eks

[Lefteris Panos @lefterispan]

Wrote a small C# tool that is able to make a network token using a certificate. Comes handy in RTs ;) https://t.co/XZOfbamxMv

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Today we are releasing TokenCert, a C# tool that will create a network token using a provided certificate via PKINIT, by @lefterispan

This is useful for Red Teams giving make-token functionality with certificates instead of passwords.

https://t.co/TvCLIq87t5

[trickster0 @trickster012]

I just released my C2 I was working on, on my free time. Feel free to play around make your own forks if you like it. It needs a lot of work but it is a fully rust one with small implant and working sleep obfuscation.
https://t.co/kSu1KW6IYN

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Calling all Red Teamers 🚨

Today we are introducing Tartarus-TpAllocInject, a new OPSEC-safe loader and technique for bypassing EDR solutions, by @trickster012

https://t.co/mEWnIvU3c7

[Hackcraft @Hackcraft_labs]

Red Team ops need diverse malware for various scenarios. @naliferopoulos of #Hackcraft created #Blueprint, an open-source tool for source-level templating. It enables the use of sinister modules & metaprogramming in Jinja2 syntax. Learn more: https://t.co/K16iPveZer #redteam

[Hackcraft @Hackcraft_labs]

Red Team's malware samples often end up in public sources for analysis. Hackcraft's first open-source tool, Fairplay, monitors these to identify payloads & notify operators, ensuring fair play between teams.
Learn more: https://t.co/6iQD1Xe0Tb #redteam #hackcraft

[Dirk-jan @_dirkjan]

Took me a few days, still don't know exactly how/why it works, but I now have a new-ish on-prem to cloud technique via a Seamless SSO (Kerberos) backdoor key. Some features:

- No GA needed to add key
- Invisible backdoor (no logs in AAD) 🫣
- 1st factor auth to any synced user

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Introducing ETWHash!

ETWHash is a new method and tool by @lefterispan for consuming SMB events from Event Tracing for Windows (ETW) and extracting NetNTLMv2 hashes for cracking offline.

https://t.co/wLmsQf71J8

[monoxgas @monoxgas]

A short🧵 detailing a Kerberos LPE I discovered while working with @tiraniddo on our BlackHat research.

https://t.co/LjM3t1b0DC (CVE-2023-21817)

This was fixed in Feb, but I think some will find the vulnerability & exploitation interesting.

1/

[Lefteris Panos @lefterispan]

Released a small tool that is able to dump crackable hashes from user DPAPI keys https://t.co/KioCIQ4mGg

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Introducing Aladdin, a new tool by @lefterispan for red teamers to generate payloads bypassing misconfigured WDAC and AppLocker.

https://t.co/doyRU7GYad

[Orange Tsai 🍊 @orange_8361]

The last part of A New Attack Surface on MS Exchange - #ProxyRelay is out! Have also left some final thoughts on the Closing part. Hope you all enjoy this journey :D

https://t.co/XOmClEtB4n

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Introducing MalSCCM!

Today, we are releasing MalSCCM, a .NET tool by @The_Keeb which enhances PowerSCCM functionality and makes it easier to use over command and control channels.

https://t.co/InO8p0syFj

[LRQA Cyber Labs @LRQA_Cyber_Labs]

🥳Introducing PoshC2 v8.0!

Major improvements, including:

* A brand-new native Linux implant;
* The capability to execute Beacon Object Files (BOF) directly from PoshC2;
* Massive SharpSocks rewrite;
* New registry edit module;
* And plenty more!

https://t.co/MZcA52AukX

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Got #CobaltStrike BOFs but love #PoshC2? We've got you covered! Introducing 'RunOF', available now.

https://t.co/GIzi3XZ59M

[vx-underground @vxunderground]

The Russian military website (https://t.co/h3n4oxn0ac) is returning HTTP error code 418 indicating the Russian Military is now a Teapot.

No, this is not a joke.

[Dirk-jan @_dirkjan]

Relaying Kerberos, for real this time 😁 (teaser, needs some more work)

[Melvin langvik @Flangvik]

That's kinda broken 😬😬, Defender For Endpoint (eg ATP) is also affected by the sandboxing tokens method found by @GabrielLandau....

[PortSwigger Research @PortSwiggerRes]

I set myself the challenge of auto executing JavaScript without a click with the animate tag. You can now do this on Firefox and Chrome using the use element.

https://t.co/SvAMIGJI3F

[Vincent Le Toux (Paris, France) @mysmartlogon]

Because clear text passwords is so trendy, I added this small credential provider that I had in stock to #mimikatz
Just 300 lines of ❤❤❤ into this file https://t.co/5XTchc8l50
Works in LogonUI.exe but also in all applications asking for creds
cc: @gentilkiwi @PythonResponder