Pentester

Apache Superset Part II: RCE, Credential Harvesting and More https://www.horizon3.ai/apache-superset-part-ii-rce-credential-harvesting-and-more/

Leveraging VSCode Extensions for Initial Access https://www.mdsec.co.uk/2023/08/leveraging-vscode-extensions-for-initial-access/

Vcenter Comprehensive Penetration and Exploitation Toolkit https://github.com/W01fh4cker/VcenterKit

Living Off the Foreign Land Part 1/3: Setup Linux VM for SOCKS routing https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform Part 2/3: Configuring the Offensive Windows VM https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2 Using Windows as Offensive Platform https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3

Cross Platform Telegram based RAT that communicates via telegram to evade network restrictions https://github.com/machine1337/TelegramRAT

CVE-2023-36874: Windows LPE https://github.com/Wh04m1001/CVE-2023-36874

Black Hat USA 2023 https://github.com/onhexgroup/Conferences/tree/main/Black%20Hat%20USA%202023%20slides

This allows you to spoof emails from any of the +2 Million domains using MailChannels. It also gives you a slightly higher chance of landing a spoofed emails from any domain that doesn't have an SPF & DMARC due to ARC adoption. https://github.com/byt3bl33d3r/SpamChannel

Diving into Windows Remote Access Service for Pre-Auth Bugs https://i.blackhat.com/BH-US-23/Presentations/US-23-YukiChen-Diving-into-Windows-Remote-Access.pdf

TBBRAT - this is power full BotNet https://github.com/StayBeautiful-collab/TBBRAT

100 Methods for Container Attacks(RTC0010) https://redteamrecipe.com/100-Method-For-Container-Attacks/

Escalate Service Account To LocalSystem via Kerberos. https://github.com/wh0amitz/S4UTomato

Proof of Concept for CVE-2023-38646 This vulnerability has been declared as critical, because it allows an unauthenticated attacker to execute arbitrary commands with the same privileges as the Metabase server. This vulnerability means the Metabase server can become a potential entry point for malicious attacks, which could compromise the integrity of the whole system it operates on. https://github.com/Zenmovie/CVE-2023-38646

It's a tool to interact with remote hosts using the Windows Search Protocol and coerce authentication. The target host will connect over SMB to the listener host using the machine account. https://github.com/slemire/WSPCoerce

KRBUACBypass By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges. Research: https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html Source: https://github.com/wh0amitz/KRBUACBypass

GIUDA - Ask a TGS on behalf of another user without password https://github.com/foxlox/GIUDA

Escalating Privileges via Third-Party Windows Installers https://www.mandiant.com/resources/blog/privileges-third-party-windows-installers https://github.com/mandiant/msi-search

zer0ptsCTF 2023 - Reverse Engineering Writeups https://fazect.github.io/zer0ptsctf2023-rev/

Critical Zero-Day Vulnerability in Citrix NetScaler ADC and NetScaler Gateway https://www.rapid7.com/blog/post/2023/07/18/etr-critical-zero-day-vulnerability-in-citrix-netscaler-adc-and-netscaler-gateway/

RMM – ScreenConnect: Client-Side Evidence https://dfirtnt.wordpress.com/2023/07/14/rmm-screenconnect-client-side-evidence/