KILLER CODE

https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption/blob/main/docs/RESEARCH.md#1-introduction-the-evolution-of-local-data-protection-in-chrome هنعمل info stealer انشاء الله يتخطي حماية chrome الجديدة ABE Credits: https://github.com/dk0m/ZeroCrumb

http://t.me/DARKSecTools JOIN 🪟

https://t.me/redteamfortress JOIN 🪟

Relay Your Heart Away: An OPSEC-Conscious Approach to 445 Takeover Smbtakeover, a technique to unbind/rebind port 445 without loading a driver, loading a module into LSASS, or rebooting the target machine. The goal is to ease exploitation of targeted NTLM relay primitives while operating over C2. GitHub: https://github.com/zyn3rgy/smbtakeover Demo: https://youtu.be/bCc622mtQKM Presentation: https://youtu.be/iBqOOkQGJEA

LeakedWallpaper Leak of any user's NetNTLM hash. Fixed in KB5040434 Blog: https://decoder.cloud/2024/08/02/the-fake-potato/

RedGuard RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.

bof-vs Visual-Studio-BOF-template Create your custom BOF with Visual Studio

File-Tunnel Tunnel TCP connections through a file. The program starts a TCP listener, and when a connection is received it writes the TCP data into a file. This same file is read by the counterpart program, which establishes a TCP connection and onforwards the TCP data. To avoid the shared file growing indefinitely, it is purged whenever it gets larger than 10 MB. Example 1 - Bypassing a firewall You'd like to connect from Host A to Host B, but a firewall is in the way. But both hosts have access to a shared folder. Host A:

ft.exe --tcp-listen 127.0.0.1:5000 --write "\\server\share\1.dat" --read "\\server\share\2.dat"

Host B:

ft.exe --read "\\server\share\1.dat" --tcp-connect 127.0.0.1:3389 --write "\\server\share\2.dat"

Now on Host A, configure the client to connect to: 127.0.0.1:5000 Example 2 - Tunnel TCP through RDP (similar to SSH tunnel) You'd like to connect to a remote service (eg. 192.168.1.50:8888), but only have access to Host B using RDP. Host A:

ft.exe --tcp-listen 127.0.0.1:5000 --write "C:\Temp\1.dat" --read "C:\Temp\2.dat"

Run an RDP client and ensure local drives are shared as shown here. Connect to Host B. Host B:

ft.exe --read "\\tsclient\c\Temp\1.dat" --tcp-connect 192.168.1.50:8888 --write "\\tsclient\c\Temp\2.dat"

Now on Host A, you can connect to 127.0.0.1:5000 and it will be forwarded to 192.168.1.50:8888

#DeadPotato is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the original #GodPotato source code by BeichenDream. https://github.com/lypd0/DeadPotato

LayeredSyscall Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR hooks in Windows. Blog: https://whiteknightlabs.com/2024/07/31/layeredsyscall-abusing-veh-to-bypass-edrs/

Sleepmask-BOF A simple Sleepmask BOF example

OSEP Unleashed. The advance of in-memory payload execution It is very common to bypass antivirus software during pentests. This can be time-consuming, which negatively affects the project results. However, there are a couple of cool tricks that will let you forget about AV on your host for a while, and one of them is running the payload in memory.

Creating a PDF Dropper by Injecting Malicious JavaScript into a PDF with a Cobalt Strike Payload PoC: https://github.com/0x6rss/pdfdropper

Thread Name-Calling Injection Remote shellcode injection technique, using Thread Name (a.k.a. Thread Description) The code to be injected is passed as a thread description to the target (with SetThreadDescription). Then, a function GetThreadDescription is called remotely on the target, via APC, causing the description buffer to be copied into the target’s working set. After making the buffer executable, it is run using another APC call. Details: https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/ Demo: https://www.youtube.com/watch?v=JjVSMin8kFU https://www.youtube.com/watch?v=8cSNgE3gZxY

EDR Telemetry Blocker Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination IP addresses are parsed based on the server name in TLS Client Hello packet and the provided blocked server name (or blocked string) list in the file. Blog: https://tierzerosecurity.co.nz/2024/07/23/edr-telemetry-blocker.html

TokenAssignor This tool tries to steal token from a specified process and execute a token assigned process. Most of methods require administrative privileges. Currently, 4 methods are implemented:

   • To execute a token assigned process with CreateProcessAsUser API, set -m option to 0;
   • When set -m option to 1, this tool tries to create a suspended process and update the primary token to a stolen token. This method cannot be used for changing Session ID due to kernel restriction;
   • If set -m option is set to 2, creates a new token assigned process with Secondary Logon Service;
   • If set -m option is set to 3, creates a new token assigned process with PPID spoofing method.

ADExplorerSnapshot-rs ADExplorerSnapshot Rust rewrite. Outputs a .tar.gz of BloodHound CE JSON files for ingestion.

🌩 Azurehound Queries Collection of BloodHound queries for Azure (100+ New Azure Queries for Bloodhound). Easily identify advanced privilege escalations in both EntraID and Azure. Cloud only queries

SSD ADVISORY – SONICWALL SMA100 STORED XSS TO RCE There are pre-auth stored XSS and post-auth remote command injection vulnerabilities in SonicWall SMA100. These vulnerabilities allow unauthenticated attackers to execute arbitrary command when an authenticated user is exposed to the stored XSS.