w0rk3r's Windows Hacking Library

Do You Really Know About LSA Protection (RunAsPPL)? https://itm4n.github.io/lsass-runasppl @WindowsHackingLibrary

The Power of SeImpersonation https://micahvandeusen.com/the-power-of-seimpersonation @WindowsHackingLibrary

From the creator of AdFind, AdMod! https://blog.joeware.net/2021/03/17/6030 Tool Link: http://www.joeware.net/freetools/tools/admod @WindowsHackingLibrary

You Do (Not) Understand Kerberos https://www.youtube.com/watch?v=4LDpb1R3Ghg @SecTalks

Anatomy of an Exploit: RCE with CVE-2020-1350 SIGRed https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce-with-cve-2020-1350-sigred @WindowsHackingLibrary

Trust Direction: An Enabler for Active Directory Enumeration and Trust Exploitation https://bohops.com/2017/12/02/trust-direction-an-enabler-for-active-directory-enumeration-and-trust-exploitation @WindowsHackingLibrary

Farming for Red Teams: Harvesting NetNTLM https://www.mdsec.co.uk/2021/02/farming-for-red-teams-harvesting-netntlm @WindowsHackingLibrary

EDR and Blending In: How Attackers Avoid Getting Caught Part 2 of the series https://www.optiv.com/explore-optiv-insights/source-zero/edr-and-blending-how-attackers-avoid-getting-caught @WindowsHackingLibrary

Endpoint Detection and Response: How Hackers Have Evolved https://www.optiv.com/explore-optiv-insights/source-zero/endpoint-detection-and-response-how-hackers-have-evolved @WindowsHackingLibrary

Offensive Windows IPC Internals 1: Named Pipes https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html @WindowsHackingLibrary

Active Directory forest trusts part 1 - How does SID filtering work? https://dirkjanm.io/active-directory-forest-trusts-part-one-how-does-sid-filtering-work @WindowsHackingLibrary

BitLocker Lockscreen bypass https://secret.club/2021/01/15/bitlocker-bypass.html @WindowsHackingLibrary

Using Spotify Playlists as Malware CDN | C2Tify https://kaganisildak.com/2021/01/14/using-spotify-playlists-as-malware-cdn-c2tify Github repo: https://github.com/kaganisildak/c2tify @WindowsHackingLibrary

Offensive Windows IPC Internals 1: Named Pipes https://csandker.io/2021/01/10/Offensive-Windows-IPC-1-NamedPipes.html @WindowsHackingLibrary

Breaking The Browser – A tale of IPC, credentials and backdoors https://www.mdsec.co.uk/2021/01/breaking-the-browser-a-tale-of-ipc-credentials-and-backdoors @WindowsHackingLibrary

R.I.P ROP: CET Internals in Windows 20H1 http://windows-internals.com/cet-on-windows @WindowsHackingLibrary

A Modern Exploration of Windows Memory Corruption Exploits - Part I: Stack Overflows https://www.forrest-orr.net/post/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows @WindowsHackingLibrary

Forging malicious DOC, undetected by all VirusTotal static engines https://arielkoren.com/blog/2020/12/24/forging-malicious-doc @WindowsHackingLibrary

Exploiting a “Simple” Vulnerability – In 35 Easy Steps or Less! https://windows-internals.com/exploiting-a-simple-vulnerability-in-35-easy-steps-or-less @WindowsHackingLibrary

Gnome is a module to load your signed driver stealthily. The driver is extracted from the Gnome loader, dropped to disk and loaded using NtLoadDriver instead of the usual service creation driver loading which can be noisy and leaves large forensic artefacts behind such as service creation, service start/stop logs etc. https://github.com/slaeryan/AQUARMOURY/tree/master/Gnome @WindowsHackingLibrary