Xkeeper

[Xkeeper @Xkeeper]

#BANK GIVEAWAY @W0100O @RohnJocha @blocboyerroy @rajapokemon19 @TheAiArtist_ @Jake_Shepherd1 @ThaMacroMan @parisa002 @CrypTounsi

[$BANK @BankercoinsAda]

THE $BANK AIRDROP IS NOW LIVE, WAITING TO BE CLAIMED.

🔗 https://t.co/YcgYHw2WX8🎁

[Xkeeper @Xkeeper]

#OXBTC GIVEAWAY @Jernasbh @RaheelQadir15 @hg_eze @jackaraden @YounessGhordaf @natikediri @ali1_idris @Izzymiles23 @LuvCompton @Uzoronyeka2 @amrizall04 @D_dabbles6 @c_obermeyer3 @RoddyRi75042822 @e_okiowei @Francoivnmz @RifatMa31688075

[Matt Hand @matterpreter]

In our never-ending hunt for new persistence techniques, @mutantvillian and I spent some time digging into using preview handlers over the past few weeks. Today we're publishing our research along with detection guidance. https://t.co/3gizujwN8R

[Pathocode @pathocode]

#Phishing with malicious #CPL + MS Access - auto prompt the user to execute the payload. Great technique from @424f424f :) #redteam #pentest #cobaltstrike

[Lorenzo Maffia @Maff1t]

Did you know that on Windows you can write non-writable pages and execute code in non-executable memory? I discovered it some days ago looking at a known ransomware.
Details & PoC: https://t.co/wUF8x6V2vu

[Swissky @pentest_swissky]

Spying on users using Remote Desktop Shadowing - Living off the Land https://t.co/ttc0kEB1mv

[Jack Ullrich @winternl_t]

Resolve syscalls at runtime on any Windows version. C# source code available here:
https://t.co/MgvZcNohhl

[Caleb Stewart @calebjstewart]

I haven't see any good Constrained Language Mode bypasses, so I made this. It reflectively modifies the runtime and spawns a FLM powershell session without running powershell.exe. Can be used w/ InstallUtil to bypass AppLocker.

https://t.co/1iPnThCFFr

[Florian Hansemann @CyberWarship]

Pentesting and .hta (bypass PowerShell Constrained Language Mode)

#infosec #pentest #redteam
https://t.co/3MdkfnrUFc

[sh4hin @s3cdev]

EnumPageFilesW shellcode execution technique added to GoPurple: https://t.co/Zq1SkbpKS2 #purpleteaming

[Panos Gkatziroulis 🦄 @ipurple]

Native Payload CallBack Techniques - C# Codes (Code Execution via Callback Functions Technique, without CreateThread Native API) https://t.co/3JHQlSkGxP

[Grzegorz Tworek @0gtweet]

Do you trust RunAsPPL? The "prevent code injection that could compromise credentials" narration? Technically it is right, as you cannot load your DLL into LSASS. But what if LSASS.exe passes cleartext passwords to mpnotify.exe, which automatically loads untrusted DLLs? 😱

[Panos Gkatziroulis 🦄 @ipurple]

Alaris Shellcode Loader - A protective and Low Level Shellcode Loader the defeats modern EDR systems https://t.co/9g37BsDbR7

[Tim Medin @TimMedin]

Want more AV/EDR hooking and bypasses? This article has some solid depth to it (and it is quite readable too).
Thank you to Matthew Eidelberg at @optiv for the article.
https://t.co/KO2lkKkfqZ

[strandjs - [email protected] @strandjs]

What are your first 5 Active Directory post access techniques in a red team?

Starting list no particular order:

1. Password Spraying
2. Kerberoasting
3. File search (passwords, backups, etc.)
4. LLMNR/mDNS/NBNS
5. Insecure mailbox search

Yours?

[PyCoder’s Weekly @pycoders]

django-unicorn: A Magical Full-Stack Framework for Django https://t.co/UBYJTj3NgE

[Nicolas Krassas @Dinosn]

Hooks-On Hoot-Off: Vitaminizing MiniDump (bypassing EDR) https://t.co/z5TT5cQ0Ps

[Nicolas Krassas @Dinosn]

Windows Shellcode in Rust
https://t.co/2DwPo8Ck7Q

[James Coote @jkcoote]

Introducing SharpSphere, a .NET project for attacking vCenter:

- C2 into target VMs, without need network visibility
- Code execution
- File upload/download
- VM enumeration

https://t.co/SBzIRKEXy6
https://t.co/9yIYqJGQ8p

[Grzegorz Tworek @0gtweet]

Simple, but fully working #backdoor based on #IIS + #PowerShell. With remote commands issued through Base64 in the URL.
Inspired by discussions with @pawelmaziarz :)
You can install it with ready-to-use PowerShell script: https://t.co/BGHaJiqWZS