fortunato lodari

Red Teamer

[Giorgia Meloni @GiorgiaMeloni]

Una decisione che lascia senza parole. Ascoltate bene cosa è successo

[Fratelli d'Italia 🇮🇹 @FratellidItalia]

Ancora truffe sul Superbonus, ancora soldi sottratti agli italiani. È l’eredità delle trovate elettorali di Conte che la Nazione continua a pagare a caro prezzo.

[fortunato lodari @flodari]

@max2cbx too much... write in Delphi: why build a steel bridge if you can cross by boat

[fortunato lodari @flodari]

@AmougouYen39757 @ImmaS66162 Che ignoranza sinistra

[fortunato lodari @flodari]

@LukeGix Which is the url of the article?
Thx

[fortunato lodari @flodari]

@splinter_code @decoder_it Why to run "cmd /c" when whoami is an executable?
"cmd /c" is always monitored by edr.

Thx for reply

[fortunato lodari @flodari]

@_RastaMouse Sure!

Try also, on an EC2 machine, to run the command (with each user, root or lowpriv)

aws sts get-access-identity

You'll see credentials and token owned by service user linked to the EC2 machine

It's the same with google cloud and azure

[fortunato lodari @flodari]

GIUDA betrayed again, how to get a new and fresh TGT (or a TGS - if you settle for little) on behalf of another logged user on a Windows machine.

How it works:
https://t.co/ldNo7PCd5C

#redteam #giuda #kerberos

thx to MzHmO@github

[fortunato lodari @flodari]

@ShitSecure I'm here too

[fortunato lodari @flodari]

@gigi52335676 Non ve la potete calare ah?

[Emergenza24 @Emergenza24]

🔴 condividete, per favore

[fortunato lodari @flodari]

Have you tried compiling C++ sources with Embarcadero C++ compiler instead of using common compilers?

OpenProcessToken
DuplicateTokenEx
CreateProcessWithTokenW

virustotal analysis:
the first compiled with Visualstudio and the second with Borland C++

#redteam

[fortunato lodari @flodari]

@jeremymoskowitz The same for me 😉

[fortunato lodari @flodari]

@AnthonySecurity @rpargman Yes Local Admin

[fortunato lodari @flodari]

The best C2?

Microsoft Azure ARC+Automation Account+Hybrid Runbook Worker.

Undetectable and signed

#redteam #c2

[fortunato lodari @flodari]

@rpargman Demo here
https://t.co/8lhhbaakFf

[fortunato lodari @flodari]

@rpargman after step 1. you must run the enrollment script on the victim

[fortunato lodari @flodari]

@bettersafetynet One tenant, you can add your victims and manage them with runbooks.
Also standalone victims (not AD joined and not azure vm), like your home PC.

[fortunato lodari @flodari]

@bettersafetynet hahaha, I'm saying something else: if you put the victim's machine in YOUR azure tenant via ARC, you can stay forever without getting caught.