Name cannot be blank retweeted
That DIT is going to take forever to exfiltrate. Better to strip the hashes out and exfiltrate those instead.
github.com/Dionach/NtdsAudit
ntdsAudit.exe '.\Active Directory\ntds.dit' -s registry\SYSTEM -p pwddump.txt -u users.csv
Its c#, so you can reflectively load it in PS, too.
Name cannot be blank retweeted
I really enjoyed testing @C5pider's Havoc C2 framework. Wrote a little blogpost, on how to set it up & exploit a fully patched Win11 machine:
payload.cafe/2022/10/02/havo…
Video: youtu.be/pso2LAONCJ8
Name cannot be blank retweeted
If you run Kali in VirtualBox, you should prob be familiar with this command to fix clipboard sync: sudo pkill -fx "/usr/bin/VBoxClient --clipboard" && /usr/bin/VBoxClient --clipboard
Name cannot be blank retweeted
With a decade of experience I can tell there are great companies to work for and not. The great ones, allow you to grow, make mistakes, learn from them, be yourself, with all your handicaps, defects and your mastery skills, they care about you on individual level/human level
Name cannot be blank retweeted
"Tools such as PC Hunter (which grants access to system processes, kernel modes, and hooks), GMER (which detects and removes rootkits) and Revo Uninstaller (which can uninstall apps and programs) also terminate programs and antimalware solutions."
3/4
trendmicro.com/vinfo/us/secu…
Name cannot be blank retweeted
- Have you ever tried to create a phishing campaign using #Gophish?
- Have you ever tried to MiTM using #Evilginx2?
Go beyond that by creating a more sophisticated campaign by migrating Gophish and Evilginx2 under Apache proxy (AaRP)
Alice in PhishLand: lnkd.in/gAZ9kecS
Name cannot be blank retweeted
Want to disable the Security Event Log? Almost two years after my original research I finally had a moment to wrap it into a short video. Enjoy :) youtu.be/Wx7gIO71HBg
If you add CurrentControlSet\Control\MiniNt key, the Windows will think it is WinPE and will not log any event to the Security Log 😱
#hacked #windowsinternals #redteam
Name cannot be blank retweeted
Compare the “5 whys” of root cause analysis to a correlary of “5 hows” to avoid getting caught. Ask “how can this be detected,” enough times to figure out how to bypass that detection, and you’ll eventually land in a gray area that isn’t easily detectable.
An example 🧵
DCSync.
Name cannot be blank retweeted
Anyone can follow this, if not finding bugs.
Next 3 months plan for you #bugbounty
Thread
1/n
Name cannot be blank retweeted
🚨 I wrote a new tool! 🚨
This tool is designed to bypass WAFs by discovering the origin web server IP. I'm sure someone has come up with this technique before, but I haven't seen it...
This is how it works 🧵👇
Read crowdsource hacker @hakluke documenting Hakoriginfinder, a new tool for bypassing WAFs by discovering the origin host behind a reverse proxy. #WAF #DetectifyLabs labs.detectify.com/2022/05/0…
Name cannot be blank retweeted
🕵️🏽👀 @Mandiant details UNC3524, a group that is in my top three for sophistication and operational security.
By targeting blind spots and weak links, this TA has been able to persist in victim orgs for over 18 months. My takeaways in 🧵 #dfir
mandiant.com/resources/unc35…
Name cannot be blank retweeted
a quick mind map where I tried to group all previously shared Lsass cred access detection traces using Windows Logs (via sparce tweets)
github.com/sbousseaden/Slide…
Example of logs can be found here
github.com/sbousseaden/EVTX-…
Name cannot be blank retweeted
🧵Seems like there are some ways to bypass RITA beaconing detection in theory(or maybe many beaconing detections). Putting it into practice might be quite difficult(or easy for a C2 developer)
Here is how:
1. Set Sleep to 30 sec
2. Set Jitter to 4 seconds
1/2
#redteam
Name cannot be blank retweeted
Weaponizing vulnerable driver for privilege escalation— Gigabyte Edition! by @SpecialHoang link.medium.com/F5URaS5YTob
Name cannot be blank retweeted
It becomes more and more simpler to get an account on the domain without any prerequisite ! thanks to @BlWasp_ 💪
Add a computer using SMB protocol:
1⃣ Responder -I eth0 -rPvd
2⃣ ntlmrelayx --smb-add-computer FAKE -t <FQDN>
3⃣ crackmapexec -u fake$ -p ...
🔥🚀
My first PR on #Impacket. It is now possible to add a computer account via SMB from a NTLM Relay with ntlmrelayx.
Not easier than LDAPS to deal with the signature, but useful when no SSL certificate is in place on LDAPS
github.com/SecureAuthCorp/im…
#Windows #SMB #relay
Name cannot be blank retweeted
alternate but similar for domain initial access:
1.) unauth #PetitPotam against (unpatched) DC
2.) ntlmrelay it (with socks) to any SMB with no sign enforced (using #impacket)
3.) RID cycle through the socks using the relayed session: profit = userlist
4.) pw spray
[HackTip ⚒] If you're having troubles brute forcing Net-NTLMv2 captured with responder/mitm6, it may be time to spray some P@ssw0rds 💨 To get a list of domain users with no creds you can relay SMB auth to any domain host with signing OFF and go for RID cycling via #impacket ⬇️
Name cannot be blank retweeted
[HackTip ⚒] If you're having troubles brute forcing Net-NTLMv2 captured with responder/mitm6, it may be time to spray some P@ssw0rds 💨 To get a list of domain users with no creds you can relay SMB auth to any domain host with signing OFF and go for RID cycling via #impacket ⬇️