APT

🥔 DeadPotato This is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the original GodPotato source code by BeichenDream. 🔗 Source: https://github.com/lypd0/DeadPotato #windows #lpe #potato #seimpersonate

🖥 Find and execute WinAPI functions with Assembly If you want to take a happy little journey through PEB structs, PE headers and kernel32.dll Export Table to spawn some "calc.exe" on x64 using Assembly, here it is. 📚 What you will learn: — WinAPI function manual location with Assembly; — PEB Structure and PEB_LDR_DATA; — PE File Structure; — Relative Virtual Address calculation; — Export Address Table (EAT); — Windows x64 calling-convention in practice; — Writing in Assembly like a real Giga-Chad... 🔗 Source: https://print3m.github.io/blog/x64-winapi-shellcoding #maldev #winapi #x64 #shellcode #assembly

👩‍💻 Anyone can Access Deleted and Private Repository Data on GitHub You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. Cross Fork Object Reference (CFOR) vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks). — Deleted Fork Data: Still accessible. — Deleted Repo Data: Commits remain. — Private Repo Data: Can become public. 🔗 Research: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github #github #private #repo #cfor

😈 [ Print3M @Print3M_ ] I wrote my first calc.exe "shellcode" in NASM. I find it a little strange that a lot of people write about malware development but almost no one talks about writing your own shellcode. I decided to write something on my own. (good comments, easy readable) 🔗 https://github.com/Print3M/shellcodes/blob/main/calc-exe.asm 🐥 [ tweet ] #для_самых_маленьких

🛠 Adventures in Shellcode Obfuscation This series of articles explores various methods for hiding shellcode, emphasizing techniques to avoid detection. The focus is on demonstrating diverse approaches to conceal shellcode. 🔗 Part 1: Overview 🔗 Part 2: Hail Caesar 🔗 Part 3: Encryption 🔗 Part 4: RC4 with a Twist 🔗 Part 5: Base64 🔗 Part 6: Two Array Method #shellcode #obfuscation #clang #maldev

.

How to fix the Crowdstrike thing: 1. Boot Windows into safe mode 2. Go to C:\Windows\System32\drivers\CrowdStrike 3. Delete C-00000291*.sys 4. Repeat for every host in your enterprise network including remote workers 5. If you're using BitLocker jump off a bridge

💻 Chrome Extension For Persistence How to silently install any Chrome extension and avoid common indicators of compromise (IOCs). The method avoids using CLI parameters or registry edits, and persists via the Secure Preferences file 🔗 Source: https://syntax-err0r.github.io/Silently_Install_Chrome_Extension.html #chrome #persistence #maldev #c2

🖥 Introduction for to Windows kernel exploitation Explore the Windows Kernel with HEVD, a vulnerable driver. Dive into stack overflow exploits and bypass SMEP/KPTI protections using the sysret approach. A detailed guide for Windows kernel explotation: — Part 0: Where do I start? — Part 1: Will this driver ever crash? — Part 2: Is there a way to bypass kASLR, SMEP and KVA Shadow? — Part 3: Can we rop our way into triggering our shellcode? — Part 4: How do we write a shellcode to elevate privileges and gracefully return to userland? #windows #kernel #driver #hevd #hacksys

😎 Gigaproxy — One Proxy to Rule Them All If you’re looking for a powerful tool to help you bypass Web Application Firewalls (WAFs) during external penetration tests and bug bounty programs, you’re in the right place. Gigaproxy tool is designed to rotate IPs using mitmproxy, AWS API Gateway, and Lambda. Fireprox is great but has one major downside. You can only target a single host at a time. Gigaproxy solves this. 🔗 Research: https://www.sprocketsecurity.com/resources/gigaproxy 🔗 Source: https://github.com/Sprocket-Security/gigaproxy #ip #rotate #aws #api #gateway #proxy

💻 BIOS bootloader from scratch in ASM Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode. From ASM basics to integrating with C, unravel the complexities step-by-step. 🔗 Research: https://thasso.xyz/2024/07/13/setting-up-an-x86-cpu.html 🔗 Code: https://github.com/thass0/blog-code/tree/main/2024-07-13-setting-up-an-x86-cpu #bios #loader #asm #clang

Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection! Давным-давно я писал о способе злоупотребления интерфейсом IHxHelpPaneServer. Однако вы когда в последний раз использовали моникеры? И я давным-давно... Поэтому нужно было найти альтернативный способ исполнения кода в сессии другого пользователя, забыв про все техники внедрения. Если посмотреть на код RemotePotato0 или RemoteKrbRelay , то можно заметить использование недокументированных интерфейсов ISpecialSystemProperties и IStandartActivator. Причем не сказать, что их использование довольно редкое. Их можно встретить в любой программе, которая позволяет стащить учётные данные (имеет переключатель -session). Сами по себе, они позволяют контролировать сессию, в которой создавать COM-объект. Ранее мы ловили от них только аутентификацию, но что мешает соединить использование этих интерфейсов с описанным в SeMishaPrivilege COM-классом IHxHelpPaneServer? Конечно же ничего! И я написал небольшой POC, который выложил на GitHub . Если вам интересно подробно окунуться в принцип работы инструмента, то советую обратить внимание на нашу статью на medium :)

⚙️ Remote Session Enumeration The blog post explores how to enumerate remote user sessions on Windows using undocumented Windows APIs, specifically focusing on the implementation and usage of the WinStation API. 🔗 Research: https://0xv1n.github.io/posts/sessionenumeration/ 🔗 Source: https://github.com/0xv1n/RemoteSessionEnum/blob/main/main.cpp #windows #qwinsta #session #winapi #cpp

😈 dirDevil: Hiding Code and Content Within Folder Structures This article describes a method for hiding data within directory structures by using GUIDs in folder names to encode information. This approach bypasses antivirus and DLP systems since the data is stored in folder names rather than files, making it difficult to detect and analyze. 🔗 Research: https://trustedsec.com/blog/dirdevil-hiding-code-and-content-within-folder-structures 🔗 Source: https://github.com/nyxgeek/dirdevil #hide #code #folder #evasion

🖥 Windows KASLR bypass using prefetch side-channel A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11. Inspired by EntryBleed for Linux. This tool was developed as part of an exploit targetting Windows 11 24H2. CPU Support: — Intel: Reliable ✅ — AMD: Flaky ⚠️ 🔗 Research: https://exploits.forsale/24h2-nt-exploit/ 🔗 Source: https://github.com/exploits-forsale/prefetch-tool #windows11 #aslr #kaslr #research

🕷 ADSpider Tool for monitor Active Directory changes in real time without getting all objects. Instead of this it use replication metadata and Update Sequence Number (USN) to filter current properties of objects. 🔗 Research: https://habr.com/ru/companies/angarasecurity/articles/697938/ 🔗 Source: https://github.com/DrunkF0x/ADSpider ——— Наконец-то появилась на свет, а точнее в паблике, утилита ADSpider от моего горячо любимого @DrunkF0x. Ура-ура! 💃 #ad #windows #monitoring #tools

🖼️ Microsoft SharePoint Server 20219 — RCE PoC for: — CVE-2024-38094 — CVE-2024-38024 — CVE-2024-38023 🔗 Source: https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC #sharepoint #poc #rce #cve

🔑 Dumping LSA: a story about task decorrelation Discover the art of bypassing EDRs by decorrelating attack tool behavior. This post explains the process of remote LSA secrets dumping and reveals techniques to retrieve a Windows computer's BOOTKEY without EDR detection. 🔗 Source: https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ #lsa #sam #dump #edr #bypass