اکنون در دسترس! پژوهش تلگرام ۲۰۲۵ — مهمترین بینشهای سال 
APT
رفتن به کانال در Telegram
This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat
نمایش بیشتر📈 تحلیل کانال تلگرام APT
کانال APT (@apt_notes) در بخش زبانی انگلیسی بازیگری فعال است. در حال حاضر جامعه شامل 14 650 مشترک است و جایگاه 8 841 را در دسته فناوری و برنامهها و رتبه 45 663 را در منطقه روسيا دارد.
📊 شاخصهای مخاطب و پویایی
از زمان ایجاد در невідомо، پروژه رشد سریعی داشته و 14 650 مشترک جذب کرده است.
بر اساس آخرین دادهها در تاریخ 11 ژوئن, 2026، کانال فعالیت پایداری دارد. در ۳۰ روز گذشته تغییر اعضا برابر 406 و در ۲۴ ساعت گذشته برابر 16 بوده و همچنان دسترسی گستردهای حفظ شده است.
- وضعیت تأیید: تأیید نشده
- نرخ تعامل (ER): میانگین تعامل مخاطب 48.83% است و در ۲۴ ساعت نخست پس از انتشار، محتوا معمولاً N/A% واکنش نسبت به کل مشترکان کسب میکند.
- دسترسی پستها: هر پست به طور میانگین 7 154 بازدید دریافت میکند. در اولین روز معمولاً 0 بازدید جمعآوری میشود.
- واکنشها و تعامل: مخاطبان بهطور فعال حمایت میکنند؛ میانگین واکنش به هر پست 18 است.
📝 توضیح و سیاست محتوایی
نویسنده این فضا را محل بیان دیدگاههای شخصی توصیف میکند:
“This channel discusses:
— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc
Disclaimer:
t.me/APT_Notes/6
Chat Link:
t.me/APT_Notes_PublicChat”
به لطف بهروزرسانیهای پرتکرار (آخرین داده در تاریخ 12 ژوئن, 2026)، کانال همواره بهروز و دارای دسترسی بالاست. تحلیلها نشان میدهد مخاطبان بهطور فعال با محتوا تعامل دارند و آن را به نقطه اثرگذاری مهم در دسته فناوری و برنامهها تبدیل کردهاند.
14 650
مشترکین
+1624 ساعت
+1087 روز
+40630 روز
آرشیو پست ها
14 650
💻 BIOS bootloader from scratch in ASM
Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode. From ASM basics to integrating with C, unravel the complexities step-by-step.
🔗 Research:
https://thasso.xyz/2024/07/13/setting-up-an-x86-cpu.html
🔗 Code:
https://github.com/thass0/blog-code/tree/main/2024-07-13-setting-up-an-x86-cpu
#bios #loader #asm #clang
14 650
Repost from RedTeam brazzers
Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection!
Давным-давно я писал о способе злоупотребления интерфейсом IHxHelpPaneServer. Однако вы когда в последний раз использовали моникеры? И я давным-давно... Поэтому нужно было найти альтернативный способ исполнения кода в сессии другого пользователя, забыв про все техники внедрения.
Если посмотреть на код RemotePotato0 или RemoteKrbRelay , то можно заметить использование недокументированных интерфейсов
ISpecialSystemProperties и IStandartActivator. Причем не сказать, что их использование довольно редкое. Их можно встретить в любой программе, которая позволяет стащить учётные данные (имеет переключатель -session). Сами по себе, они позволяют контролировать сессию, в которой создавать COM-объект. Ранее мы ловили от них только аутентификацию, но что мешает соединить использование этих интерфейсов с описанным в SeMishaPrivilege COM-классом IHxHelpPaneServer? Конечно же ничего!
И я написал небольшой POC, который выложил на GitHub . Если вам интересно подробно окунуться в принцип работы инструмента, то советую обратить внимание на нашу статью на medium :)14 650
⚙️ Remote Session Enumeration
The blog post explores how to enumerate remote user sessions on Windows using undocumented Windows APIs, specifically focusing on the implementation and usage of the WinStation API.
🔗 Research:
https://0xv1n.github.io/posts/sessionenumeration/
🔗 Source:
https://github.com/0xv1n/RemoteSessionEnum/blob/main/main.cpp
#windows #qwinsta #session #winapi #cpp
14 650
😈 dirDevil: Hiding Code and Content Within Folder Structures
This article describes a method for hiding data within directory structures by using GUIDs in folder names to encode information. This approach bypasses antivirus and DLP systems since the data is stored in folder names rather than files, making it difficult to detect and analyze.
🔗 Research:
https://trustedsec.com/blog/dirdevil-hiding-code-and-content-within-folder-structures
🔗 Source:
https://github.com/nyxgeek/dirdevil
#hide #code #folder #evasion
14 650
🖥 Windows KASLR bypass using prefetch side-channel
A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11. Inspired by EntryBleed for Linux. This tool was developed as part of an exploit targetting Windows 11 24H2.
CPU Support:
— Intel: Reliable ✅
— AMD: Flaky ⚠️
🔗 Research:
https://exploits.forsale/24h2-nt-exploit/
🔗 Source:
https://github.com/exploits-forsale/prefetch-tool
#windows11 #aslr #kaslr #research
14 650
🕷 ADSpider
Tool for monitor Active Directory changes in real time without getting all objects. Instead of this it use replication metadata and Update Sequence Number (USN) to filter current properties of objects.
🔗 Research:
https://habr.com/ru/companies/angarasecurity/articles/697938/
🔗 Source:
https://github.com/DrunkF0x/ADSpider
———
Наконец-то появилась на свет, а точнее в паблике, утилита ADSpider от моего горячо любимого @DrunkF0x. Ура-ура! 💃
#ad #windows #monitoring #tools
14 650
🖼️ Microsoft SharePoint Server 20219 — RCE
PoC for:
— CVE-2024-38094
— CVE-2024-38024
— CVE-2024-38023
🔗 Source:
https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC
#sharepoint #poc #rce #cve
14 650
Repost from SecuriXy.kz
🆕Все читали в новостях шумную новость про новый rockyou 2024🆕
https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/
Мы его скачали, немного отфильтровали, а теперь делимся с Вами результатами 😎
ZIP-архив в 45 гигов в распакованном виде выдаёт текстовый файл размером 155 ГБ.
При открытии с помощью
less будет уведомление, что он выглядит как бинарный файл. В нём по какой-то причине добавлено приличное количество мусора...
Вычистив его, получаем на выходе файл размером в 144 ГБ. Но даже в нём, достаточно бесполезных строк (Хотя если кому надо, можем выложить и его).
Отфильтровали ещё немного, оставив только строки без пробелов длиной от 8 до 40 символов и вуаля - 25 гигабайт приемлемого вордлиста).
Пользуйтесь 🔥14 650
🔑 Dumping LSA: a story about task decorrelation
Discover the art of bypassing EDRs by decorrelating attack tool behavior. This post explains the process of remote LSA secrets dumping and reveals techniques to retrieve a Windows computer's BOOTKEY without EDR detection.
🔗 Source:
https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
#lsa #sam #dump #edr #bypass
14 650
💻 VMware vCenter Server — Remote Code Execution (CVE-2024-22274)
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system as the "root" user.
🔗 Source:
https://github.com/mbadanoiu/CVE-2024-22275
#vmware #vcenter #rce #cve
14 650
💻 VMware vCenter Server — Multiple LPE (CVE-2024-37081)
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
🔗 Source:
https://github.com/mbadanoiu/CVE-2024-37081
#vmware #vcenter #lpe #cve
14 650
Repost from Похек
RockYou2024
Архив весит 45 гб
Распакованный 156 гб
Загрузил на свой S3. Скорость не лучшая, но точно не отвалиться загрузка
https://s3.timeweb.cloud/fd51ce25-6f95e3f8-263a-4b13-92af-12bc265adb44/rockyou2024.zip
В процессе Google Drive и Яндекс Диск
14 650
🔑 RockYou2024: 10 billion passwords leaked in the largest compilation of all time
Researchers discovered what appears to be the largest password compilation with a staggering 9,948,575,739 unique plaintext password
🔗 Source:
https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/
🔗 Source archive:
https://fastupload.io/1824d409732f30be
#wordlist #rockyou #passwords
14 650
📄 Evading ETW Based Detections
In this post, Event Tracing for Windows (ETW) will be explored along with various evasion techniques used to evade detections based on this Windows event tracking and collection mechanism.
🔗 https://s4dbrd.com/evading-etw-based-detections/
#etw #bypass #windows
14 650
🤖 DojoLoader — Generic PE Loader for Prototyping Evasion Techniques
This is a versatile PE loader designed for prototyping evasion techniques. It supports downloading and executing encrypted shellcode, dynamic IAT hooking, and three Sleep obfuscation methods. Ideal for use with UDRL-less Beacon payloads from Cobalt Strike.
🔗 Blog Post:
https://www.naksyn.com/cobalt%20strike/2024/07/02/raising-beacons-without-UDRLs-teaching-how-to-sleep.html
🔗 Source:
https://github.com/naksyn/DojoLoader
#cobaltstrike #udrl #memory #evasion
14 650
🖼️ RegreSSHion — OpenSSH Unauthenticated RCE
The Qualys Threat Research Unit has discovered a Remote Unauthenticated Code Execution vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this vulnerability is CVE-2024-6387.
The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems.
🔗 Research:
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
🔗 PoC:
https://github.com/7etsuo/cve-2024-6387-poc
#openssh #glibc #rce #cve
14 650
🪞 Smoke and Mirrors — Driver Signatures Are Optional
ItsNotASecurityBoundary is an exploit that leverages False File Immutability assumptions in Windows Code Integrity (ci.dll) to trick it into accepting an improperly-signed security catalog containing fraudulent authentihashes. With attacker-controlled authentihashes loaded and trusted by CI, the kernel will load any driver of the attacker's choosing, even unsigned ones.
🔗 https://github.com/gabriellandau/ItsNotASecurityBoundary
#driver #signature #bypass #ffi #windows
14 650
Repost from PT SWARM
🔥 Our researcher Arseniy Sharoglazov has discovered two unauthenticated RCE vulnerabilities in Xerox WorkCentre!
Read more: https://swarm.ptsecurity.com/inside-xerox-workcentre-two-unauthenticated-rces/
14 650
Repost from Ralf Hacker Channel
CVE-2024-30088: Windows LPE
PATCHED: June 11, 2024
https://github.com/tykawaii98/CVE-2024-30088
P.S. Протестил на Win11, работает
#git #exploit #lpe #pentest #redteam
14 650
💻 TREVORproxy
This is a simple SOCKS proxy that helps avoid Smart Lockout by load-balancing your requests between multiple IP addresses. It accomplishes this with built-in Linux features -- no complex OpenVPN setups or strange firewall configurations.
There are two techniques that TREVORproxy can use to spread your requests across multiple IP addresses: an SSH Proxy and a Subnet Proxy.
— SSH Proxy
You give TREVORproxy some hosts that support SSH, and it sends your traffic through them, making sure to balance equally between all the hosts.
— Subnet Proxy
If you have access to a
/64 IPv6 subnet (Linode is perfect for this), TREVORproxy will load-balance your requests across eighteen quintillion (18,446,744,073,709,551,616) unique source addresses.
🔗 Source:
https://github.com/blacklanternsecurity/TREVORproxy
#ip #rotation #waf #bypass