Vylegzhanin Daniil

RT

[Dominic Chell 👻 @domchell]

Welcome to the red team world…. where blue chastised us for hoarding TTPs 😂😂

[Vylegzhanin Daniil @jfmeee]

https://t.co/M6crnBxent

[Vylegzhanin Daniil @jfmeee]

@domchell "less things shared publicly" so it's finally healing and we no longer brag about .one motw bypasses in the face of the vendor?

[Vylegzhanin Daniil @jfmeee]

Shared a note about the issue I discovered during the weaponization of auditd persistence on macOS
https://t.co/ZvZUOdkbdn

[MDSec @MDSecLabs]

We've just pushed details on our latest #Nighthawk release (Sivako) https://t.co/iSoLVbsnJK - including async BOF support, native kerberos and more 🔥 https://t.co/yPUUBrA5pF

[bohops @bohops]

Exploring the WDAC Microsoft Recommended Block Rules: kill.exe

kill.exe is an interesting SDK #lolbin. Instead of loading unsigned code through deserialization or through some script host trampoline magic, kill.exe appears to bypass WDAC b/c it is vulnerable to buffer overflow

[Vylegzhanin Daniil @jfmeee]

Infosec twitter is something

[Alex @xaitax]

🚀 Just dropped v0.5 of my Chrome App-Bound Encryption Decryption tool! Full user-mode (no admin), all path-validation bypasses, full cookie extraction (JSON 🍪) and stealth DLL injection. Chrome’s ABE is officially broken, works on Chrome, Edge & Brave. Anything else to tackle with ABE? 🤔

[Vylegzhanin Daniil @jfmeee]

@0xBoku @4y45u45c4 @_JohnHammond @SimonExley25688 🙄🙄

[Tim @__invictus_]

So I wanted to collate a bunch of different attacks you can perform via ServiceNow that we've used pretty regularly, but for which there doesn't seem to be much out there publicly.

[xvonfers @xvonfers]

V8 Sandbox escape/bypass/violation and VR collection
https://t.co/dMhlqzYiSf

[Vylegzhanin Daniil @jfmeee]

@__invictus_ @IceSolst Tbf I'm ok with gatekeeping

[Vylegzhanin Daniil @jfmeee]

Nothing feels better than finishing a year with a high integrity callback on the high value server running under privileged account.

[Vylegzhanin Daniil @jfmeee]

@HaifeiLi Yeah, corpus minimisation and coverage stability for these kind of targets took most of the time for me as well. I found that harnesses make a huge difference for stability, especially when COM is involved.

[Vylegzhanin Daniil @jfmeee]

@filip_dragovic Does it change anything tho?

[Vylegzhanin Daniil @jfmeee]

Spent last two weeks working with Binary Ninja and finally can put ida to the bin. Awesome product, solid plugin support (lighthouse available!), 10/10

[Vylegzhanin Daniil @jfmeee]

Rip webdav motw bypass, was part of some nice exec chains, burnt as cve-2024-38213 by zdi. Unlucky that won't be able to use it for my next gig but had some good time.

[Orange Tsai 🍊 @orange_8361]

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! https://t.co/7ygwWXY0pd

Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996

[SpecterOps @SpecterOps]

ICYMI: Apeman, a tool designed to simplify the understanding of permissions & potential Attack Paths within an AWS environment for both attackers & defenders, is now live!

@hotnops is at #BHUSA digging into the tool now - join him at Arsenal Station 3 to learn more.

[Outflank @OutflankNL]

OST's Stage1 C2 is now Outflank C2, an optimised, OPSEC focused custom C2 framework with:
•Native implants for Windows, macOS and Linux
•Dynamic code exec
•Proxying support
•Peer-to-peer C2 between all three implants
Get more info at https://t.co/UM2DPDBWqM

[Vylegzhanin Daniil @jfmeee]

@tautology0 @HackingLZ What is 0day Edr bypass?