uz
Feedback
APT

APT

Kanalga Telegram’da o‘tish

This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat

Ko'proq ko'rsatish
Rossiya40 429Texnologiyalar & Aralashmalar7 782

📈 Telegram kanali APT analitikasi

APT (@apt_notes) Ingliz til segmentidagi kanali faol ishtirokchi. Hozirda hamjamiyat 16 236 obunachidan iborat bo'lib, Texnologiyalar & Aralashmalar toifasida 7 782-o'rinni va Rossiya mintaqasida 40 429-o'rinni egallagan.

📊 Auditoriya ko‘rsatkichlari va dinamika

невідомо sanasidan buyon loyiha tez o‘sib, 16 236 obunachiga ega bo‘ldi.

29 Avgust, 2026 dagi oxirgi ma’lumotlarga ko‘ra kanal barqaror faollikka ega. Oxirgi 30 kunda obunachilar soni 560 ga, so‘nggi 24 soatda esa 13 ga o‘zgardi va umumiy qamrov yuqori darajada qolmoqda.

  • Tasdiqlash holati: Tasdiqlanmagan
  • Jalb etish (ER): Auditoriya o‘rtacha 39.15% darajada jalb etiladi. Nashrdan keyingi dastlabki 24 soatda kontent odatda umumiy obunachilar sonining 18.08% ini tashkil etuvchi reaksiyalarni to‘playdi.
  • Post qamrovi: Har bir post o‘rtacha 6 354 marta ko‘riladi; birinchi sutkada odatda 2 934 ta ko‘rish yig‘iladi.
  • Reaksiyalar va o‘zaro ta’sir: Auditoriya faol: har bir postga o‘rtacha 26 ta reaksiya keladi.

📝 Tavsif va kontent siyosati

Muallif resursni shaxsiy fikrni ifoda etish maydoni sifatida ta’riflaydi:
“This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat”

Yuqori yangilanish chastotasi (oxirgi ma’lumot 30 Avgust, 2026 da olingan) sababli kanal doimo dolzarb va katta qamrovli bo‘lib qoladi. Analitika auditoriya kontent bilan faol hamkorlik qilishini, uni Texnologiyalar & Aralashmalar toifasidagi muhim ta’sir nuqtasiga aylantirishini ko‘rsatadi.

16 236
Obunachilar
+1324 soatlar
+1017 kunlar
+56030 kunlar
Postlar arxiv
APT
APT
16 234
👻 Ghost: Shellcode Loader Ghost is a shellcode loader project designed to bypass multiple detection capabilities that are us
👻 Ghost: Shellcode Loader Ghost is a shellcode loader project designed to bypass multiple detection capabilities that are usually implemented by an EDR. 🚀 Feature: — Bypassing kernel callbacks with fiber threads — Stack spoofing (Return Address Spoofing and Function Hooking) — Hiding shellcode within large, randomized memory regions — Disabling ETW — Removing EDR function hooks with suspended processes — Custom API hashing for resolving functions 🔗 Source: https://github.com/cpu0x00/Ghost #edr #shellcode #kernel #memory #evasion

APT
APT
16 234
Repost from 1N73LL1G3NC3
Exploit for Windows Kernel-Mode Driver Elevation of Privilege Flaw (CVE-2024-35250)

APT
APT
16 234
Repost from 1N73LL1G3NC3
CVE-2024-9465: Palo Alto Expedition Unauthenticated SQL Injection Firing up the SQLMAP tool, and supplying it the endpoint an
CVE-2024-9465: Palo Alto Expedition Unauthenticated SQL Injection Firing up the SQLMAP tool, and supplying it the endpoint and parameter to inject and table to dump, it successfully dumps the entire users table: 
python3 sqlmap.py -u "https://10.0.40.64/bin/configurations/parsers/Checkpoint/CHECKPOINT.php?action=im port&type=test&project=pandbRBAC&signatureid=1" -p signatureid -T users --dump
CVE-2024-5910: Expedition: Missing Authentication Leads to Admin Account Takeover for attackers with network access 
curl -k 'https://10.0.40.64/0S/startup/restore/restoreAdmin.php'
CVE-2024-9464: Palo Alto Expedition Authenticated Command Injection Exploit CVE-2024-9466: Cleartext Credentials in Logs 
/home/userSpace/devices/debug.txt
This world-readable file contained the raw request logs of the Expedition server when it exchanged cleartext credentials for API keys in the device integration process. The Expedition server only stores the API keys, and is not supposed to retain the cleartext credentials, but this log file showed all the credentials used in cleartext. This issue was reported and assigned CVE-2024-9466. Blog: https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/ Shodan dork: 
html:"Expedition Project"

APT
APT
16 234
Repost from 1N73LL1G3NC3
KrbRelay-SMBServer This krbrelay version acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP. Re
+1
KrbRelay-SMBServer This krbrelay version acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP.
Relaying SMB to HTTP (ADCS) with a modified version of krbrelay using DFSCoerce and PetitPotam - classic ESC8 attack with Kerberos, no DCOM involved ;)

APT
APT
16 234
Repost from haxx
📖 Тем временем в NetExec (nxc) подвезли поддержку протокола NFS. Из функций сейчас доступен энум файловых шар (права и файлы
📖 Тем временем в NetExec (nxc) подвезли поддержку протокола NFS. Из функций сейчас доступен энум файловых шар (права и файлы рекурсивно), погрузка и разгрузка файлов. Базовый энум 
NetExec nfs IP --shares
Рекурсивный энум 
NetExec nfs IP --enum-shares
Забираем файл 
NetExec nfs IP --get-file /home/user/Desktop/test/lolkekpohek.txt lolkekpohek.txt
Заливаем файл 
NetExec nfs IP --put-file lolkekpohek.txt /home/user/Desktop/
🔗 Где почитать подробнее: Энум https://www.netexec.wiki/nfs-protocol/enumeration Льем/качаем файлы https://www.netexec.wiki/nfs-protocol/download-and-upload-files Исходники https://github.com/Pennyw0rth/NetExec/tree/main/nxc/protocols/nfs

APT
APT
16 234
Repost from 1N73LL1G3NC3
CVE-2024-26808 Linux kernel Netfilter Use-After-Free leads to LPE CVE-2024-26808 is a use-after-free vulnerability within the
CVE-2024-26808 Linux kernel Netfilter Use-After-Free leads to LPE CVE-2024-26808 is a use-after-free vulnerability within the Linux Kernel Netfilter, a powerful framework integral to the Linux networking stack. Netfilter provides essential networking operations such as packet filtering, network address translation (NAT), and port forwarding. The flaw arises from improper handling of network packet processing, leading to the potential for unauthorized memory access. Writeup: https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2024-26808_cos/docs/exploit.md

APT
APT
16 234
Underconf Конференция получилась просто огонь! Полезные доклады, превосходные спикеры и невероятная атмосфера. Отдельный респ
Underconf Конференция получилась просто огонь! Полезные доклады, превосходные спикеры и невероятная атмосфера. Отдельный респект за ностальгическую игровую зону, которая вернула в прошлое, и трек Pentest AD. Особая благодарность ISTINA lounge за уют и потрясающие чаи ❤️ «12 мундштуков из 10!» Спасибо организаторам за крутой эвент! 🔥

APT
APT
16 234
🚀 Elevating Privileges in Windows via Activation Cache Poisoning A deep dive into CVE-2024-6769, which leverages two chained
🚀 Elevating Privileges in Windows via Activation Cache Poisoning A deep dive into CVE-2024-6769, which leverages two chained bugs to escalate privileges from medium to high integrity. The first stage involves remapping the root drive, followed by a DLL hijacking exploit. The second stage poisons the Activation Cache through the CSRSS process to gain full administrator access. 🔗 Research: https://www.coresecurity.com/core-labs/articles/cve-2024-6769-poisoning-activation-cache-elevate-medium-high-integrity 🔗 Source: https://github.com/fortra/CVE-2024-6769 #windows #privesc #dll #hijacking

APT
APT
16 234
Repost from PT SWARM
ATTACKING UNIX SYSTEMS VIA CUPS, PART I 👤 by Simone Margaritelli A remote unauthenticated attacker can silently replace exis
ATTACKING UNIX SYSTEMS VIA CUPS, PART I 👤 by Simone Margaritelli A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer). Entry Points • WAN / public internet: a remote attacker sends an UDP packet to port 631. No authentication whatsoever. • LAN: a local attacker can spoof zeroconf / mDNS / DNS-SD advertisements and achieve the same code path leading to RCE. RCE chain • Force the target machine to connect back to our malicious IPP server. • Return an IPP attribute string that will inject controlled PPD directives to the temporary file. • Wait for a print job to be sent to our fake printer for the PPD directives, and therefore the command, to be executed. 📝 Contents: ● Summary ● Intro ● What is cups-browsed? ● Stack Buffer Overflows and Race Conditions ● Back to found_cups_printer ● Internet Printing Protocol ● PostScript Printer Description ● The problematic child: foomatic-rip ● Remote Command Execution chain ● Personal Considerations ● One More Thing https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

APT
APT
16 234
🔐 Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation This article explains how atta
🔐 Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation This article explains how attackers use malware virtualization, custom virtual machines, code obfuscation, and polymorphic packers to evade detection by EDR systems, allowing Red Teams to remain undetected in secure environments. 🔗 Source: https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/ #edr #evasion #virtualization #obfuscation #redteam

APT
APT
16 234
💻 Microsoft Office NTLMv2 Disclosure (CVE-2024-38200) A new vulnerability related to capturing NTLMv2 hashes via Office URI schemes has been discovered. The http:// protocol can be used for attacks such as NTLM relay to a Domain Controller. Microsoft 365 and Office 2019 versions are vulnerable, as they open remote files without warnings, unlike earlier versions. The exploit involves using a 302 redirect and abusing GPO misconfigurations to capture NTLMv2 hashes over SMB and HTTP. 🔗 Source: https://github.com/passtheticket/CVE-2024-38200 #windows #office #ntlm #relay

APT
APT
16 234
Repost from Волосатый бублик
Yeehaw! In TrustedSec new blog post, CSO & VP of Consulting Services Martin Bos highlights some new command line interface (C
Yeehaw! In TrustedSec new blog post, CSO & VP of Consulting Services Martin Bos highlights some new command line interface (CLI) tools so you can navigate your workflow like a console cowboy 🤠 Read it now! https://trustedsec.com/blog/console-cowboys-navigating-the-modern-terminal-frontier Table of contents: 1. tldr 2. cheat 3. bat 4. lsd 5. Atuin 5. Delta 6. Fastfetch 7. bottom 8. zoxide 9. fd 10. ripgrep 11. Broot 12. fzf 13. gping 14. procs 15. HTTPie 16. dust 17. speedtest-cli 18. Putting it all together

APT
APT
16 234
📜 DGPOEdit Disconnected GPO Editor - A Group Policy Manager launcher to allow editing of domain GPOs from non-domain joined machines 🔗 Source: https://github.com/CCob/DGPOEdit #ad #windows #gpo #policy

APT
APT
16 234
Repost from RedTeam brazzers
Эксплуатация ядерных уязвимостей - довольно рискованное дело, особенно когда нет уверенности, что эксплойт отработает корректно. @hummelchen0 специально для нашего сообщества разобрал вопрос применения таких эксплойтов в статье (https://hummelchen.gitbook.io/linux_lpe) "Ядерные LPE в Linux на практике". В ней вы сможете узнать, как на своей системе протестировать ядерный сплойт для практически любого ядра Linux и автоматизировать такие проверки для самых популярных дистрибутивов.

APT
APT
16 234
🔑 Three-Headed Potato Dog: NTLM and Kerberos Coercion New research demonstrates how DCOM can coerce Windows systems to authe
🔑 Three-Headed Potato Dog: NTLM and Kerberos Coercion New research demonstrates how DCOM can coerce Windows systems to authenticate remotely, allowing attackers to relay NTLM or Kerberos authentication to AD CS over HTTP. This enables remote and cross-session authentication relay attacks, targeting both machine and user accounts. 🔗 Research: https://blog.compass-security.com/2024/09/three-headed-potato-dog/ 🔗 Source: https://github.com/sploutchy/impacket/blob/potato/examples/potato.py #ad #windows #dcom #relay #potato

APT
APT
16 234
Repost from Offensive Xwitter
😈 [ Aleem Ladha @LadhaAleem ] I've fully automated the lab used for @_leHACK_ Active Directory 2024 workshop done by @mpgn_x
😈 [ Aleem Ladha @LadhaAleem ] I've fully automated the lab used for @_leHACK_ Active Directory 2024 workshop done by @mpgn_x64 and it's available for everyone ! 🔥 Also big kudos to @M4yFly for the playbooks and NetExec dev teams for this awesome tool ! Hope you enjoy, more to come 🔗 https://github.com/Pennyw0rth/NetExec-Lab 🐥 [ tweet ]

APT
APT
16 234
🖥 Veeam Backup & Response — RCE (CVE-2024-40711) A critical deserialization vulnerability in .NET Remoting has been discovered in Veeam Backup & Replication, allowing unauthenticated remote code execution (RCE). The flaw affects versions 12.1.2.172 and earlier. 🔗 Research: https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/ 🔗 Source: https://github.com/watchtowrlabs/CVE-2024-40711 #veeam #backup #deserialization #unauth #rce

APT
APT
16 234
👻 Ghost in the PPL Part 3: LSASS Memory Dump In the third part of the series, the author explores methods for dumping the memory of LSASS, including indirectly calling MiniDumpWriteDump, loading arbitrary DLLs into LSASS via the WinSock2 Autodial feature, and dynamically resolving addresses. 🔗 Source: https://itm4n.github.io/ghost-in-the-ppl-part-3/ #lsa #lsass #ppl #dll #maldev

APT
APT
16 234
🍪 GlobalUnProtect PoC tool for decrypting and collecting GlobalProtect configuration, cookies, and HIP files from windows cl
🍪 GlobalUnProtect PoC tool for decrypting and collecting GlobalProtect configuration, cookies, and HIP files from windows client installations. 🔗 Research: https://rotarydrone.medium.com/decrypting-and-replaying-vpn-cookies-4a1d8fc7773e 🔗 Source: https://github.com/rotarydrone/GlobalUnProtect #paloalto #globalprotect #cookie #vpn

APT
APT
16 234
⚙️From COM Object Fundamentals To UAC Bypasses A 25-minute crash course covering Tokens, Privileges, UAC, COM, and ultimately bypassing UAC. 🔗Research: https://www.youtube.com/watch?v=481SI_HWlLs 🔗Source: https://github.com/tijme/conferences/tree/master/2024-09%20OrangeCon/code #windows #com #uac #bypass