Francois Laplaud (Rebrec)

Infosec addict / sysadmin / dreaming about working in the infosec world

[Nicolas Krassas @Dinosn]

Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest https://t.co/BkwoSBEFew

[The DFIR Report @TheDFIRReport]

We identified a malvertising campaign targeting users searching for legitimate software, leading to the download of a trojanized WinSCP installer that deployed Broomstick/OysterLoader.

All files involved in the initial access phase were signed with valid certificates.

[Andrew Oliveau @AndrewOliveau]

🔥Introducing a new Red Team tool - SessionHop: https://t.co/oU2R60ayPD

SessionHop utilizes the IHxHelpPaneServer COM object to hijack specified user sessions. This session hijacking technique is an alternative to remote process injection or dumping LSASS. Kudos to @tiraniddo for first discovering this years ago.

Blue Team tip: Look for unusual child processes spawning from HelpPane.exe

[The Hacker News @TheHackersNews]

🚨 A .NET flaw called “SOAPwn” lets hackers run code on enterprise apps — no patch from Microsoft.

Researchers at Black Hat Europe showed how SOAP clients can be tricked into writing files or web shells, hitting tools like Barracuda RMM and Ivanti EPM.

🔗 Full details here ↓ https://t.co/3B3bTCWvPu

[Francois Laplaud (Rebrec) @elfrancesco]

Auto labelling sharepoint files in Pureview https://t.co/d5KdiQGN43

[Francois Laplaud (Rebrec) @elfrancesco]

Powershell module to create a mermaid representation of your #intune apps and other stuff : https://t.co/BgbOZSHOht

[Francois Laplaud (Rebrec) @elfrancesco]

https://t.co/lx6vXMCBmX

[Rad @rad9800]

Another approach to disable EDRs (with anti-tampering). Credit goes to @sixtyvividtails for the idea🧙‍♂️

PendingFileRenameOperations and an NTFS junction, we can ask Windows to delete EDR binaries on reboot (with Admin privs)

A link to a complete GitHub PoC follows in replies

[Francois Laplaud (Rebrec) @elfrancesco]

https://t.co/0ZG3nghLUY

[Canopée Forêts Vivantes @Canopee_asso]

🪵Gros coup dur pour les forêts: le Parlement vient de saboter la loi européenne contre la déforestation. Ce texte vise à interdire de vendre en Europe des produits s'ils sont responsables de déforestation. Mais les députés viennent de voter pour 3 changements dans le texte qui pourraient avoir des conséquences catastrophiques: une exclusion de la grande majorité des pays des obligations de la loi, une conditionnalité pour la date de sa mise en application, et un report d'un an.
💪Heureusement ce n'est pas fini, il va maintenant falloir trouver un compromis avec la position de la Commission et du Conseil 📃

[CICADA8Research @CICADA8Research]

Hello everyone! Our team loves everything related to LPE exploits. However, there is no publicly available list on the web with fresh LPE exploits (2023-2024) for Windows. However, we do have such a list. And we are sharing it with you!

https://t.co/vZwah6erOy

[Denis Laskov 🇮🇱 @it4sec]

"Apple CarPlay: What's Under the Hood" - the newest and most detailed public research on CarPlay I've seen so far. Security analysis and fun memes included! 🚘 📲 🔬

Presentation [PDF]: https://t.co/PrmYmZ7D4O
Video: https://t.co/7f3mTo5oVg

[Denis Laskov 🇮🇱 @it4sec]

Rooting an Android POS "Smart Terminal" to steal credit card information:✅

Paper "Exploring and Exploiting an Android 'Smart POS' Payment Terminal", by Jacopo Jannone.Paying with a POS will never feel the same for me.

PDF: https://t.co/mZqbgoZZyh
Video: https://t.co/V98uJ4MH0m

[Binni Shah @binitamshah]

Breaking Down Multipart Parsers : File upload validation bypass : https://t.co/p3mmkqEGoH

[CERT-FR @CERT_FR]

Le CERT-FR recrute un expert en investigation numérique ! Si vous aimez traquer les APTs, souhaitez devenir expert sur des technologies très variées et donner du sens à votre travail, n'hésitez pas à postuler 🙂
➡ https://t.co/lsyHAmFqr2

[Udayveer Singh @m4lici0u5]

AV/EDR Lab environment setup references to help in malware development.

https://t.co/pB8nm1zBUa

#Maldev #RedTeam #AV #EDR #Lab

[sabotage @saab_sec]

New blog!

I hate you COM – Pitfalls of COM object activation!

Addressing few issues in .NET unmanaged apis when used in offensive coding

https://t.co/KKpAlkM4fh

[DirectoryRanger @DirectoryRanger]

Microsoft Incident Response lessons on preventing cloud identity compromise
https://t.co/kBtEiWsj2q

[DirectoryRanger @DirectoryRanger]

Extracting Credentials From Windows Logs
https://t.co/018vc4XsWc

[Adam Chester 🏴‍☠️ @_xpn_]

New tool published which is proving to be useful. Cred1py allows execution of the CRED-1 SCCM attack published by @Raiona_ZA over SOCKS5 UDP by wrapping the awesome https://t.co/vlpvKEVziV from @0xcsandker. Enjoy :) https://t.co/NO7HYTA1PP