APT

😈 [ codewhisperer84 @codewhisperer84 ] Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM. 🔗 https://github.com/trustedsec/Titanis/ 🐥 [ tweet ]

🎯 SpearSpray Advanced password spraying tool for Active Directory environments. Combines LDAP user enumeration with intelligent pattern-based password generation. Uses Kerberos pre-authentication and leverages user-specific data (pwdLastSet, displayName) to create personalized passwords per user. 🔗 Source: https://github.com/sikumy/spearspray #ad #password #spraying #kerberos #bloodhound

🛡CreateProcessAsPPL This is a utility for running processes with Protected Process Light (PPL) protection, enabling bypass of EDR/AV solution defensive mechanisms. It leverages legitimate Windows clipup.exe functionality from System32 to create protected processes that can overwrite antivirus service executable files. 🔗 Source: https://github.com/2x7EQ13/CreateProcessAsPPL #av #edr #bypass #ppl

💻 GroupPolicyBackdoor Инструмент пост эксплуатации для различных манипуляций с GPO. Написан на 😰 Python Впервые представлена на DEFCON 33 Примеры:

#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'

Пример ini:

[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"

[MODULEFILTERS]
filters =
    [{
        "operator": "AND",
        "type": "Computer Name",
        "value": "ad01-srv1.corp.com"
    }]

GPO creation, deletion, backup and injections Various injectable configurations, with, for each, customizable options (see list in the wiki) Possibility to remove injected configurations from the target GPO Possibility to revert the actions performed on client devices GPO links manipulation GPO enumeration / user privileges enumeration on GPOs

💻 Repo 📔 Docs #gpo #redteam #windows ✈️ Whitehat Lab 💬Chat

🐶 vCenterHound Collect infrastructure and permissions data from vCenter and export it as a BloodHound‑compatible graph using Custom Nodes/Edges

👑 Our researcher has discovered LPE in VMWare Tools (CVE-2025-22230 & CVE-2025-22247) via VGAuth! Write-up by the one who broke it: Sergey Bliznyuk https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/

🖼️ SharePoint RCE — ToolShell (CVE‑2025‑53770) Critical deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote code execution over the network. The exploit uses POST requests to /_layouts/15/ToolPane.aspx with HTTP Referer header /_layouts/SignOut.aspx to bypass authentication, then extracts MachineKey configuration to generate valid __VIEWSTATE payloads for arbitrary code execution via a single HTTP request. 🔗 Research: https://research.eye.security/sharepoint-under-siege/ 🔗 PoC: https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501 #ad #sharepoint #deserialization #toolshell #rce

🌐 101 Chrome Exploitation Introductory course on browser exploitation — not just covering individual JIT bugs, but a comprehensive dive into browser architecture, security layers, and principles of building exploit chains. The author demonstrates how to turn memory corruption into working exploits by analyzing a functional 3-stage chain for Chrome 130. 🔗 Source: https://opzero.ru/en/press/101-chrome-exploitation-part-0-preface/ #chrome #v8 #sandbox #redteam

🔑 Golden DMSA Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial. 🔗 Research: https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/ 🔗 Source: https://github.com/Semperis/GoldenDMSA #ad #windows #dmsa #kerberos #persistence

🔥 MS-RPC-Fuzzer PowerShell-based fuzzer that automates MS-RPC vulnerability research by dynamically creating RPC clients and fuzzing procedures with random inputs. Visualizes results through Neo4j graphs to help researchers identify potentially vulnerable RPC services. 🔗 Source: https://github.com/warpnet/MS-RPC-Fuzzer #rpc #fuzzing #windows #vulnerability #research

🐶 LudusHound This is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via the Ludus framework for controlled testing. This tool can be used to replicate most AD objects and permissions or can be used to replicate a specific Attack Path. 🔗 Research: https://specterops.io/blog/2025/07/14/ludushound-raising-bloodhound-attack-paths-to-life/ 🔗 Source: https://gitlab.com/badsectorlabs/ludus #ad #bloodhound #ludus #replica

🩸 CitrixBleed 2 — Citrix NetScaler Memory Leak (CVE-2025-5777) Critical memory leak vulnerability in Citrix NetScaler ADC/Gateway. Sending malformed POST request with login parameter without value causes server to return ~127 bytes of uninitialized stack memory, including session tokens, enabling MFA bypass and active session hijacking. 🔗 Research: https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206 🔗 Source: https://github.com/win3zz/CVE-2025-5777 #citrix #netscaler #memoryleak #exploit

🔀 LdrShuffle Code execution/injection technique using _LDR_DATA_TABLE_ENTRY structure manipulation in PEB to redirect EntryPoint of loaded DLLs. Allows code execution without using classic APIs like CreateRemoteThread or QueueUserAPC. 🔗 Source: https://github.com/RWXstoned/LdrShuffle #windows #peb #dll #injection #evasion

🔍 NauthNRPC A Python tool that introduces a new method for gathering domain information, including the enumeration of domain users. The tool leverages auth-level = 1 (No authentication) against the MS-NRPC (Netlogon) interface on domain controllers. All that's required is the domain controller's IP address, and the entire process can be completed without providing any credentials. 🔗 Research: https://securelist.com/no-auth-domain-information-enumeration/112629/ 🔗 Source: https://github.com/sud0Ru/NauthNRPC #ad #enum #netlogon #rpc

Успейте подать заявку на Pentest Award 2025 до 30 июня! Это отраслевая награда для специалистов по тестированию на проникновение, которая проводится уже в третий раз. Основная задача премии — выделить лучших специалистов и показать их вклад в развитие российского пентеста. Участие бесплатное, финалисты получат технику apple и максимальный почет сообщества этичных хакеров. Церемония награждения будет проходить 1 августа в Москве. Заявка на премию — это рассказ о лучшем проекте в свободной форме. Не нужно раскрывать эксплоиты, любые шаги в цепочке эксплуатации могут быть полностью анонимны, а детали могут быть скрыты, важно отразить сам подход и идею. Подать заявку и узнать больше информации можно на сайте — https://award.awillix.ru/

CVE-2025-33073: Reflective Kerberos Relay (LPE) Blog: https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/ Patched: June 10, 2025 Интересная LPE с релеем на себя... Даже CVE есть) #lpe #ad #relay #pentest #redteam

👨‍🎓Дети участников боевых действий в РФ могут бесплатно учиться в вузах — принят закон

🔐 Bitrix CMS Ultimate Pentest Guide A detailed guide on penetration testing for 1C-Bitrix CMS, one of the most popular content management systems in CIS countries. The guide covers authentication bypasses, XSS, SSRF, LFI, RCE exploits, WAF bypass methods, and vulnerabilities in third-party modules (especially Aspro). 🔗 Source: https://pentestnotes.ru/notes/bitrix_pentest_full/ #1c #bitrix #web

😈 [ Toffy @toffyrak ] I have just released my first tool: GPOHound 🚀 GPOHound is an offensive tool for dumping and analysing GPOs. It leverages BloodHound data and enriches it with insights extracted from the analysis. Check it out here: 🔗 https://github.com/cogiceo/GPOHound 🐥 [ tweet ]