APT

👩‍💻 Anyone can Access Deleted and Private Repository Data on GitHub

You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way. Cross Fork Object Reference (CFOR) vulnerability occurs when one repository fork can access sensitive data from another fork (including data from private and deleted forks).

— Deleted Fork Data: Still accessible.
— Deleted Repo Data: Commits remain.
— Private Repo Data: Can become public.

🔗 Research:
https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github

#github #private #repo #cfor

😈 [ Print3M @Print3M_ ]

I wrote my first calc.exe "shellcode" in NASM. I find it a little strange that a lot of people write about malware development but almost no one talks about writing your own shellcode. I decided to write something on my own. (good comments, easy readable)

🔗 https://github.com/Print3M/shellcodes/blob/main/calc-exe.asm

🐥 [ tweet ]

#для_самых_маленьких

🛠 Adventures in Shellcode Obfuscation

This series of articles explores various methods for hiding shellcode, emphasizing techniques to avoid detection. The focus is on demonstrating diverse approaches to conceal shellcode.

🔗 Part 1: Overview
🔗 Part 2: Hail Caesar
🔗 Part 3: Encryption
🔗 Part 4: RC4 with a Twist
🔗 Part 5: Base64
🔗 Part 6: Two Array Method
🔗 Part 7: Flipping the Script
🔗 Part 8: Shellcode as IP Addresses
🔗 Part 9: Shellcode as UUIDs
🔗 Part 10: Shellcode as MAC Addresses
🔗 Part 11: Jargon
🔗 Part 12: Jigsaw
🔗 Part 13: Calculating Offsets
🔗 Part 14: Further Research

#shellcode #obfuscation #clang #maldev

How to fix the Crowdstrike thing:

1. Boot Windows into safe mode
2. Go to C:\Windows\System32\drivers\CrowdStrike
3. Delete C-00000291*.sys
4. Repeat for every host in your enterprise network including remote workers
5. If you're using BitLocker jump off a bridge

#meme

💻 Chrome Extension For Persistence

How to silently install any Chrome extension and avoid common indicators of compromise (IOCs). The method avoids using CLI parameters or registry edits, and persists via the Secure Preferences file

🔗 Source:
https://syntax-err0r.github.io/Silently_Install_Chrome_Extension.html

#chrome #persistence #maldev #c2

🖥 Introduction for to Windows kernel exploitation

Explore the Windows Kernel with HEVD, a vulnerable driver. Dive into stack overflow exploits and bypass SMEP/KPTI protections using the sysret approach.
A detailed guide for Windows kernel explotation:

— Part 0: Where do I start?
— Part 1: Will this driver ever crash?
— Part 2: Is there a way to bypass kASLR, SMEP and KVA Shadow?
— Part 3: Can we rop our way into triggering our shellcode?
— Part 4: How do we write a shellcode to elevate privileges and gracefully return to userland?

#windows #kernel #driver #hevd #hacksys

😎 Gigaproxy — One Proxy to Rule Them All

If you’re looking for a powerful tool to help you bypass Web Application Firewalls (WAFs) during external penetration tests and bug bounty programs, you’re in the right place. Gigaproxy tool is designed to rotate IPs using mitmproxy, AWS API Gateway, and Lambda. Fireprox is great but has one major downside. You can only target a single host at a time. Gigaproxy solves this.

🔗 Research:
https://www.sprocketsecurity.com/resources/gigaproxy

🔗 Source:
https://github.com/Sprocket-Security/gigaproxy

#ip #rotate #aws #api #gateway #proxy

💻 BIOS bootloader from scratch in ASM

Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode. From ASM basics to integrating with C, unravel the complexities step-by-step.

🔗 Research:
https://thasso.xyz/2024/07/13/setting-up-an-x86-cpu.html

🔗 Code:
https://github.com/thass0/blog-code/tree/main/2024-07-13-setting-up-an-x86-cpu

#bios #loader #asm #clang

Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection!

Давным-давно я писал о способе злоупотребления интерфейсом IHxHelpPaneServer. Однако вы когда в последний раз использовали моникеры? И я давным-давно... Поэтому нужно было найти альтернативный способ исполнения кода в сессии другого пользователя, забыв про все техники внедрения.

Если посмотреть на код RemotePotato0 или RemoteKrbRelay , то можно заметить использование недокументированных интерфейсов ISpecialSystemProperties и IStandartActivator. Причем не сказать, что их использование довольно редкое. Их можно встретить в любой программе, которая позволяет стащить учётные данные (имеет переключатель -session). Сами по себе, они позволяют контролировать сессию, в которой создавать COM-объект. Ранее мы ловили от них только аутентификацию, но что мешает соединить использование этих интерфейсов с описанным в SeMishaPrivilege COM-классом IHxHelpPaneServer? Конечно же ничего!

И я написал небольшой POC, который выложил на GitHub . Если вам интересно подробно окунуться в принцип работы инструмента, то советую обратить внимание на нашу статью на medium :)

⚙️ Remote Session Enumeration

The blog post explores how to enumerate remote user sessions on Windows using undocumented Windows APIs, specifically focusing on the implementation and usage of the WinStation API.

🔗 Research:
https://0xv1n.github.io/posts/sessionenumeration/

🔗 Source:
https://github.com/0xv1n/RemoteSessionEnum/blob/main/main.cpp

#windows #qwinsta #session #winapi #cpp

😈 dirDevil: Hiding Code and Content Within Folder Structures

This article describes a method for hiding data within directory structures by using GUIDs in folder names to encode information. This approach bypasses AV and DLP systems since the data is stored in folder names rather than files, making it difficult to detect and analyze.

🔗 Research:
https://trustedsec.com/blog/dirdevil-hiding-code-and-content-within-folder-structures

🔗 Source:
https://github.com/nyxgeek/dirdevil

#hide #code #folder #evasion

🖥 Windows KASLR bypass using prefetch side-channel

A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11. Inspired by EntryBleed for Linux. This tool was developed as part of an exploit targetting Windows 11 24H2.

CPU Support:
— Intel: Reliable ✅
— AMD: Flaky ⚠️

🔗 Research:
https://exploits.forsale/24h2-nt-exploit/

🔗 Source:
https://github.com/exploits-forsale/prefetch-tool

#windows11 #aslr #kaslr #research

🕷 ADSpider

Tool for monitor Active Directory changes in real time without getting all objects. Instead of this it use replication metadata and Update Sequence Number (USN) to filter current properties of objects.

🔗 Research:
https://habr.com/ru/companies/angarasecurity/articles/697938/

🔗 Source:
https://github.com/DrunkF0x/ADSpider

———
Наконец-то появилась на свет, а точнее в паблике, утилита ADSpider от моего горячо любимого @DrunkF0x. Ура-ура! 💃

#ad #windows #monitoring #tools

🖼️ Microsoft SharePoint Server 2019 — RCE

PoC for:
— CVE-2024-38094
— CVE-2024-38024
— CVE-2024-38023

🔗 Source:
https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC

#sharepoint #poc #rce #cve

🆕Все читали в новостях шумную новость про новый rockyou 2024🆕
https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/

Мы его скачали, немного отфильтровали, а теперь делимся с Вами результатами 😎

ZIP-архив в 45 гигов в распакованном виде выдаёт текстовый файл размером 155 ГБ.

При открытии с помощью less будет уведомление, что он выглядит как бинарный файл. В нём по какой-то причине добавлено приличное количество мусора...

Вычистив его, получаем на выходе файл размером в 144 ГБ. Но даже в нём, достаточно бесполезных строк (Хотя если кому надо, можем выложить и его).

Отфильтровали ещё немного, оставив только строки без пробелов длиной от 8 до 40 символов и вуаля - 25 гигабайт приемлемого вордлиста).

Пользуйтесь 🔥

🔑 Dumping LSA: a story about task decorrelation

Discover the art of bypassing EDRs by decorrelating attack tool behavior. This post explains the process of remote LSA secrets dumping and reveals techniques to retrieve a Windows computer's BOOTKEY without EDR detection.

🔗 Source:
https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/

#lsa #sam #dump #edr #bypass

💻 VMware vCenter Server — Remote Code Execution (CVE-2024-22274)

The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system as the "root" user.

🔗 Source:
https://github.com/mbadanoiu/CVE-2024-22274
https://github.com/l0n3m4n/CVE-2024-22274-RCE

#vmware #vcenter #rce #cve

💻 VMware vCenter Server — Multiple LPE (CVE-2024-37081)

The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.

🔗 Source:
https://github.com/mbadanoiu/CVE-2024-37081

#vmware #vcenter #lpe #cve