APT
Open in Telegram
This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat
Show more📈 Analytical overview of Telegram channel APT
Channel APT (@apt_notes) in the English language segment is an active participant. Currently, the community unites 16 326 subscribers, ranking 7 738 in the Technologies & Applications category and 40 313 in the Russia region.
📊 Audience metrics and dynamics
Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 16 326 subscribers.
According to the latest data from 04 September, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 553 over the last 30 days and by 27 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 56.41%. Within the first 24 hours after publication, content typically collects 13.14% reactions from the total number of subscribers.
- Post reach: On average, each post receives 9 210 views. Within the first day, a publication typically gains 2 146 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 13.
📝 Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
“This channel discusses:
— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc
Disclaimer:
t.me/APT_Notes/6
Chat Link:
t.me/APT_Notes_PublicChat”
Thanks to the high frequency of updates (latest data received on 05 September, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
16 326
Subscribers
+2724 hours
+1117 days
+55330 days
Posts Archive
16 326
🥔 DeadPotato
This is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the original GodPotato source code by BeichenDream.
🔗 Source:
https://github.com/lypd0/DeadPotato
#windows #lpe #potato #seimpersonate
16 326
🖥 Find and execute WinAPI functions with Assembly
If you want to take a happy little journey through PEB structs, PE headers and kernel32.dll Export Table to spawn some "calc.exe" on x64 using Assembly, here it is.
📚 What you will learn:
— WinAPI function manual location with Assembly;
— PEB Structure and PEB_LDR_DATA;
— PE File Structure;
— Relative Virtual Address calculation;
— Export Address Table (EAT);
— Windows x64 calling-convention in practice;
— Writing in Assembly like a real Giga-Chad...
🔗 Source:
https://print3m.github.io/blog/x64-winapi-shellcoding
#maldev #winapi #x64 #shellcode #assembly
16 326
👩💻 Anyone can Access Deleted and Private Repository Data on GitHub
You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. Cross Fork Object Reference (CFOR) vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks).
— Deleted Fork Data: Still accessible.
— Deleted Repo Data: Commits remain.
— Private Repo Data: Can become public.
🔗 Research:
https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github
#github #private #repo #cfor
16 326
Repost from Offensive Xwitter
😈 [ Print3M @Print3M_ ]
I wrote my first calc.exe "shellcode" in NASM. I find it a little strange that a lot of people write about malware development but almost no one talks about writing your own shellcode. I decided to write something on my own. (good comments, easy readable)
🔗 https://github.com/Print3M/shellcodes/blob/main/calc-exe.asm
🐥 [ tweet ]
#для_самых_маленьких
16 326
🛠 Adventures in Shellcode Obfuscation
This series of articles explores various methods for hiding shellcode, emphasizing techniques to avoid detection. The focus is on demonstrating diverse approaches to conceal shellcode.
🔗 Part 1: Overview
🔗 Part 2: Hail Caesar
🔗 Part 3: Encryption
🔗 Part 4: RC4 with a Twist
🔗 Part 5: Base64
🔗 Part 6: Two Array Method
#shellcode #obfuscation #clang #maldev
16 326
Repost from vx-underground
How to fix the Crowdstrike thing:
1. Boot Windows into safe mode
2. Go to C:\Windows\System32\drivers\CrowdStrike
3. Delete C-00000291*.sys
4. Repeat for every host in your enterprise network including remote workers
5. If you're using BitLocker jump off a bridge
16 326
💻 Chrome Extension For Persistence
How to silently install any Chrome extension and avoid common indicators of compromise (IOCs). The method avoids using CLI parameters or registry edits, and persists via the Secure Preferences file
🔗 Source:
https://syntax-err0r.github.io/Silently_Install_Chrome_Extension.html
#chrome #persistence #maldev #c2
16 326
🖥 Introduction for to Windows kernel exploitation
Explore the Windows Kernel with HEVD, a vulnerable driver. Dive into stack overflow exploits and bypass SMEP/KPTI protections using the sysret approach.
A detailed guide for Windows kernel explotation:
— Part 0: Where do I start?
— Part 1: Will this driver ever crash?
— Part 2: Is there a way to bypass kASLR, SMEP and KVA Shadow?
— Part 3: Can we rop our way into triggering our shellcode?
— Part 4: How do we write a shellcode to elevate privileges and gracefully return to userland?
#windows #kernel #driver #hevd #hacksys
16 326
😎 Gigaproxy — One Proxy to Rule Them All
If you’re looking for a powerful tool to help you bypass Web Application Firewalls (WAFs) during external penetration tests and bug bounty programs, you’re in the right place. Gigaproxy tool is designed to rotate IPs using mitmproxy, AWS API Gateway, and Lambda. Fireprox is great but has one major downside. You can only target a single host at a time. Gigaproxy solves this.
🔗 Research:
https://www.sprocketsecurity.com/resources/gigaproxy
🔗 Source:
https://github.com/Sprocket-Security/gigaproxy
#ip #rotate #aws #api #gateway #proxy
16 326
💻 BIOS bootloader from scratch in ASM
Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode. From ASM basics to integrating with C, unravel the complexities step-by-step.
🔗 Research:
https://thasso.xyz/2024/07/13/setting-up-an-x86-cpu.html
🔗 Code:
https://github.com/thass0/blog-code/tree/main/2024-07-13-setting-up-an-x86-cpu
#bios #loader #asm #clang
16 326
Repost from RedTeam brazzers
Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection!
Давным-давно я писал о способе злоупотребления интерфейсом IHxHelpPaneServer. Однако вы когда в последний раз использовали моникеры? И я давным-давно... Поэтому нужно было найти альтернативный способ исполнения кода в сессии другого пользователя, забыв про все техники внедрения.
Если посмотреть на код RemotePotato0 или RemoteKrbRelay , то можно заметить использование недокументированных интерфейсов
ISpecialSystemProperties и IStandartActivator. Причем не сказать, что их использование довольно редкое. Их можно встретить в любой программе, которая позволяет стащить учётные данные (имеет переключатель -session). Сами по себе, они позволяют контролировать сессию, в которой создавать COM-объект. Ранее мы ловили от них только аутентификацию, но что мешает соединить использование этих интерфейсов с описанным в SeMishaPrivilege COM-классом IHxHelpPaneServer? Конечно же ничего!
И я написал небольшой POC, который выложил на GitHub . Если вам интересно подробно окунуться в принцип работы инструмента, то советую обратить внимание на нашу статью на medium :)16 326
⚙️ Remote Session Enumeration
The blog post explores how to enumerate remote user sessions on Windows using undocumented Windows APIs, specifically focusing on the implementation and usage of the WinStation API.
🔗 Research:
https://0xv1n.github.io/posts/sessionenumeration/
🔗 Source:
https://github.com/0xv1n/RemoteSessionEnum/blob/main/main.cpp
#windows #qwinsta #session #winapi #cpp
16 326
😈 dirDevil: Hiding Code and Content Within Folder Structures
This article describes a method for hiding data within directory structures by using GUIDs in folder names to encode information. This approach bypasses antivirus and DLP systems since the data is stored in folder names rather than files, making it difficult to detect and analyze.
🔗 Research:
https://trustedsec.com/blog/dirdevil-hiding-code-and-content-within-folder-structures
🔗 Source:
https://github.com/nyxgeek/dirdevil
#hide #code #folder #evasion
16 326
🖥 Windows KASLR bypass using prefetch side-channel
A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11. Inspired by EntryBleed for Linux. This tool was developed as part of an exploit targetting Windows 11 24H2.
CPU Support:
— Intel: Reliable ✅
— AMD: Flaky ⚠️
🔗 Research:
https://exploits.forsale/24h2-nt-exploit/
🔗 Source:
https://github.com/exploits-forsale/prefetch-tool
#windows11 #aslr #kaslr #research
16 326
🕷 ADSpider
Tool for monitor Active Directory changes in real time without getting all objects. Instead of this it use replication metadata and Update Sequence Number (USN) to filter current properties of objects.
🔗 Research:
https://habr.com/ru/companies/angarasecurity/articles/697938/
🔗 Source:
https://github.com/DrunkF0x/ADSpider
———
Наконец-то появилась на свет, а точнее в паблике, утилита ADSpider от моего горячо любимого @DrunkF0x. Ура-ура! 💃
#ad #windows #monitoring #tools
16 326
🖼️ Microsoft SharePoint Server 20219 — RCE
PoC for:
— CVE-2024-38094
— CVE-2024-38024
— CVE-2024-38023
🔗 Source:
https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC
#sharepoint #poc #rce #cve
16 326
Repost from SecuriXy.kz
🆕Все читали в новостях шумную новость про новый rockyou 2024🆕
https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/
Мы его скачали, немного отфильтровали, а теперь делимся с Вами результатами 😎
ZIP-архив в 45 гигов в распакованном виде выдаёт текстовый файл размером 155 ГБ.
При открытии с помощью
less будет уведомление, что он выглядит как бинарный файл. В нём по какой-то причине добавлено приличное количество мусора...
Вычистив его, получаем на выходе файл размером в 144 ГБ. Но даже в нём, достаточно бесполезных строк (Хотя если кому надо, можем выложить и его).
Отфильтровали ещё немного, оставив только строки без пробелов длиной от 8 до 40 символов и вуаля - 25 гигабайт приемлемого вордлиста).
Пользуйтесь 🔥16 326
🔑 Dumping LSA: a story about task decorrelation
Discover the art of bypassing EDRs by decorrelating attack tool behavior. This post explains the process of remote LSA secrets dumping and reveals techniques to retrieve a Windows computer's BOOTKEY without EDR detection.
🔗 Source:
https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
#lsa #sam #dump #edr #bypass
