post on cross-domain pivoting through an outbound trust in Active Directory.

Check it out here:
👉 https://t.co/XZv1xwJAzS

#redteam #activedirectory #pivoting #infosec #pentest

[WHOAMI @wh0amitz]

TailVNC — Drop-in Windows VNC persistence over Tailscale. Single binary, Session 0 bypass, zero exposed ports. Built for offensive security & ops. Inspired by @Yeeb_ 's SockTail.

https://t.co/EaN4DycFi4

#redteam #Pentesting #CyberSecurity

[Altered Security @AlteredSecurity]

Congratulations to @Dram4ck for the rare distinction of clearing our Certified Red Team Master exam!
#GCBLab #CRTM #AlteredSecurity cc @nikhil_mitt
https://t.co/oMZP53fHjD

[Alex Neff @al3x_n3ff]

Did you know that you can kerberoast without any valid credentials? All you need is an account that is ASREProastable.
This allows you to request service tickets for any account with a set SPN🔥

NetExec now has a native implementation of this technique, thanks to Azox

[Dram4ck @Dram4ck]

I just published a new blog post on cross-domain pivoting through an outbound trust in Active Directory.

Check it out here:
👉 https://t.co/XZv1xwJAzS

#redteam #activedirectory #pivoting #infosec #pentest

[Dram4ck @Dram4ck]

Cable
Active Directory reconnaissance and exploitation

- Enumerates LDAP & DACL entries
- Modifies user/computer accounts
- Explores trust relationships
https://t.co/u17hlDNmz0
#redteam #pentest #infosec #adsecurity

[Dram4ck @Dram4ck]

Revisiting COM Hijacking

Used for: Persistence via COM hijacking

- Loads payloads into browsers
- Exploits HKCU registry for access
- Avoids noisy direct injection

https://t.co/x3ogEMrCJD

#redteam #pentest #infosec #persistence

[DirectoryRanger @DirectoryRanger]

MSC_Dropper. Python script designed to automate the creation of MSC (Microsoft Management Console) files with customizable payloads for arbitrary execution, by @MarcelBilal
https://t.co/97k4Hg6nqr

[Dram4ck @Dram4ck]

One Tool To Rule Them All

Defeating AMSI, CLM & ETW with a signed Microsoft tool

- Bypasses AMSI via CDB scripting
- Manipulates ETW outputs
- Induces CLM mode changes

https://t.co/RcJIIsLgUV

#redteam #pentest #infosec #AMSI #ETW #bypass #windows #microsoft #cybersecurity

[Dram4ck @Dram4ck]

Compromising Critical Infrastructure by Reversing SCADA Software

- Demonstrates multi-stage attacks
- Exploits IT/OT network convergence
- Reverse-engineers SCADA software

https://t.co/4BGtpl4IP0

#redteam #pentest #infosec #criticalinfrastructure

[Dram4ck @Dram4ck]

Cable
Active Directory reconnaissance and exploitation

- Enumerates LDAP & DACL entries
- Modifies user/computer accounts
- Explores trust relationships
https://t.co/u17hlDNmz0
#redteam #pentest #infosec #adsecurity

[Dram4ck @Dram4ck]

MobApp-Data-Extractor
listing and extracting installed Android APKs and decrypted iOS IPAs

- Extract data from Android and iOS apps
- manual ADB pulls
- Frida scripts

https://t.co/u8FmyrL0yj
#redteam #pentest #infosec #mobilesecurity

[Dram4ck @Dram4ck]

Stratoshark
Analyzing cloud application system calls

- Wireshark-like interface
- Captures system call/logs
- Open-source compatibility
https://t.co/b20eEsO8ob
#redteam #pentest #infosec #cloudsecurity

[Dram4ck @Dram4ck]

Pinkerton
Crawling JavaScript files for secrets

- Finds API keys & tokens
- Detects hardcoded passwords
- Supports Docker setup
https://t.co/mg0lR4GBz3
#redteam #pentest #infosec

[Dram4ck @Dram4ck]

@Carlos_LopezMkt The best approach is to test upstream in a fully monitored environment, so as to analyze each response related to each action performed.

I recommend Elastic EDR, which can be deployed locally for free (trial period).

[Dram4ck @Dram4ck]

LitterBox
Sandbox for red team payload testing

- Validate evasion techniques before deployment
- Analyze payload behavior in virtual environments
https://t.co/7BZZH5wh5O
#redteam #pentest #infosec

[Intigriti @intigriti]

Hunting for misconfigured AWS S3 cloud buckets:
1. Clone CloudEnum
2. Run $ python3 cloud_enum.py -k <TARGET_KEYWORD>
3. Examine results 😎

GitHub: https://t.co/fcqu2fq1HF

[Florian Hansemann @CyberWarship]

''Ghosting AMSI: Cutting RPC to disarm AV''

#infosec #pentest #redteam #blueteam
https://t.co/BcchsnT9mE

[Dram4ck @Dram4ck]

I'm at LeHack with @hackthebox_eu @ParrotSec 🦜

[🃏 ZkClown 🃏 @Zk_Clown]

@Ze_Asimovitch and I have just released a new blog post on "How to create your own Mythic Agent en C"
https://t.co/DCDvgxgLVc