w0rk3r's Windows Hacking Library

The new OpenSecurityTraining2 site has been launched at http://ost2.fyi The public betas of refreshed classes on x86-64 assembly, x86-64 OS internals and coreboot are now open #security #hardware #reverse #dukeBarman

Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab @WindowsHackingLibrary

AD CS relay attack - Practical Guide https://www.exandroid.dev/2021/06/23/ad-cs-relay-attack-practical-guide @WindowsHackingLibrary

Certified Pre-Owned: Abusing Active Directory Certificate Services https://posts.specterops.io/certified-pre-owned-d95910965cd2 Paper: https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf @WindowsHackingLibrary

Bypassing Image Load Kernel Callbacks https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks @WindowsHackingLibrary

Hiding your syscalls https://passthehashbrowns.github.io/hiding-your-syscalls @WindowsHackingLibrary

Mimicking Evil Alex Manners at CyberconVI https://youtu.be/aaCp2dY5MpA @SecTalks

Attacking Active Directory: 0 to 0.9 https://zer1t0.gitlab.io/posts/attacking_ad @WindowsHackingLibrary

Reading Your Way Around UAC Part 1: https://www.tiraniddo.dev/2017/05/reading-your-way-around-uac-part-1.html Part 2: https://www.tiraniddo.dev/2017/05/reading-your-way-around-uac-part-2.html Part 3: https://www.tiraniddo.dev/2017/05/reading-your-way-around-uac-part-3.html @WindowsHackingLibrary

The Much Misunderstood SeRelabelPrivilege https://www.tiraniddo.dev/2021/06/the-much-misunderstood.html @WindowsHackingLibrary

Leveraging from PE parsing technique to write x86 shellcode https://mohamed-fakroud.gitbook.io/t3nb3w/shellcoding/leveraging-from-pe-parsing-technique-to-write-x86-shellcode @WindowsHackingLibrary

The Attack Path Management Manifesto https://posts.specterops.io/the-attack-path-management-manifesto-3a3b117f5e5 @WindowsHackingLibrary

Primer to DInvokes Injection API and a tale of token duplication and command-line spoofing on the cheap https://redteamer.tips/primer-to-dinvokes-injection-api-and-a-tale-of-token-duplication-and-command-line-spoofing-on-the-cheap @WindowsHackingLibrary

Dumping Stored Credentials with SeTrustedCredmanAccessPrivilege https://www.tiraniddo.dev/2021/05/dumping-stored-credentials-with.html @WindowsHackingLibrary

How to Exploit Active Directory ACL Attack Paths Through LDAP Relaying Attacks https://www.praetorian.com/blog/how-to-exploit-active-directory-acl-attack-paths-through-ldap-relaying-attacks @WindowsHackingLibrary

Malware researchers - Beware of GetProcAddress spoofing via manipulation of PE format in memory https://dennisbabkin.com/blog/?t=malware-researchers-beware-of-getprocaddress-spoofing @BlueTeamLibrary

Data Only Attack: Neutralizing EtwTi Provider https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider @WindowsHackingLibrary

Bypassing EDR real-time injection detection logic https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection Tool: https://github.com/xinbailu/DripLoader @WindowsHackingLibrary

Abusing Replication: Stealing AD FS Secrets Over the Network https://www.fireeye.com/blog/threat-research/2021/04/abusing-replication-stealing-adfs-secrets-over-the-network.html @WindowsHackingLibrary

Bypassing LSA Protection in Userland https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland Tool: https://github.com/itm4n/PPLdump @WindowsHackingLibrary