We've just pushed details on our latest #Nighthawk release (Sivako) https://t.co/iSoLVbsnJK - including async BOF support, native kerberos and more 🔥 https://t.co/yPUUBrA5pF
Exploring the WDAC Microsoft Recommended Block Rules: kill.exe
kill.exe is an interesting SDK #lolbin. Instead of loading unsigned code through deserialization or through some script host trampoline magic, kill.exe appears to bypass WDAC b/c it is vulnerable to buffer overflow
🚀 Just dropped v0.5 of my Chrome App-Bound Encryption Decryption tool! Full user-mode (no admin), all path-validation bypasses, full cookie extraction (JSON 🍪) and stealth DLL injection. Chrome’s ABE is officially broken, works on Chrome, Edge & Brave. Anything else to tackle with ABE? 🤔
So I wanted to collate a bunch of different attacks you can perform via ServiceNow that we've used pretty regularly, but for which there doesn't seem to be much out there publicly.
@HaifeiLi Yeah, corpus minimisation and coverage stability for these kind of targets took most of the time for me as well. I found that harnesses make a huge difference for stability, especially when COM is involved.
Spent last two weeks working with Binary Ninja and finally can put ida to the bin. Awesome product, solid plugin support (lighthouse available!), 10/10
Rip webdav motw bypass, was part of some nice exec chains, burnt as cve-2024-38213 by zdi. Unlucky that won't be able to use it for my next gig but had some good time.
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! https://t.co/7ygwWXY0pd
Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996
ICYMI: Apeman, a tool designed to simplify the understanding of permissions & potential Attack Paths within an AWS environment for both attackers & defenders, is now live!
@hotnops is at #BHUSA digging into the tool now - join him at Arsenal Station 3 to learn more.
OST's Stage1 C2 is now Outflank C2, an optimised, OPSEC focused custom C2 framework with:
•Native implants for Windows, macOS and Linux
•Dynamic code exec
•Proxying support
•Peer-to-peer C2 between all three implants
Get more info at https://t.co/UM2DPDBWqM