w0rk3r's Windows Hacking Library

Playing with Relayed Credentials https://www.coresecurity.com/blog/playing-relayed-credentials @WindowsHackingLibrary

Understanding how DLL Hijacking works https://astr0baby.wordpress.com/2018/09/08/understanding-how-dll-hijacking-works @WindowsHackingLibrary

windows-privesc-check - Standalone Executable to Check for Simple Privilege Escalation Vectors on Windows Systems https://github.com/pentestmonkey/windows-privesc-check @FromZer0toHero

Walk-through Mimikatz sekurlsa module https://jetsecurity.github.io/post/mimikatz/walk-through_sekurlsa @WindowsHackingLibrary

Red Teaming Microsoft: Part 1 – Active Directory Leaks via Azure https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure @WindowsHackingLibrary

Persistence using AdminSDHolder and SDProp https://blog.stealthbits.com/persistence-using-adminsdholder-and-sdprop @WindowsHackingLibrary

AppLocker Bypass - CMSTP https://pentestlab.blog/2018/05/10/applocker-bypass-cmstp @WindowsHackingLibrary

Invoke-AtomicTest - Automating MITRE ATT&CK with Atomic Red Team http://subt0x11.blogspot.com/2018/08/invoke-atomictest-automating-mitre-att.html @WindowsHackingLibrary

Having Fun with ActiveX Controls in Microsoft Word https://www.blackhillsinfosec.com/having-fun-with-activex-controls-in-microsoft-word @WindowsHackingLibrary

Bypassing Workflows Protection Mechanisms - Remote Code Execution on SharePoint https://www.nccgroup.trust/uk/our-research/technical-advisory-bypassing-workflows-protection-mechanisms-remote-code-execution-on-sharepoint @WindowsHackingLibrary

Microsoft.Workflow.Compiler.exe, Veil, and Cobalt Strike https://www.fortynorthsecurity.com/microsoft-workflow-compiler-exe-veil-and-cobalt-strike @WindowsHackingLibrary

Remote NTLM relaying through meterpreter on Windows port 445 https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445 @WindowsHackingLibrary

Task Scheduler ALPC exploit (unpatched) && PoC by SandboxEscaper https://github.com/SandboxEscaper/randomrepo/blob/master/PoC-LPE.rar @WindowsHackingLibrary

Privilege Escalation & Post-Exploitation Docs https://rmusser.net/docs/Privilege%20Escalation%20&%20Post-Exploitation.html @WindowsHackingLibrary

Clientside Exploitation - Tricks of the Trade 0x01 - Sharpshooter + SquibblyTwo https://0x00sec.org/t/clientside-exploitation-tricks-of-the-trade-0x01-sharpshooter-squibblytwo/8178 @WindowsHackingLibrary

whitelist_bypass_server This module is designed to be a platform to test an endpoints application whitelisting effectiveness by providing bypasses to solutions such as software restriction policies and applocker. https://github.com/rapid7/metasploit-framework/pull/8783 @WindowsHackingLibrary

Kerberoasting and SharpRoast output parsing! https://grumpy-sec.blogspot.com/2018/08/kerberoasting-and-sharproast-output.html @WindowsHackingLibrary

Operational Guidance for Offensive User DPAPI Abuse https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107 @WindowsHackingLibrary

CVE-2018-0952: Privilege Escalation Vulnerability in Windows Standard Collector Service https://www.atredis.com/blog/cve-2018-0952-privilege-escalation-vulnerability-in-windows-standard-collector-service @WindowsHackingLibrary

Top Five Ways I Got Domain Admin on Your Internal Network before Lunch (2018 Edition) https://medium.com/@adam.toscher/top-five-ways-i-got-domain-admin-on-your-internal-network-before-lunch-2018-edition-82259ab73aaa @WindowsHackingLibrary