w0rk3r's Windows Hacking Library

Red Team Telemetry: Empire Edition https://www.lares.com/red-team-telemetry-empire-edition @WindowsHackingLibrary

Development of a new Windows 10 KASLR Bypass (in One WinDBG Command) https://www.offensive-security.com/vulndev/development-of-a-new-windows-10-kaslr-bypass-in-one-windbg-command @WindowsHackingLibrary

Fileless UAC Bypass in Windows Store Binary https://www.activecyber.us/activelabs/windows-uac-bypass @WindowsHackingLibrary

WEF Logging Bypass for Elastic's Winlogbeat https://blog.neu5ron.com/2019/03/wef-logging-bypass-for-elastics.html @WindowsHackingLibrary

Dynamic Shellcode Execution https://countercept.com/blog/dynamic-shellcode-execution @WindowsHackingLibrary

Extracting BitLocker Keys from a TPM https://pulsesecurity.co.nz/articles/TPM-sniffing @WindowsHackingLibrary

Silencing Cylance: A Case Study in Modern EDRs https://www.mdsec.co.uk/2019/03/silencing-cylance-a-case-study-in-modern-edrs @WindowsHackingLibrary

MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory’s Oddest Settings https://blog.netspi.com/machineaccountquota-is-useful-sometimes @WindowsHackingLibrary

The worst of both worlds: Combining NTLM Relaying and Kerberos delegation https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation @WindowsHackingLibrary

SirepRAT - RCE as SYSTEM on Windows IoT Core https://github.com/SafeBreach-Labs/SirepRAT @WindowsHackingLibrary

Remote Code Execution — Gaining Domain Admin due to a typo https://medium.com/@DanielC7/remote-code-execution-gaining-domain-admin-privileges-due-to-a-typo-dbf8773df767 @WindowsHackingLibrary

A Case Study in Wagging the Dog: Computer Takeover https://posts.specterops.io/a-case-study-in-wagging-the-dog-computer-takeover-2bcb7f94c783 @WindowsHackingLibrary

Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence https://blog.netspi.com/exporting-azure-runas-certificates @WindowsHackingLibrary

Data Source Analysis and Dynamic Windows RE using WPP and TraceLogging https://posts.specterops.io/data-source-analysis-and-dynamic-windows-re-using-wpp-and-tracelogging-e465f8b653f7 @WindowsHackingLibrary

powershellveryless == Constrained Language Mode + AMSI bypass all in one == https://github.com/decoder-it/powershellveryless @WindowsHackingLibrary

Trust? Years to earn, seconds to break (T2A4D) https://labs.mwrinfosecurity.com/blog/trust-years-to-earn-seconds-to-break @WindowsHackingLibrary

Kerberoasting Revisited https://posts.specterops.io/kerberoasting-revisited-d434351bd4d1 @WindowsHackingLibrary

Abusing Unsafe Defaults in Active Directory Domain Services: A Real-World Case Study https://gosecure.net/2019/02/20/abusing-unsafe-defaults-in-active-directory @WindowsHackingLibrary

Krbrelayx - Unconstrained delegation abuse toolkit https://github.com/dirkjanm/krbrelayx @WindowsHackingLibrary

“Relaying” Kerberos - Having fun with unconstrained delegation https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit @WindowsHackingLibrary