APT

🚨 CVE-2025-55182 - Pre-auth RCE в React Server Components

Уязвимость в RSC (версии 19.0.0, 19.1.0, 19.1.1, 19.2.0) позволяет удаленное выполнение кода без аутентификации через небезопасную десериализацию payload’ов в Server Function endpoints.
Затронутые пакеты:

react-server-dom-parcel  
react-server-dom-turbopack  
react-server-dom-webpack

🚨 CVE-2025-66478 затрагивает Next.js начиная с 14.3.0-canary.77, все ветки 15.x и 16.x до патчей.
Безопасные версии: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7.

🔬 PoC / инструменты:  
анализ и эксплойт  
сканер для выявления уязвимых инстансов  
PoC 1  
PoC 2  
Лаборатория для тестов
Nuclei templates:  
versions.yaml  
cve-2025-55182.yaml

Подготовил для вас подробное руководство по тестированию на проникновение Outlook Web Access (OWA). 😈

➡️ В статье я разобрал все основные атаки и уязвимости OWA. Собрал и структурировал самое полезное в одном месте.

➡️ Также материал идеально подойдет для тех, кто все еще путает между собой OWA, Outlook и MS Exchange :)

Даже если вы раньше не сталкивались с почтовыми сервисами Microsoft, после прочтения смело можете бежать проверять их на безопасность. 🥤

Ссылка на статью

💫 @pentestnotes | #pentest #OWA #Exchange

😈 [ codewhisperer84 @codewhisperer84 ]

Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.

🔗 https://github.com/trustedsec/Titanis/

🐥 [ tweet ]

🎯 SpearSpray

Advanced password spraying tool for Active Directory environments. Combines LDAP user enumeration with intelligent pattern-based password generation. Uses Kerberos pre-authentication and leverages user-specific data (pwdLastSet, displayName) to create personalized passwords per user.

🔗 Source:
https://github.com/sikumy/spearspray

#ad #password #spraying #kerberos #bloodhound

🛡CreateProcessAsPPL

This is a utility for running processes with Protected Process Light (PPL) protection, enabling bypass of EDR/AV solution defensive mechanisms. It leverages legitimate Windows clipup.exe functionality from System32 to create protected processes that can overwrite antivirus service executable files.

🔗 Source:
https://github.com/2x7EQ13/CreateProcessAsPPL

🔗 Research:
https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html

#av #edr #bypass #ppl

💻 GroupPolicyBackdoor

Инструмент пост эксплуатации для различных манипуляций с GPO. Написан на 😰 Python
Впервые представлена на DEFCON 33

Примеры:

#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'

Пример ini:

[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"

[MODULEFILTERS]
filters =
    [{
        "operator": "AND",
        "type": "Computer Name",
        "value": "ad01-srv1.corp.com"
    }]

GPO creation, deletion, backup and injections
Various injectable configurations, with, for each, customizable options (see list in the wiki)
Possibility to remove injected configurations from the target GPO
Possibility to revert the actions performed on client devices
GPO links manipulation
GPO enumeration / user privileges enumeration on GPOs

💻 Repo
📔 Docs

#gpo #redteam #windows

✈️ Whitehat Lab 💬Chat

👑 Our researcher has discovered LPE in VMWare Tools (CVE-2025-22230 & CVE-2025-22247) via VGAuth!

Write-up by the one who broke it: Sergey Bliznyuk

https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/

🖼️ SharePoint RCE — ToolShell (CVE‑2025‑53770)

Critical deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote code execution over the network. The exploit uses POST requests to /_layouts/15/ToolPane.aspx with HTTP Referer header /_layouts/SignOut.aspx to bypass authentication, then extracts MachineKey configuration to generate valid __VIEWSTATE payloads for arbitrary code execution via a single HTTP request.

🔗 Research:
https://research.eye.security/sharepoint-under-siege/

🔗 PoC:
https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501

🔗 Exploit:
https://github.com/soltanali0/CVE-2025-53770-Exploit

#ad #sharepoint #deserialization #toolshell #rce

🌐 101 Chrome Exploitation

Introductory course on browser exploitation — not just covering individual JIT bugs, but a comprehensive dive into browser architecture, security layers, and principles of building exploit chains. The author demonstrates how to turn memory corruption into working exploits by analyzing a functional 3-stage chain for Chrome 130.

🔗 Source:
https://opzero.ru/en/press/101-chrome-exploitation-part-0-preface/

#chrome #v8 #sandbox #redteam

🔑 Golden DMSA

Critical vulnerability in Windows Server 2025 allows attackers with KDS root key access to generate passwords for all dMSA/gMSA accounts forest-wide. New research reveals design flaw in ManagedPasswordId structure - only 1,024 possible combinations makes brute-force trivial.

🔗 Research:
https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/

🔗 Source:
https://github.com/Semperis/GoldenDMSA

#ad #windows #dmsa #kerberos #persistence

🔥 MS-RPC-Fuzzer

PowerShell-based fuzzer that automates MS-RPC vulnerability research by dynamically creating RPC clients and fuzzing procedures with random inputs. Visualizes results through Neo4j graphs to help researchers identify potentially vulnerable RPC services.

🔗 Research:
https://www.incendium.rocks/posts/Automating-MS-RPC-Vulnerability-Research/

🔗 Source:
https://github.com/warpnet/MS-RPC-Fuzzer

#rpc #fuzzing #windows #vulnerability #research

🐶 LudusHound

This is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via the Ludus framework for controlled testing. This tool can be used to replicate most AD objects and permissions or can be used to replicate a specific Attack Path.

🔗 Research:
https://specterops.io/blog/2025/07/14/ludushound-raising-bloodhound-attack-paths-to-life/

🔗 Source:
https://gitlab.com/badsectorlabs/ludus

#ad #bloodhound #ludus #replica

🩸 CitrixBleed 2 — Citrix NetScaler Memory Leak (CVE-2025-5777)

Critical memory leak vulnerability in Citrix NetScaler ADC/Gateway. Sending malformed POST request with login parameter without value causes server to return ~127 bytes of uninitialized stack memory, including session tokens, enabling MFA bypass and active session hijacking.

🔗 Research:
https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/

🔗 Source:
https://github.com/win3zz/CVE-2025-5777

#citrix #netscaler #memoryleak #exploit

🔀 LdrShuffle

Code execution/injection technique using _LDR_DATA_TABLE_ENTRY structure manipulation in PEB to redirect EntryPoint of loaded DLLs. Allows code execution without using classic APIs like CreateRemoteThread or QueueUserAPC.

🔗 Source:
https://github.com/RWXstoned/LdrShuffle

#windows #peb #dll #injection #evasion

🔍 NauthNRPC

A Python tool that introduces a new method for gathering domain information, including the enumeration of domain users. The tool leverages auth-level = 1 (No authentication) against the MS-NRPC (Netlogon) interface on domain controllers. All that's required is the domain controller's IP address, and the entire process can be completed without providing any credentials.

🔗 Research:
https://securelist.com/no-auth-domain-information-enumeration/112629/

🔗 Source:
https://github.com/sud0Ru/NauthNRPC

#ad #enum #netlogon #rpc

Успейте подать заявку на Pentest Award 2025 до 30 июня!

Это отраслевая награда для специалистов по тестированию на проникновение, которая проводится уже в третий раз. Основная задача премии — выделить лучших специалистов и показать их вклад в развитие российского пентеста.

Участие бесплатное, финалисты получат технику apple и максимальный почет сообщества этичных хакеров. Церемония награждения будет проходить 1 августа в Москве.

Заявка на премию — это рассказ о лучшем проекте в свободной форме. Не нужно раскрывать эксплоиты, любые шаги в цепочке эксплуатации могут быть полностью анонимны, а детали могут быть скрыты, важно отразить сам подход и идею.

Подать заявку и узнать больше информации можно на сайте — https://award.awillix.ru/

CVE-2025-33073: Reflective Kerberos Relay (LPE)

Blog: https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/

Patched: June 10, 2025

Интересная LPE с релеем на себя... Даже CVE есть)

#lpe #ad #relay #pentest #redteam

🔐 Bitrix CMS Ultimate Pentest Guide

A detailed guide on penetration testing for 1C-Bitrix CMS, one of the most popular content management systems in CIS countries. The guide covers authentication bypasses, XSS, SSRF, LFI, RCE exploits, WAF bypass methods, and vulnerabilities in third-party modules (especially Aspro).

🔗 Source:
https://pentestnotes.ru/notes/bitrix_pentest_full/

#1c #bitrix #web

😈 [ Toffy @toffyrak ]

I have just released my first tool: GPOHound 🚀

GPOHound is an offensive tool for dumping and analysing GPOs. It leverages BloodHound data and enriches it with insights extracted from the analysis.

Check it out here:
🔗 https://github.com/cogiceo/GPOHound

🐥 [ tweet ]