Волосатый бублик

[ SO-CON 2025 — Talk Recordings ] Recordings from SpecterOps conference. https://www.youtube.com/playlist?list=PLJK0fZNGiFU-WmPyQew-o58t6OtwSruGb

EvilentCoerce A PoC tool that triggers the ElfrOpenBELW procedure in the MS-EVEN RPC interface (used for Windows Event Log service), causing the target machine to connect to an attacker-controlled SMB share. If antivirus software (e.g., Defender) is present, it may scan the file and unintentionally leak NetNTLMv2 credentials, which can be relayed via ntlmrelayx. Blog: https://habr.com/ru/companies/tomhunter/articles/907068/

[ 8 Ways to Attack & Detect Lateral Movement ] Breakdown of 8 lateral movement techniques — and how to detect each one: 🛠 RDP 📁 Admin Shares 🛎 Service Install 📦 PsExec 📆 Scheduled Tasks 🧪 WMI / WMIC 🧬 DCOM 💻 PowerShell Remoting ▶️ Watch here: https://youtu.be/eYNFl1w0W0g

#kerberos [ Common Tool Errors - Kerberos ] So you are performing your favourite kerberos attacks, such as pass the ticket, Public Key Cryptography for Initial Authentication (PKINIT), Shadow Credentials or Active Directory Certificate Services (AD CS) vulnerabilities but you run into a kerberos error and despite troubleshooting you're still none-the-wiser on what todo? Well here's a quick post on the different errors you might encounter, what the root cause of them is and what you might want todo to fix your commands. Blog: https://blog.zsec.uk/common-tool-errors-kerberos Bonus interactive app: https://kerberos.errorism.io

[ GoExec ] Powerful Go‑based tool designed as a drop‑in, OPSEC-first replacement for many of the commonly used Impacket remote‑execution scripts (atexec, dcomexec, psexec, smbexec, wmiexec). In its initial release, GoExec supports four primary RPC‑based methods on Windows: - MS‑SCMR (Service Control Manager) - MS‑TSCH (Task Scheduler) - MS‑DCOM (Distributed COM) - MS‑WMI (Windows Management Instrumentation) Blog: https://www.falconops.com/blog/introducing-goexec Tool: https://github.com/FalconOpsLLC/goexec

[ NomadScanner ] NomadScanner is a hardened, memory-only Windows port scanner built for red teamers and penetration testers who need maximum stealth and OPSEC. It sends fully in-memory HTTP probes with randomized network characteristics to blend into normal traffic patterns. Key features: - Random source ports (49152–65535) and pre/post connection jitter - Variable IP TTL, TOS, and “Don’t Fragment” flags - Dynamic TCP window sizing and Nagle disabling - "Polymorphic" HTTP probes - Shuffles between GET/HEAD/OPTIONS - Random User-Agent strings and variable padding - Domain fronting support (custom Host header) - Custom payload templates and banner grabbing - Port range scanning with exclusions (e.g. 1-1024, 135,445) - Hostname spoofing and a MAC-spoof stub for future extension - Multithreaded with configurable thread count and delays https://github.com/django-88/NomadScanner

#socks #proxy [ ProxyBlobing into your network ] Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS? It's ProxyBlob, a reverse proxy over Azure. https://blog.quarkslab.com/proxyblobing-into-your-network.html

#htb [ HackTheBox Machines Interactive ] 0xdf built a page for all HackTheBox machines. Filter on difficulty, OS, tags, and/or name. Mark complete or incomplete and filter on that (stored in browser local storage). https://0xdf.gitlab.io/cheatsheets/htb-interactive

#ad #dcsync #netsync Netsync attack. No SMB involved. Link: https://gist.github.com/ThePirateWhoSmellsOfSunflowers/4efeea0e405ee8a53c8aa9f4f515d9ad

#kerberos #relay [ From NTLM relay to Kerberos relay: Everything you need to know ] By Andrea Pierini: «I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic.» https://decoder.cloud/2025/04/24/from-ntlm-relay-to-kerberos-relay-everything-you-need-to-know

#recon [ Scopify - the "Netify" Reconnaissance Tool ] Scopify is a Python command-line tool designed for penetration testers and bug bounty hunters to quickly gather and analyze infrastructure information (CDN, Hosting, SaaS) for a target company by scraping netify. It optionally leverages OpenAI's API to provide AI-driven analysis of the gathered infrastructure, highlighting potential areas of interest and suggesting reconnaissance methodologies. By Jason Haddix. 🔗Tool: https://github.com/Arcanum-Sec/Scopify

#ad #gpo [ GPOHound ] GPOHound is a tool for dumping and analysing Group Policy Objects (GPOs) extracted from the SYSVOL share. It provides a structured, formalized format to help uncover misconfigurations, insecure settings, and privilege escalation paths in Active Directory environments. The tool integrates with BloodHound's Neo4j database, using it as an LDAP-like source for Active Directory information while also enriching it by adding new relationships (edges) and node properties based on the analysis. By Toffy. 🔗Check it out here: https://github.com/cogiceo/GPOHound

[ Eventlog Compendium ] A new Streamlit app, that aims to be the go-to resource for understanding and playing with Windows Event Logs. ⚙️ Build your own Advanced Audit Policy based on different data points making your policy data driven. 🧭EventID to Audit Policy mapping as well MITRE ATT&CK to Event ID explorer 📊Leveraging the EVTX-ETW-Resources project, you can explore the different ETW providers by build, version and filter down on key message strings. 📄 EVTX Baseline Search & Match - Explore the evtx-baseline project in a visual way. Where you can paste logs and check if they match in real time 🧮Event Field Decoder - Decode common Windows Security Event fields such as Logon Types, Access Masks, Active Directory GUIDs and SIDs 🔒Built-in SACL Explorer - leveraging SACL Scanner from Alexander DeMine, you can explore the built-in SACLs on a windows system. And much more to come. By Nasreddine Bencherchali P.S. (from admin) This is GOLD! https://eventlog-compendium.streamlit.app

[ Powering up: Abusing Power Apps to compromise on-prem servers ] New blog post from Josh about a bug in Power Apps that allows execution of arbitrary SQL queries on hosts connected through on-prem data gateways. This can turn external O365 access into compromised on-prem SQL servers. Read it: https://www.ibm.com/think/x-force/abusing-power-apps-compromise-on-prem-servers

[ FindUnusualSessions ] A tool to remotely detect unusual sessions opened on windows machines using RPC — Extracts the list of legitimate domains and trusts registered in the LDAP — Maps the current sessions open on remote machines through RPC — Highlight suspicious sessions — Multithreaded connections to enum remote sessions. https://github.com/p0dalirius/FindUnusualSessions

[ Why Red Teams Keep Winning—and How to Flip the Script ] https://cypfer.com/wp-content/uploads/2025/04/Advanced-red-teaming-tactics-latest-trends-for-a-successful-exploitation.pdf

#phishing [Device Code Login Phishing Presentation Attack, Detect, Mitigate] «Device Code Auth is certainly a phish I could see myself falling for, as it blends in with a regular meeting invite and doesn't require entering my password» — video by IppSec. https://www.youtube.com/watch?v=Y8SSYLEq15Q

#aws [ dAWShund – framework to put a leash on naughty AWS permissions ] A framework for putting a leash on naughty AWS permissions. dAWShund helps blue and red teams find resources in AWS, evaluate their access levels and visualize the relationships between them. Blog: https://falconforce.nl/dawshund-framework-to-put-a-leash-on-naughty-aws-permissions GitHub: https://github.com/FalconForceTeam/dAWShund

#ntlm #relay [ The Renaissance of NTLM Relay Attacks: Everything You Need to Know ] Despite being around for a long time, NTLM relay attacks are still one of the most effective ways to compromise domain-joined systems. SpecterOps added new NTLM relay edges to BloodHound to help visualize these attack paths. Check out this deep dive into NTLM to learn more! https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e