TGViewer
Channel Public Channel
APT

APT

@apt_notes

This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.me/APT_Notes/6

Chat Link:
t.me/APT_Notes_PublicChat
Open in Telegram
Subscribers
16.8K
Photos
565
Videos
28
Links
909

Showing posts older than #622 · Back to latest

Older Posts 20 shown
Post #621 569
RefleXXion

RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array.

https://github.com/hlldz/RefleXXion

#edr #evasion #cpp #redteam
Post #620 581
Create a Hidden Account in Windows

A tool for creating hidden accounts using the registry.
In addition to adding hidden accounts, the tool also adds functions to check hidden accounts and delete hidden accounts, so that both the red team and the blue team can use this tool.

https://github.com/wgpsec/CreateHiddenAccount

#ad #windows #hidden #account
  • 👍 2
Post #619 565
CRLF OneLiner

A simple Bash one liner with aim to automate CRLF vulnerability scanning. This is an extremely helpful and practical One liner for Bug Hunters, which helps you find CRLF missconfiguration in every possible method. Simply replace the links in subdomains.txt with the URL you want to target. This will help you scan for CRLF vulnerability without the need of an external tool. What you have to do is to copy-and-paste the commands into your terminal and finger crossed for any possible CRLF.

Bash OneLiner:
input='CRLF-one-liner/subdomains.txt';while IFS= read -r targets; do cat CRLF-one-liner/crlf_payloads.txt |xargs -I % sh -c "curl -vs --max-time 9 $targets/% 2>&1 |grep -q '< Set-Cookie: ?crlf'&& echo $targets '[+] is vulnerable with payload: '%>>crlf_results.txt||echo '[-] Not vulnerable: '$targets";done<$input

crlf_payloads.txt:
https://raw.githubusercontent.com/kleiton0x00/CRLF-one-liner/master/crlf_payloads.txt

#crlf #bash #oneliner #bugbounty
  • 👍 1
Post #615 1.18K
Finding Sensitive Files for BugBounty

— /proc/self/cwd/index.php
— /proc/self/cwd/main.py
— /etc/motd
— /proc/net/udp
— /proc/net/arp
— /proc/self/environ
— /var/run/secrets/kubernetes.io/serviceaccount
— /proc/cmdline
— /proc/mounts
— /etc/motd
— /etc/mysql/my.cnf
— /proc/sched_debug
— /home/ user/.bash_history
— /home/user/.ssh/id_rsa

#sensitive #files #bugbounty #bugbountytips
  • 👍 1
Post #614 659
aesKrbKeyGen

Script to calculate Active Directory Kerberos keys (AES256 and AES128) for an account, using its plaintext password. Either of the resulting keys can be utilized with Impacket's getTGT.py to obtain a TGT for the account, provided it is configured to support AES encryption.

https://github.com/Tw1sm/AesKrbKeyGen

#ad #kerbeos #tgt #tools
GitHub GitHub - Tw1sm/aesKrbKeyGen: Generate AES128/256 Kerberos keys for an AD account using a plaintext password and Python3 Generate AES128/256 Kerberos keys for an AD account using a plaintext password and Python3 - Tw1sm/aesKrbKeyGen
Post #613 698
Process Ghosting

This article describes a new executable image tampering attack similar to, but distinct from, Doppelgänging and Herpaderping. With this technique, an attacker can write a piece of malware to disk in such a way that it’s difficult to scan or delete it — and where it then executes the deleted malware as though it were a regular file on disk. This technique does not involve code injection, process hollowing, or Transactional NTFS (TxF).

Research:
https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack

C# Code Snippet:
https://github.com/Wra7h/SharpGhosting

#edr #evasion #process #ghosting #csharp
  • 🔥 3
Post #606 509
Vergilius

A collection of Microsoft Windows kernel structures, unions and enumerations. Most of them are not officially documented and cannot be found in Windows Driver Kit (WDK) headers. The target audience of this site is driver developers and kernel researches

https://www.vergiliusproject.com/

#windows #driver #kernel
Post #605 527
Ares

This project is a PoC loader written in C/C++ based on the Transacted Hollowing technique. It features:

— PPID spoofing
— Dynamic function resolution with API hashing
— NTDLL unhooking
— AES256 CBC Encryption
— CIG to block non-Microsoft-signed binaries

https://github.com/Cerbersec/Ares

#edr #evasion #cpp
GitHub GitHub - Cerbersec/Ares: Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique - Cerbersec/Ares
  • 👍 1
Post #603 525
Network Access Control (NAC) Bypass

This post will be all about Network Access Control (NAC) solutions and how they might lull you into a sense of security.

https://luemmelsec.github.io/I-got-99-problems-but-my-NAC-aint-one/

#nac #bypass #pentest
luemmelsec.github.io I got 99 problems but my NAC ain´t one This post will be all about Network Access Control (NAC) solutions and how they might lull you into a sense of security. Designed to keep rouge devices out of your network, I´ll show you ways around it, as well as ways to protect yourself. From a pentester´s…
Post #602 632
Active Directory ACL Visualizer and Explorer

adalanche tool gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and show misconfigurations.

https://github.com/lkarlslund/adalanche

#ad #acl #visualizer #blueteam #redteam
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →