HackGit

​​HijackLibs This project aims to keep a record of publicly disclosed DLL Hijacking opportunities. You can find the web version of this repository on https://www.hijacklibs.net https://github.com/wietze/HijackLibs #dll #hijack #redteam

​​CVE-2022-30216 Authentication coercion of the Windows “Server” service https://github.com/akamai/akamai-security-research/tree/main/cve-2022-30216 Research: https://www.akamai.com/blog/security/authentication-coercion-windows-server-service #windows #cve

​​Agnee Find sensitive information using dorks from different search-engines. https://github.com/R0X4R/Agnee

​​python-keylogger Simple Python Keylogger with Pynput Sending data to a server https://github.com/davidbombal/python-keylogger

​​QueenSono A Golang Package for Data Exfiltration with ICMP protocol. QueenSono tool only relies on the fact that ICMP protocol isn't monitored. It is quite common. It could also been used within a system with basic ICMP inspection (ie. frequency and content length watcher) or to bypass authentication step with captive portal (used by many public Wi-Fi to authenticate users after connecting to the Wi-Fi e.g Airport Wi-Fi). Try to imitate PyExfil (and others) with the idea that the target machine does not necessary have python installed (so provide a binary could be useful) https://github.com/ariary/QueenSono

​​Threatest A Go framework for testing threat detection end-to-end. Threatest allows you to detonate an attack technique, and verify that the alert you expect was generated in your favorite security platform. A detonator describes how and where an attack technique is executed. Supported detonators: ▫️ Local command execution ▫️ SSH command execution ▫️ Stratus Red Team ▫️ AWS detonator https://github.com/datadog/threatest Read the announcement blog post: https://securitylabs.datadoghq.com/articles/threatest-end-to-end-testing-threat-detection/

​​Black Hat USA 2022 Presentation Materials Presentation materials for my Black Hat USA 2022 Briefing and Arsenal talks https://github.com/h4wkst3r/Blackhat-USA-2022-Materials

Bypass-Sandbox-Evasion Bypass Malware sandbox evasion Ram check. https://github.com/ZeroMemoryEx/Bypass-Sandbox-Evasion

​​blackhat-usa-2022-demos ▫️ Silver ticket with password. ▫️ Silver ticket U2U. ▫️ Silver ticket with buffer type confusion. ▫️ KDC pinning and BYOKDC ▫️ S4U2Self ▫️ UAC bypass https://github.com/tyranid/blackhat-usa-2022-demos

​​Xlocate The ultimate exploit finder. https://github.com/ARPSyndicate/xlocate

​​Azure AD Exporter The Azure AD Exporter is a PowerShell module that allows you to export your Azure AD and Azure AD B2C configuration settings to local .json files. This module can be run as a nightly scheduled task or a DevOps component (Azure DevOps, GitHub, Jenkins) and the exported files can be version controlled in Git or SharePoint. This will provide tenant administrators with a historical view of all the settings in the tenant including the change history over the years. https://github.com/microsoft/azureadexporter

​​MemoryRanger Updated MemoryRanger: Hijacking Is Not An Option Blasting Event-Driven Cornucopia: WMI-based User-Space Attacks Blind SIEMs and EDRs MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x/EPT features: ▫️ Hijacking of NTFS structures gains an unauthorized access to files opened without shared access by patching Stream Control Block structures; ▫️ Handle Hijacking Attack provides illegal access to exclusively open files via patching handle table entries; ▫️ Token Hijacking Attack is designed to elevate the process privileges without using token-swapping technique; https://github.com/IgorKorkin/MemoryRanger

​​BadBlood BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time. https://github.com/davidprowe/BadBlood #ad

​​Orange Pi 3 LTS Orange Pi 3 LTS is as $35 single-board PC with Allwinner H6, 2GB RAM, 8GB storage. The Orange Pi 3 LTS is a Raspberry Pi-sized single-board computer powered by an Allwinner H6 processor, which is a 1.8 GHz quad-core ARM Cortex-A53 chip with Mali-T720 graphics. The little computer also has 2GB of LPDDR3 memory, 8GB of eMMC storage, a microSD card reader, and support for WiFi 5 and Bluetooth 5.0. The new board measures 85 x 56mm (3.4″ x 2.2″), which makes it a little smaller than the previous model, which was 93.5 x 60mm (3.7″ x 2.4″). It has the same processor and basic specs, but the manufacturer has updated the wireless card, replaced the micro USB port with a USB-C port, removed the mPCIe support, and reduced the number of USB Type-A ports. But the Orange Pi 3 LTS still has a pretty decent selection of I/O options including: ▫️ 1 x USB 3.0 Type-A ▫️ 2 x USB 2.0 Type-A ▫️ 1 x Gigabit Ethernet ▫️ 1 x HDMI 2.0 ▫️ 1 x 3.5mm audio ▫️ 26-pin connector with GPIO, I2C, SPI, and UART ▫️ IR receiver for optional remote control The board should support Android 9 as well as GNU/Linux distributions including Ubuntu and Debian (Kali Linux). Buy online: 🛒 https://ali.ski/kh-EIS #orangepi #minipc

​​CVE-2022-27255 Realtek eCos SDK SIP ALG buffer overflow. https://github.com/infobyte/cve-2022-27255 #cve

​​CVE-2022-27925-PoC Zimbra RCE simple poc https://github.com/vnhacker1337/CVE-2022-27925-PoC #cve #poc

​​Cobalt Strike Token Vault This Beacon Object File (BOF) creates in-memory storage for stolen/duplicated Windows access tokens allow you to: ▫️ Hot swap/re-use already stolen tokens without re-duplicating. ▫️ Store tokens for later use in case of a person log out. https://github.com/Henkru/cs-token-vault #ad #tokens #c2 #cobalt #redteam

​​SharpSCCM SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr, formerly SCCM) for lateral movement and credential gathering without requiring access to the SCCM administration console GUI. Please visit the wiki for documentation detailing how to build and use SharpSCCM. https://github.com/Mayyhem/SharpSCCM

CVE-2022-36446 A Python script to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997. ▫️ Supports HTTP and HTTPS (even with self-signed certificates with --insecure). ▫️ Single command execution with --command option. ▫️ Interactive console with --interactive option. https://github.com/p0dalirius/CVE-2022-36446-Webmin-Software-Package-Updates-RCE #cve #exploit

​​PrivescCheck This script aims to enumerate common Windows configuration issues that can be leveraged for local privilege escalation. It also gathers various information that might be useful for exploitation and/or post-exploitation. https://github.com/itm4n/PrivescCheck #windows #privesc #enumeration #powershell