Channel Public Channel

Alaid TechThread

@offensive_thread

Vulnerability discovery, threat intelligence, reverse engineering, AppSec

Open in Telegram

Subscribers: 1.14K
Photos: 7
Videos: 2
Links: 1.4K

Showing posts older than #1081 · Back to latest

Older Posts 20 shown

Post #1080 95 Jun 4, 2021, 19:33 UTC

Know Your Enemy: Exploiting the Dell BIOS Driver Vulnerability to Defend Against It

https://www.crowdstrike.com/blog/cve-2021-21551-learning-through-exploitation/

CrowdStrike.com CVE-2021-21551: Learning Through Exploitation | CrowdStrike Using CVE-2021-21551 as an example, learn how adversaries approach weaponizing vulnerabilities, and the technologies that work best to mitigate their tactics.

Post #1079 81 Jun 3, 2021, 07:35 UTC

Fuzzing exotic arch with AFL using ghidra emulator

https://airbus-cyber-security.com/fuzzing-exotic-arch-with-afl-using-ghidra-emulator/

Post #1078 102 May 23, 2021, 10:46 UTC

How to Exploit Active Directory ACL Attack Paths Through LDAP Relaying Attacks

https://www.praetorian.com/blog/how-to-exploit-active-directory-acl-attack-paths-through-ldap-relaying-attacks/

Praetorian How to Exploit Active Directory ACL Attack Paths Through LDAP Relaying Attacks Overview This article describes methods by which an attacker can induce a victim user into authenticating using the NT Lan Manager (NTLM) Authentication Protocol to an attacker-controlled “Intranet” site, even in instances where that site points to an external…

Post #1077 79 May 21, 2021, 21:01 UTC

An exploration of JSON interoperability vulnerabilities

https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interoperability-vulnerabilities

Post #1076 83 May 17, 2021, 15:43 UTC

Dumping Plaintext RDP credentials from svchost.exe

https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/

www.n00py.io Dumping Plaintext RDP credentials from svchost.exe Recently I was browsing Twitter and came across a very interesting tweet: A simple string search within the process memory for svchost.exe revealed the plaintext password that was used to connect to the system via RDP. After some testing, I was also able…

Post #1075 80 May 17, 2021, 14:30 UTC

Credential Dumping cheatsheet

https://dl.packetstormsecurity.net/papers/general/credential_dumping.pdf

Post #1074 64 May 17, 2021, 06:51 UTC

CVE-2021-31166: Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

https://github.com/0vercl0k/CVE-2021-31166

GitHub GitHub - 0vercl0k/CVE-2021-31166: Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. - 0vercl0k/CVE-2021-31166

Post #1073 83 May 11, 2021, 20:00 UTC

Domain Borrowing is a new method to hide your C2 traffic with CDN

https://github.com/Dliv3/DomainBorrowing

GitHub GitHub - Dliv3/DomainBorrowing: Domain Borrowing PoC Domain Borrowing PoC. Contribute to Dliv3/DomainBorrowing development by creating an account on GitHub.

Post #1072 70 May 10, 2021, 20:38 UTC

repo contains information about EDRs that can be useful during red team exercise.

https://github.com/Mr-Un1k0d3r/EDRs

GitHub GitHub - Mr-Un1k0d3r/EDRs Contribute to Mr-Un1k0d3r/EDRs development by creating an account on GitHub.

Post #1071 81 May 6, 2021, 17:43 UTC

Weird Ways to Run Unmanaged Code in .NET

https://blog.xpnsec.com/weird-ways-to-execute-dotnet

XPN Infosec Blog @_xpn_ - Weird Ways to Run Unmanaged Code in .NET Recently I've been looking at the .NET CLR internals and wanted to understand what further techniques may be available for executing unmanaged code from the managed runtime. This post contains a snipped of some of the weird techniques that I found.

Post #1070 77 May 4, 2021, 21:35 UTC

Remote Potato – From Domain User to Enterprise Admin

https://pentestlab.blog/2021/05/04/remote-potato-from-domain-user-to-enterprise-admin/

Penetration Testing Lab Remote Potato – From Domain User to Enterprise Admin NTLM Relaying is an well-known technique that was mainly used in security assessments in order to establish some sort of foothold on a server in the network or used for privilege escalation scenari…

Post #1069 82 Apr 23, 2021, 14:24 UTC

Analysis of Chromium issue 1196683, 1195777

https://iamelli0t.github.io/2021/04/20/Chromium-Issue-1196683-1195777.html

iamelli0t’s blog Analysis of Chromium issue 1196683, 1195777 On April 12, a code commit[1] in Chromium get people’s attention. This is a bugfix for some vulnerability in Chromium Javascript engine v8. At the same time, the regression test case regress-1196683.js for this bugfix was also submitted. Based on this regression…

Post #1068 71 Apr 23, 2021, 12:42 UTC

Building on the Shoulders of Giants: Combining TensorFlow and Rust

https://www.crowdstrike.com/blog/how-crowdstrike-combines-tensorflow-and-rust-for-performance/

crowdstrike.com How CrowdStrike Combines TensorFlow and Rust for Performance In this blog, we share our perspectives on combining Rust’s and TensorFlow's powerful capabilities to boost both memory performance and speed capability.

Post #1067 65 Apr 22, 2021, 16:44 UTC

Bypassing LSA Protection in Userland

https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland/

Post #1066 77 Apr 20, 2021, 10:24 UTC

Named Pipe Pass-the-Hash

https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/

s3cur3th1ssh1t.github.io Named Pipe Pass-the-Hash | S3cur3Th1sSh1t This post will cover a little project I did last week and is about Named pipe Impersonation in combination with Pass-the-Hash (PTH) to execute binaries as an...

Post #1065 98 Apr 15, 2021, 13:25 UTC

The project-memoria-detector tool aims to determine whether a target network device runs a specific embedded TCP/IP stack.

https://github.com/Forescout/project-memoria-detector

GitHub GitHub - Forescout/project-memoria-detector Contribute to Forescout/project-memoria-detector development by creating an account on GitHub.

Post #1064 85 Apr 13, 2021, 21:29 UTC

An excel-centric approach for managing the MITRE ATT&CK® tactics and techniques.

https://github.com/RealityNet/attack-coverage

GitHub GitHub - RealityNet/attack-coverage: an excel-centric approach for the MITRE ATT&CK® Tactics and Techniques an excel-centric approach for the MITRE ATT&CK® Tactics and Techniques - RealityNet/attack-coverage

Post #1063 92 Apr 9, 2021, 10:15 UTC

An experimentation and research platform to investigate the interaction of automated agents in an abstract simulated network environments.

https://github.com/microsoft/CyberBattleSim

GitHub GitHub - microsoft/CyberBattleSim: An experimentation and research platform to investigate the interaction of automated agents… An experimentation and research platform to investigate the interaction of automated agents in an abstract simulated network environments. - microsoft/CyberBattleSim

Post #1062 79 Apr 8, 2021, 08:07 UTC

Do You Really Know About LSA Protection (RunAsPPL)?

https://itm4n.github.io/lsass-runasppl/

itm4n’s blog Do You Really Know About LSA Protection (RunAsPPL)? When it comes to protecting against credentials theft on Windows, enabling LSA Protection (a.k.a. RunAsPPL) on LSASS may be considered as the very first recommendation to implement. But do you really know what a PPL is? In this post, I want to cover some…

Post #1061 88 Apr 1, 2021, 08:17 UTC

Update on campaign targeting security researchers

https://blog.google/threat-analysis-group/update-campaign-targeting-security-researchers/

Google Update on campaign targeting security researchers An update on a hacking campaign targeting security researchers.

Older posts →