Guglielmo Scaiola

Solution Architect @iCubed - I.T. Consultant, Speaker, Trainer, Red-Teamer,PenTester and Security Consultant, former Army Paratrooper. Opinions are my own

[Guglielmo Scaiola @S0ftwarGs]

https://t.co/6LwcTozDD6

[Guglielmo Scaiola @S0ftwarGs]

https://t.co/Z0V23csLQg

[Guglielmo Scaiola @S0ftwarGs]

Fidenza Corsa https://t.co/V6tuaocAAQ

[Guglielmo Scaiola @S0ftwarGs]

#TEC2023

[Vincent Le Toux (Paris, France) @mysmartlogon]

#PingCastle 3.0 released !!!
https://t.co/wAQMeSPOvz

Active Directory & AzureAD security health check in seconds

>200k AD audited, management readable, no install, no admin, no data sent "to a cloud"

Example of report: https://t.co/jfXlLLS7Ln

github: https://t.co/PEB73KZtoq

[Oliver Lyak @ly4k_]

Today we're publishing new techniques for recovering NTLM hashes from encrypted credentials protected by Windows Defender Credential Guard.

These techniques also work on victims logged on before the server was compromised.

https://t.co/euNIyX2dwW

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Of course it's disputed... 😅 #keepass @harmj0y

Do not forget policies..., enforced ones !
> https://t.co/2VslF3j1td

"Disable trigger system" / "Disable trigger system, delete user triggers" + <ExportNoKey>false</ExportNoKey>

[Emeric Nasi @EmericNasi]

Another #ShellcodePack video by @MC_Info_Sec! Stealthy XLL generation running a Sliver implant. With AV running in background of course :)
https://t.co/ZNlmnzPWB2

[Florian Hansemann @CyberWarship]

"SharpEventPersist: Persistence by writing/reading shellcode from Event Log"

#pentest #redteam #infosec
https://t.co/7WmW0ubp4H

[Guglielmo Scaiola @S0ftwarGs]

@malmoeb @fabian_bader @mysmartlogon +1 Thx

[Florian Hansemann @CyberWarship]

"Red Teaming Active Directory"

#infosec #pentest #redteam
https://t.co/PqR3m6xs0D

[mgeeky | Mariusz Banach @mariuszbit]

MS Defender for Endpoint detects Primary Refresh Token (PRT) extraction based on ProcessCreate event with BrowserCore.exe

Guess what?
Copy BrowserCore.exe to %TEMP%\random.exe - no more detections ¯\_(ツ)_/¯

Got it implemented in my sponsorware SharpPRT for anyone intersted :)

[an0n @an0n_r0]

Reproduced the MS-MSDT Office RCE (on up-to-date Win10 and up-to-date Office 2019). Had some troubles with building the appropriate docx with external HTML reference, so quickly made some notes how to do it, step-by-step: https://t.co/zutxokWF4W

[sinusoid @the_bit_diddler]

Have multiple engagements, past and present? Wanting more flexibility in your download locations?

You asked, I listened. Now you can specify synchronization between Cobalt Strike download locations on a per TeamServer basis.

More tools coming shortly.

https://t.co/QSE1N3h1Mg

[Cn33liz @Cneelis]

Today is #BOFFriday! Time for some new candy:
> New BOF for CVE-2022-26923
> New BOF KerbHash (hash passwds to kerberos keys)
> New BOF version of PetitPotam attack
> Domaininfo updated with Azure support

Check out the @OutflankNL C2-Tool-Collection repo: https://t.co/Wq1obZDfRU

[Florian Hansemann @CyberWarship]

"Shell Code Injector with AES Encryption - EDR Bypass"

#infosec #redteam #pentest
https://t.co/CblemKKpOZ

[Hope Walker @Icemoonhsv]

Pull requests accepted for SharpUp! ProcessDLLHijack and ModifableScheduledTask modules are now available. https://t.co/KUhyvUnQMa

[Florian Hansemann @CyberWarship]

"Taking the pain out of C2 Infrastructure (Part 1)"

#infosec #redteam #pentest
https://t.co/S3HXfQ85V3

Part 2

#redteam #infosec #pentest
https://t.co/zuR5pm32P4

[Vincent Le Toux (Paris, France) @mysmartlogon]

It's coming !
#PingCastle

[Florian Hansemann @CyberWarship]

Obfuscating Malicious, Macro-Enabled Word Docs

#infosec #pentest #redteam
https://t.co/o6GFWLy5sN