Nicolas Chatelain

Security researcher | Ligolo/Ligolo-ng/Chashell author

[Nicolas Chatelain @Nicocha30]

@dottor_morte @Jean_Maes_1994 There seems to be a bug affecting Edge and IWA. Unfortunately, there's very little documentation on IWA. I'll investigate.

[Nicolas Chatelain @Nicocha30]

Introducing Ligolo-IWA!

If you love Ligolo-ng but struggle with proxies, EDRs, or AppLocker policies, this is for you. Ligolo-IWA runs directly from Chromium-based browsers (Edge/Chrome) to bypass standard host restrictions and corporate filters.

https://t.co/LwUyUoYey0

[Nicolas Chatelain @Nicocha30]

@JohnWH79 Most likely a duplicate route. Check your routes/yaml configuration file.

[Necromancer Labs @NecromancerLabs]

There are likely Ligolo servers on the Internet that you can connect to with a Ligolo agent.

1. Ligolo has 3 JARM signatures.

2. Ligolo-MP's JARM is the same as Sliver C2.

3. We do not advise or condone connecting to potential Ligolo servers. https://t.co/IYCIFmwEy5

[Atsika @_atsika]

ProxyBlob is alive ! We’ve open-sourced our stealthy reverse SOCKS proxy over Azure Blob Storage that can help you operate in restricted environments 🔒

🌐 https://t.co/KO4AYUDTmb

Blog post for more details right below ⬇️

[DEFCON GROUP Paris @dcgparis]

🇬🇧 DEFCON Paris on NOV-04
🇫🇷 DEFCON Paris le 04/11

- "New cyber visualisation tool", by Adem Ali Cherif

- "RedTeaming and Tunneling – Stop using Raspberry Pi!", by Nicolas Chatelain (@Nicocha30)

📍 Le Carlie, 177 rue Saint Martin, Paris
🕖 19:00
🎟️ https://t.co/dslTzdRwc3

[Nicolas Chatelain @Nicocha30]

@H_Miser L'état a supprimé les aides pour les contrats d'alternance en professionnalisation. https://t.co/dnJPAUSAg0

[quarkslab @quarkslab]

Wireless hacking doesn't have to be a mess of dongles and ad-hoc code anymore.
Yesterday @virtualabs and @CayreRomain from @Eurecom released WHAD, a set of open source tools, libraries and firmware to make wireless security research easier.
The code repo: https://t.co/KtacDBecg7

[vx-underground @vxunderground]

How to fix the Crowdstrike thing:

1. Boot Windows into safe mode
2. Go to C:\Windows\System32\drivers\CrowdStrike
3. Delete C-00000291*.sys
4. Repeat for every host in your enterprise network including remote workers
5. If you're using BitLocker jump off a bridge

[Nicolas Chatelain @Nicocha30]

💪🏻

[HaxRob @haxrob]

Plans to literally "hack the planet" foiled due to 500ms of latency that Andres instinctually investigated.

The latency was due how the malicious code parsed symbol tables in memory.

https://t.co/WNExkhVbTx

[Rob Fuller @mubix]

“It’s almost like people are making more money teaching hacking than actually doing it.” -- @assume_breach https://t.co/2OIGpqk7hS
^ 100% true statement, and most don't teach good habits, they teach run and gun cowboy BS.

[reverseame @reverseame]

LocalPotato - When Swapping The Context Leads You To SYSTEM https://t.co/epQI9Os5iU

[Renaud Lifchitz ⠵ @nono2357]

#Cloning #Fingerprints Like A Boss: 101 Edition
https://t.co/KqFMAhYznK

[Nicolas Chatelain @Nicocha30]

@reybango That's a very good question. Ligolo-ng connections can only be established through the proxy, not from the agent. Even if it works like a VPN, it's not really a VPN 😉. No TUN/TAP interfaces are created on the agent.

[Nicolas Chatelain @Nicocha30]

@reybango Hey Rey! I don't think there are any security issues using the proxy. For authentication, using mTLS is on my Todo list. 😉

[Dave Aitel @daveaitel]

Lol?

[Ollie Whitehouse @ollieatnowhere]

A fun little canary for you all in cyber defence to help detect breaches/data theft.

QT & MP4 files can reference external urls via 'rdrf' sections. These can be URLs and thus you can get a DNS resolution and/or HTTP request on open.

Have an MP4 working example in VLC...

[daniel:// stenberg:// @bagder]

CVE-2020-19909 is everything that is wrong with CVEs

Another 9.8 CRITICAL curl problem. All made up.

https://t.co/iiWAnJHCYh

[Nicolas Chatelain @Nicocha30]

@Laughing_Mantis