TGViewer
Channel Public Channel
APT

APT

@apt_notes

This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.me/APT_Notes/6

Chat Link:
t.me/APT_Notes_PublicChat
Open in Telegram
Subscribers
16.7K
Photos
565
Videos
28
Links
909

Showing posts older than #914 · Back to latest

Older Posts 20 shown
Post #913 2.86K
☁️ Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust

In this blog we will look at how this trust can be abused by an attacker that obtains Global Admin in Azure AD, to elevate their privileges to Domain Admin in environments that have the Cloud Kerberos Trust set up. Since this technique is a consequence of the design of this trust type, the blog will also highlight detection and prevention measures admins can implement.

https://dirkjanm.io/obtaining-domain-admin-from-azure-ad-via-cloud-kerberos-trust

#ad #azure #kerberos #research
dirkjanm.io Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust Many modern enterprises operate in a hybrid environment, where Active Directory is used together with Azure Active Directory. In most cases, identities will be synchronized from the on-premises Active Directory to Azure AD, and the on-premises AD remains…
  • 👍 3
Post #912 16.9K
🔥 VMware vRealize Network Insight — Pre-authenticated RCE (CVE-2023-20887)

This post will examine the exploitation process of CVE-2023-20887 in VMware Aria Operations for Networks (formerly known as vRealize Network Insight). This vulnerability comprises a chain of two issues leading to Remote Code Execution (RCE) that can be exploited by unauthenticated attackers.

Exploit:
https://github.com/sinsinology/CVE-2023-20887

Research:
https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/

#VMware #vRealize #rce #cve
  • 🔥 3
Post #911 2.07K

Forwarded from linkmeup

​Отлично! Теперь шелл можно и через SMS пропихнуть.
Пока безопасники бьются с DLP, настраивают политики и заливают порты эпоксидкой, просто отправь SMS на номер.TCPoverSMS, my ass.
https://github.com/persistent-security/SMShell
  • 👍 6
  • 🔥 2
  • ❤ 1
Post #910 2.48K
🦾 SharpTerminatator

Terminate AV/EDR Processes using kernel driver. SharpTerminatator is a C# port of ZeroMemoryEx's art piece called Terminator. It can be used with Cobalt Strike's execute-assembly or as a standalone executable.

https://github.com/mertdas/SharpTerminator

#av #edr #cobaltstrike #csharp
  • 🔥 3
Post #909 2.59K

Forwarded from Волосатый бублик

#ad #relay #webdav #ldap

[ DavRelayUp ] 
A  port of #KrbRelayUp with modifications to allow for NTLM relay from WebDAV to LDAP and abuse #RBCD in order achieve #LPE in domain-joined windows workstations where LDAP signing is not enforced.

Thanks to: Руслан

https://github.com/Dec0ne/DavRelayUp
  • ❤ 5
  • 🔥 1
Post #908 3.68K
🎯 GitLab CE/EE Path Traversal Vulnerability (CVE-2023-2825)

On May 23, 2023, GitLab released version 16.0.1, which addressed a critical vulnerability, CVE-2023-2825, impacting both the Community Edition (CE) and Enterprise Edition (EE) version 16.0.0. This vulnerability enables unauthenticated users to read arbitrary files by exploiting a path traversal bug. Additionally, an unauthenticated malicious user can leverage a path traversal vulnerability to read arbitrary files on the server if there is an attachment present in a public project nested within a minimum of five groups.

Shodan Dork:
application-77ee44de16d2f31b4ddfd214b60b6327fe48b92df7054b1fb928fd6d4439fc7e.css

Research:
https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/

PoC:
https://github.com/Occamsec/CVE-2023-2825

#gitlab #path #traversal #poc #cve
  • 👍 7
  • 🔥 2
Post #907 2.37K

Forwarded from Offensive Xwitter

😈 [ kleiton0x7e, Kleiton Kurti ]

We took a Cobalt Strike profile, modified it, and bypassed Crowdstrike & Sophos without encrypting the shellcode. Also bypassed all published YARA rules, sleep detections, and string detections around a CS beacon.

Blog: https://t.co/m7FNOwV6Nx

#CyberSecurity #redteam #infosec

🔗 https://whiteknightlabs.com/2023/05/23/unleashing-the-unseen-harnessing-the-power-of-cobalt-strike-profiles-for-edr-evasion/

🐥 [ tweet ]
  • 👍 7
Post #906 3.4K
🔀 Direct Syscalls vs Indirect Syscalls

This post discusses Indirect Syscalls as a solution to eliminate indicators of compromise and avoid detection by EDRs. Indirect Syscalls allow the execution of Syscall and Return statements in the memory of ntdll.dll, which is the usual behavior in Windows.

https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls

#maldev #syscall #edr #bypass
  • 🔥 8
  • 👍 3
Post #904 2.82K

Forwarded from 1N73LL1G3NC3

CVE-2023-32233 LPE

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

Once the PoC is started on a vulnerable system, it may leave that system in an unstable state with corrupted kernel memory. We strongly recommend to test the PoC on a dedicated system to avoid potential data corruptions.
  • 👍 12
Post #901 2.88K
🥶 Freeze

Freeze.rs is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealthy manner. Freeze.rs utilizes multiple techniques to not only remove Userland EDR hooks, but to also execute shellcode in such a way that it circumvents other endpoint monitoring controls.

Research:
https://www.optiv.com/insights/source-zero/blog/sacrificing-suspended-processes

Source:
https://github.com/optiv/Freeze.rs

#av #edr #etw #windows #maldev
  • 🔥 6
  • ❤ 1
Post #899 2.39K

Forwarded from Offensive Xwitter

😈 [ mpgn_x64, mpgn ]

The sponsor version of CrackMapExec just receive an update from @MJHallenbeck 🚀

▶️ cme is now using rich logging from @willmcgugan
▶️ a progress bar has been added 🚄🚃🚃
▶️ protocol ssh is now working with a key
▶️ cmedb now store creds found with ssh

@porchetta_ind 🪂

🐥 [ tweet ]
  • 👍 9
Post #898 2.08K

Forwarded from PT SWARM

Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707)

👤 by testanull

While analyzing CVE-2022-41082, also known as Proxy Not Shell, researcher discovered CVE-2023-21707 vulnerability which he has detailed in this blog.
The vulnerability allows a privileged user to trigger RCE during a deserialization of untrusted data.

📝 Contents:
● Introduction
● The new variant
● Payload delivery
● Demo
● References

https://starlabs.sg/blog/2023/04-microsoft-exchange-powershell-remoting-deserialization-leading-to-rce-cve-2023-21707/
  • 👍 10
Post #897 3.85K
🕸️ PowerShell Obfuscation Bible

A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion.

https://github.com/t3l3machus/PowerShell-Obfuscation-Bible

#powershell #obfuscation #redteam
GitHub GitHub - t3l3machus/PowerShell-Obfuscation-Bible: A collection of techniques, examples and a little bit of theory for manually… A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion, compiled for educational purposes. The contents of this repository...
  • 🔥 9
  • 👍 2
  • 👎 2
  • ❤ 1
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →