WH @wh_lab
Showing posts older than #696 · Back to latest
Forwarded from Ralf Hacker Channel (Ralf Hacker)
1. GreatXML - Обход BitLocker через MS Defender. Unpatched
2. RoguePlanet - LPE через Race condition в MS Defender. Unpatched
3. MiniPlasma - LPE через драйвер cldflt.sys. Patched Jun, 9.
4. GreenPlasma - LPE через CTFMON (CVE-2026-45586) Patched Jun, 9.
5. YellowKey - Обход BitLocker через WinRE (CVE-2026-45585) Patched May, 19.
6. BlueHammer - LPE через компоненты MS Defender (CVE-2026-33825). Patched Apr, 19.
7. RedSun - LPE через MS Defender (TOCTOU + CfAPI). Patched May, 19.
8. UnDefend - Деактивация обновлений MS Defender (DoS). Patched May, 19.
LsaIso.exe)DumpGuard is a credential dumping and protocol research tool for modern Windows systems. It abuses the Remote Credential Guard protocol to recover credential material even when Credential Guard is enabled, and also includes a Microsoft v1 authentication package path for session-oriented NTLM extraction
Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. This project demonstrates various UAC bypass techniques and serves as an educational resource for understanding Windows security mechanisms.
Method 82 added
Existing methods tested against latest Windows 11 25H2 and their statuses are updated according to results
akagi32.exe [Method_Number] [Optional_Command]
akagi64.exe [Method_Number] [Optional_Command]
akagi32.exe 23
akagi64.exe 61
akagi32.exe 23 c:\windows\system32\calc.exe
akagi64.exe 61 c:\windows\system32\charmap.exe
High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision
Native Scan (vigolium scan): Fast, powerful, and flexible
Agentic Scan (vigolium agent): Thoroughly audits your codebase
On the 20th of May, the Drupal Security Team released SA-CORE-2026-004 (CVE-2026-9082), a Highly critical (20/25) SQL injection in Drupal core. The issue is reachable by fully anonymous users on any deployment that backs Drupal with PostgreSQL
Import-Module .\adPEAS.ps1
Invoke-adPEAS
Domain - поиск базовой информации о контроллерах домена, сайтов, трастов и стандартных парольных политиках
Rights - поиск различных прав, например LAPS, DCSync и т.д.
GPO - базовая информация о групповых политиках
ADCS - информация о центрах сертификации
Creds - ASREPRoast, Kerberoasting, GroupPolicies, Netlogon скрипты, LAPS, gMSA и т.д.
Delegation - поиск делегирования, например ограниченное делегирование, неограниченное делегирование и RBCD (Resource Based Constrained Delegation) для компьютеров и учетных записей
Accounts - информация об аккаунтах
Computer - AD DS, AD CS, Exchange серверы и т.д.
BloodHound - сборщик данных для BH
Invoke-adPEAS -Domain 'contoso.com' -Outputfile 'C:\temp\adPEAS_outputfile' -NoColor
Invoke-adPEAS -Domain 'contoso.com' -Server 'dc1.contoso.com'
$SecPassword = ConvertTo-SecureString 'Passw0rd1!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('contoso\johndoe', $SecPassword)
Invoke-adPEAS -Domain 'contoso.com' -Cred $Cred
Invoke-adPEAS -Module Domain
Invoke-adPEAS -Module Rights
Invoke-adPEAS -Module GPO
Invoke-adPEAS -Module ADCS
Invoke-adPEAS -Module Creds
Invoke-adPEAS -Module Delegation
Invoke-adPEAS -Module Accounts
Invoke-adPEAS -Module Computer
Invoke-adPEAS -Module Bloodhound -Scope All
