uz
Feedback
APT

APT

Kanalga Telegram’da o‘tish

This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat

Ko'proq ko'rsatish
Rossiya40 343Texnologiyalar & Aralashmalar7 759

📈 Telegram kanali APT analitikasi

APT (@apt_notes) Ingliz til segmentidagi kanali faol ishtirokchi. Hozirda hamjamiyat 16 267 obunachidan iborat bo'lib, Texnologiyalar & Aralashmalar toifasida 7 759-o'rinni va Rossiya mintaqasida 40 343-o'rinni egallagan.

📊 Auditoriya ko‘rsatkichlari va dinamika

невідомо sanasidan buyon loyiha tez o‘sib, 16 267 obunachiga ega bo‘ldi.

31 Avgust, 2026 dagi oxirgi ma’lumotlarga ko‘ra kanal barqaror faollikka ega. Oxirgi 30 kunda obunachilar soni 546 ga, so‘nggi 24 soatda esa 11 ga o‘zgardi va umumiy qamrov yuqori darajada qolmoqda.

  • Tasdiqlash holati: Tasdiqlanmagan
  • Jalb etish (ER): Auditoriya o‘rtacha 40.49% darajada jalb etiladi. Nashrdan keyingi dastlabki 24 soatda kontent odatda umumiy obunachilar sonining 18.06% ini tashkil etuvchi reaksiyalarni to‘playdi.
  • Post qamrovi: Har bir post o‘rtacha 6 579 marta ko‘riladi; birinchi sutkada odatda 2 934 ta ko‘rish yig‘iladi.
  • Reaksiyalar va o‘zaro ta’sir: Auditoriya faol: har bir postga o‘rtacha 26 ta reaksiya keladi.

📝 Tavsif va kontent siyosati

Muallif resursni shaxsiy fikrni ifoda etish maydoni sifatida ta’riflaydi:
“This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat”

Yuqori yangilanish chastotasi (oxirgi ma’lumot 01 Sentabr, 2026 da olingan) sababli kanal doimo dolzarb va katta qamrovli bo‘lib qoladi. Analitika auditoriya kontent bilan faol hamkorlik qilishini, uni Texnologiyalar & Aralashmalar toifasidagi muhim ta’sir nuqtasiga aylantirishini ko‘rsatadi.

16 267
Obunachilar
+1124 soatlar
+927 kun
+54630 kun
Postlar arxiv
APT
APT
16 267
Repost from 1N73LL1G3NC3
Exposing hidden risks through ACLs in Active Directory The abuse of misconfigured Access Control Lists is nothing new. Howeve
Exposing hidden risks through ACLs in Active Directory The abuse of misconfigured Access Control Lists is nothing new. However, it is still one of the main ways of lateral movement and privilege escalation within an active directory domain.

APT
APT
16 267
☁️ Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust In this blog we will look at how this trust can be abused by an attacker that obtains Global Admin in Azure AD, to elevate their privileges to Domain Admin in environments that have the Cloud Kerberos Trust set up. Since this technique is a consequence of the design of this trust type, the blog will also highlight detection and prevention measures admins can implement. https://dirkjanm.io/obtaining-domain-admin-from-azure-ad-via-cloud-kerberos-trust #ad #azure #kerberos #research

APT
APT
16 267
🔥 VMware vRealize Network Insight — Pre-authenticated RCE (CVE-2023-20887) This post will examine the exploitation process of CVE-2023-20887 in VMware Aria Operations for Networks (formerly known as vRealize Network Insight). This vulnerability comprises a chain of two issues leading to Remote Code Execution (RCE) that can be exploited by unauthenticated attackers. Exploit: https://github.com/sinsinology/CVE-2023-20887 Research: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ #VMware #vRealize #rce #cve

APT
APT
16 267
Repost from linkmeup
​Отлично! Теперь шелл можно и через SMS пропихнуть. Пока безопасники бьются с DLP, настраивают политики и заливают порты эпоксидкой, просто отправь SMS на номер.TCPoverSMS, my ass. https://github.com/persistent-security/SMShell

APT
APT
16 267
🦾 SharpTerminatator Terminate AV/EDR Processes using kernel driver. SharpTerminatator is a C# port of ZeroMemoryEx's art pie
🦾 SharpTerminatator Terminate AV/EDR Processes using kernel driver. SharpTerminatator is a C# port of ZeroMemoryEx's art piece called Terminator. It can be used with Cobalt Strike's execute-assembly or as a standalone executable. https://github.com/mertdas/SharpTerminator #av #edr #cobaltstrike #csharp

APT
APT
16 267
Repost from Волосатый бублик
#ad #relay #webdav #ldap [ DavRelayUp ] A port of #KrbRelayUp with modifications to allow for NTLM relay from WebDAV to LDAP
#ad #relay #webdav #ldap [ DavRelayUp ] 
A  port of #KrbRelayUp with modifications to allow for NTLM relay from WebDAV to LDAP and abuse #RBCD in order achieve #LPE in domain-joined windows workstations where LDAP signing is not enforced.
Thanks to: Руслан https://github.com/Dec0ne/DavRelayUp

APT
APT
16 267
🎯 GitLab CE/EE Path Traversal Vulnerability (CVE-2023-2825) On May 23, 2023, GitLab released version 16.0.1, which addressed
🎯 GitLab CE/EE Path Traversal Vulnerability (CVE-2023-2825) On May 23, 2023, GitLab released version 16.0.1, which addressed a critical vulnerability, CVE-2023-2825, impacting both the Community Edition (CE) and Enterprise Edition (EE) version 16.0.0. This vulnerability enables unauthenticated users to read arbitrary files by exploiting a path traversal bug. Additionally, an unauthenticated malicious user can leverage a path traversal vulnerability to read arbitrary files on the server if there is an attachment present in a public project nested within a minimum of five groups. Shodan Dork: application-77ee44de16d2f31b4ddfd214b60b6327fe48b92df7054b1fb928fd6d4439fc7e.css Research: https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/ PoC: https://github.com/Occamsec/CVE-2023-2825 #gitlab #path #traversal #poc #cve

APT
APT
16 267
Repost from Offensive Xwitter
😈 [ kleiton0x7e, Kleiton Kurti ] We took a Cobalt Strike profile, modified it, and bypassed Crowdstrike & Sophos without encrypting the shellcode. Also bypassed all published YARA rules, sleep detections, and string detections around a CS beacon. Blog: https://t.co/m7FNOwV6Nx #CyberSecurity #redteam #infosec 🔗 https://whiteknightlabs.com/2023/05/23/unleashing-the-unseen-harnessing-the-power-of-cobalt-strike-profiles-for-edr-evasion/ 🐥 [ tweet ]

APT
APT
16 267
🔀 Direct Syscalls vs Indirect Syscalls This post discusses Indirect Syscalls as a solution to eliminate indicators of compro
🔀 Direct Syscalls vs Indirect Syscalls This post discusses Indirect Syscalls as a solution to eliminate indicators of compromise and avoid detection by EDRs. Indirect Syscalls allow the execution of Syscall and Return statements in the memory of ntdll.dll, which is the usual behavior in Windows. https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls #maldev #syscall #edr #bypass

APT
APT
16 267
Repost from Ralf Hacker Channel
Для получения паролей пользователей SSH в открытом виде https://github.com/jm33-m0/SSH-Harvester #redteam #pentest #creds #gi
Для получения паролей пользователей SSH в открытом виде https://github.com/jm33-m0/SSH-Harvester #redteam #pentest #creds #git

APT
APT
16 267
Repost from 1N73LL1G3NC3
CVE-2023-32233 LPE In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. Once the PoC is started on a vulnerable system, it may leave that system in an unstable state with corrupted kernel memory. We strongly recommend to test the PoC on a dedicated system to avoid potential data corruptions.

APT
APT
16 267
Repost from Ralf Hacker Channel
Для дампа памяти процессов, защищённых PPL. Работает с Windows 11 25346.1001 (April 2023). https://github.com/gabriellandau/PPLFault #creds #git #soft

APT
APT
16 267
🕳 Resocks This is a reverse/back-connect SOCKS5 proxy tunnel that can be used to route traffic through a system that can't b
🕳 Resocks This is a reverse/back-connect SOCKS5 proxy tunnel that can be used to route traffic through a system that can't be directly accessed (e.g. due to NAT). The channel is secured by mutually trusted TLS with auto-generated certificates based on a connection key. Blog: https://blog.redteam-pentesting.de/2023/introducing-resocks/ Source: https://github.com/RedTeamPentesting/resocks #socks #proxy #tunnel #mtls

APT
APT
16 267
🥶 Freeze Freeze.rs is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealth
🥶 Freeze Freeze.rs is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealthy manner. Freeze.rs utilizes multiple techniques to not only remove Userland EDR hooks, but to also execute shellcode in such a way that it circumvents other endpoint monitoring controls. Research: https://www.optiv.com/insights/source-zero/blog/sacrificing-suspended-processes Source: https://github.com/optiv/Freeze.rs #av #edr #etw #windows #maldev

APT
APT
16 267
Repost from 1N73LL1G3NC3
ETWHash ETWHash is a C# POC that is able to extract NetNTLMv2 hashes of incoming authentications via SMB, by consuming ETW ev
ETWHash ETWHash is a C# POC that is able to extract NetNTLMv2 hashes of incoming authentications via SMB, by consuming ETW events from the Microsoft-Windows-SMBServer provider {D48CE617-33A2-4BC3-A5C7-11AA4F29619E} https://labs.nettitude.com/blog/etwhash-he-who-listens-shall-receive/

APT
APT
16 267
Repost from Offensive Xwitter
😈 [ mpgn_x64, mpgn ] The sponsor version of CrackMapExec just receive an update from @MJHallenbeck 🚀 ▶️ cme is now using ri
😈 [ mpgn_x64, mpgn ] The sponsor version of CrackMapExec just receive an update from @MJHallenbeck 🚀 ▶️ cme is now using rich logging from @willmcgugan ▶️ a progress bar has been added 🚄🚃🚃 ▶️ protocol ssh is now working with a key ▶️ cmedb now store creds found with ssh @porchetta_ind 🪂 🐥 [ tweet ]

APT
APT
16 267
Repost from PT SWARM
Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707) 👤 by testanull While analyzing CVE-20
Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707) 👤 by testanull While analyzing CVE-2022-41082, also known as Proxy Not Shell, researcher discovered CVE-2023-21707 vulnerability which he has detailed in this blog. The vulnerability allows a privileged user to trigger RCE during a deserialization of untrusted data. 📝 Contents: ● Introduction ● The new variant ● Payload delivery ● Demo ● References https://starlabs.sg/blog/2023/04-microsoft-exchange-powershell-remoting-deserialization-leading-to-rce-cve-2023-21707/

APT
APT
16 267
🕸️ PowerShell Obfuscation Bible A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion. https://github.com/t3l3machus/PowerShell-Obfuscation-Bible #powershell #obfuscation #redteam

APT
APT
16 267

APT
APT
16 267
Repost from Ralf Hacker Channel
В семействе картошек пополнение - GodPotato. Windows LPE: * Windows Server 2012 - Windows Server 2022 ; * Windows8 - Windows 11 https://github.com/BeichenDream/GodPotato #git #soft #lpe