News

• Pixel Update Bulletin—April 2024 - "There are indications that the following may be under limited, targeted exploitation." Update those Pixels!
• The Incognito Mode Myth Has Fully Unraveled - Google settles a lawsuit about Incognito Mode by agreeing to delete "billions of data records" the company collected while users browsed the web using Incognito mode. This implies that the data was tagged as being collected while the browser was in incognito mode.
• Fighting cookie theft using device bound sessions - Cookie theft from Chrome based browsers could get more difficult on computers with a TPM.

Techniques and Write-ups

• EvilGophish's Approach to Advanced Bot Detection with Cloudflare Turnstile - Using commercial products designed to stop bots to protect phishing infrastructure from scanners and bots is clever. Why re-invent the wheel?
• Security research without ever leaving GitHub: From code scanning to CVE via Codespaces and private vulnerability reporting - You can do CodeQL scanning and even development in Codespaces all from your browser. The era of the centralized, time-share, computer is back! Mainframes got replaced with "the cloud" and web browsers are the new IBM 3270 terminals.
• Ghostwriter v4.1: The Custom Fields Update - The Ghostwriter documentation automation web-app just got a lot more customizable, as you can extend the data models easily in 4.1, and now any formatted text fields support Jinja2 templates!
• Getting Intune with Bugs and Tokens: A Journey Through EPM - 4 Specter Ops hackers looked into Microsoft Intune Endpoint Privilege Management (EPM) and found a privilege escalation vulnerability.
• Kobold Letters - Why HTML emails are a risk to your organization - You can use the kobold-letter class to hide text in an email until it is forwarded. A powerful primitive for phishing.
• Em Eye: Eavesdropping on Security Camera via Unintentional Rf Emissions - This is pretty incredible. Using just a software defined radio, amplifier, and antenna the researchers could recreate images from many cameras with decent fidelity at up to 5.5 meters away. Code is available at: EMEye_Tutorial.
• From HTTP to RCE. How to leave a backdoor in IIS - This one has to be translated to English but it's still a good write up on IIS webshells.
• Foreign Entra Workload Identities: A Security Boundary Risk? - This article explores an example of how Microsoft Entra workload identities can inadvertently extend the security boundary of a Entra tenant to a foreign tenant.
• SSHishing - Abusing Shortcut Files and the Windows SSH Client for Initial Access - Windows shortcut files can be used to allow targets to SSH to you (careful) which can aid in initial access or lateral movement objectives

Tools and Exploits

• Security Advisory YSA-2024-01 YubiKey Manager Privilege Escalation - "any browser windows opened by YubiKey Manager GUI may also be elevated with Administrator privileges depending on the browser in use. This issue can be used by an attacker to escalate local attacks and increase the impact of browser based attacks."
• Burp2API - Converting your Burp Suite projects into JSON APIs.
• nimfilt - A collection of modules and scripts to help with analyzing Nim binaries.
• Evilginx 3.3 - Go & Phish - Evilginx has an official integration with GoPhish!
• APK Downloader - APK downloader from few sources
• No-Consolation - A BOF that runs unmanaged PEs inline. Updated this week to automatically encrypt and store binaries in memory which allows multiple runs of the same binary without having to send it to target each time.
• interceptor - Sample Rust Hooking Engine.
• Aplos - Aplos an extremely simple fuzzer for Windows binaries.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• CVE-2024-28085 - WallEscape vulnerability in util-linux.
• VolWeb - A centralized and enhanced memory analysis platform.
• secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters and security researchers.
• kasld - Kernel Address Space Layout Derandomization (KASLD) - A collection of various techniques to infer the Linux kernel base virtual address as an unprivileged local user, for the purpose of bypassing Kernel Address Space Layout Randomization (KASLR).
• SignSaboteur - Burp Suite extension for editing, signing, verifying various signed web tokens
• Blauhaunt - A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
• Physsec Methodology A public, open source physical security methodology
• Microsoft-Extractor-Suite - A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
• Microsoft-Analyzer-Suite - A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
• ARL - Injecting a DLL into a process directly from memory rather than from disk

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• XZ Backdoor

  • Our (viral?!) breakdown thread - This thread took off on friday as it was posted pretty quickly after the news broke.
  • xzbot - notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094).
  • XZ backdoor infographic - A nice one page summary of the backdoor
  • More potential malicious commits from Jia Tan.

• [PDF] Court documents show Facebook owned VPN was using HTTPS interception to decrypt Snapchat, YouTube, and Amazon traffic - See the bottom of page 2 and top of page 3. At least they paid the VPN "users?" Remember, this from they "trust me" Zuck. Just as Meta was gaining reputation back with their open LLMs...

Techniques and Write-ups

• Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques - This got overshadowed by the xz backdoor but it's epic. A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different kernel targets once.

• Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu - More great Linux exploitation content.

• SCCM

  • SCCM Exploitation: Account Compromise Through Automatic Client Push & AD System Discovery - The SCCM train continues! A way to go from low priv user -> SCCM client push account and SCCM machine account. Great work Marshall!
  • SeeSeeYouExec: Windows Session Hijacking via CcmExec - A blog on how the CcmExec service can be utilized for session hijacking. Came with a tool drop: CcmPwn . A tool designed to facilitate this technique.
  • SCCM / MECM LAB - Part 0x1 - Recon and PXE - A walkthrough of the new SCCM lab in GOAD.

• In-the-Wild Windows LPE 0-days: Insights & Detection Strategies - Detection methods for Windows local privilege escalation techniques based on dynamic behaviors analysis. Not really 0-days since they're older vulns but still cool read.

• Structure-Aware linux kernel Fuzzing with libFuzzer - Enhancing Linux kernel fuzzing by integrating KCOV with libFuzzer, aiming to boot the kernel efficiently without a complex root filesystem setup.

• ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild - I thought AI was supposed to replace security, not add to it!

• Satori Threat Intelligence Alert: PROXYLIB and LumiApps Transform Mobile Devices into Proxy Nodes - Have you used residential proxies for your red teams yet? Threat actors are using them...

• Azure Redirect URI Takeover Vulnerability - A vulnerability in Azure's OAuth 2.0 flow where unregistered subdomains in application redirect URIs could be exploited by TAs to steal authorization codes and impersonate users.

• The Power of UI Automation - UI Automation provides a tree of UI automation elements representing various aspects of a user interface. Could be useful to automate certain testing or other tasks.

• Kerberos II - Credential Access Part two of the series.

• Improving port scans against API servers - Friendly reminder to explore new tools because you might end up liking them. Like replacing your ESXi host with Ludus 😜! This blog discusses some of the reasons they moved away from Nmap and into naabu (from the projectdiscovery team).

Tools and Exploits

• TeamsNTLMLeak - Leak NTLM via Website tab in teams via MS Office.
• Atexec-pro - Fileless atexec, no more need for port 445.
• SharpConflux - SharpConflux is a .NET application built to facilitate Confluence exploration. It allows Red Team operators to easily investigate Confluence instances with the goal of finding credential material and documentation relating to objectives without having to rely on SOCKS proxying. Here is the related blog.
• SQL-BOF - A library of beacon object files to interact with remote SQL servers and data.
• CspReconGo - It automates the extraction and analysis of domains from Content Security Policy (CSP) headers and JavaScript files on websites.
• CVE-2024-1086 - Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.
• CcmPwn - Lateral movement script that leverages the CcmExec service to remotely hijack user sessions.
• ChaiLdr - AV bypass while you sip your Chai!.
• curlrevshell - Kooky cURL-powered replacement for reverse shell via /dev/tcp.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Cookie dumper for Chrome and Edge - Dump cookies directly from Chrome process memory
• RustRedOps - 🦀 | RustRedOps is a repository dedicated to gathering and sharing advanced techniques and offensive malware for Red Team, with a specific focus on the Rust programming language.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• Unveiling malware behavior trends - Analyzing a Windows dataset of over 100,000 malicious files by Elastic Security Labs.
• Introducing STAR-FS The Bank of England announced the introduction of a new regulatory framework, STAR-FS, to support the financial sector in its cyber resilience operations.
• GoFetch - A new vulnerability baked into Apple's M-series of chips that allows attackers (and/or userspace applications) to extract secret keys from Macs. It looks like there are mitigation flags that can be set to mitigate this for sensitive cryptographic calls. Time will tell if they are effective/implemented.
• The US Department of Justice is suing Apple — read the full lawsuit here - Will this lead to a more open iOS? Maybe, but it will be years before anything (if anything) changes.

Techniques and Write-ups

• (Anti-)Anti-Rootkit Techniques - Part I: UnKovering mapped rootkits - Part I of a series, that will showcase various anti-rootkit techniques, known through anti-rootkits or anti-cheats, and their implementations in unKover.
• naively bypassing new memory scanning POCs - This blog focuses on in-memory evasion from both offensive and defensive angles, and introduces a simple but effective method to avoid detection by leveraging behaviors similar to legitimate JIT (Just-In-Time) compilation processes
• Poisoned Pipeline Execution Attacks: A Look at CI-CD Environments - This attack vector is 🔥. Internal red teams: Add supply chain to your existing red team roadmap if you haven't already.
• Identity Providers for RedTeamers - A look at popular cloud-based Identify Providers and their attack primitives. Awesome work by Adam Chester of (now) SpecterOps. Very practical to modern operations against SaaS/Remote friendly companies.
• Weaponizing Windows Thread Pool APIs: Proxying DLL Loads Using I/O Completion Callbacks - Proxying DLL loads using the Windows thread pool API with C++/assembly.
• CVE-2024-1212: Unauthenticated Command Injection - In Progress Kemp LoadMaster - Write-up on the Progress Kemp LoadMaster load balancer Unauthenticated command injection vulnerability. A bash script that calls a binary that runs shell commands with system, what could go wrong?
• NamespaceHound: protecting multi-tenant K8s clusters - Open-source tool for detecting the risk of potential namespace crossing violations and anonymous access opportunities in multi-tenant clusters. NamespaceHound is the tool.
• Kerberos I - Overview - Every attackers friend, kerberos. This start of a series on the topic.
• From Error to Entry: Cracking the Code of Password-Spraying Tools - An analysis of the current password spraying tooling and limitations in the error codes they handle. Good reminder for tool authors!
• Abusing the DHCP Administrators Group to Escalate Privileges in Windows Domains - DHCP Administrator to DA under certain conditions.
• Deactivating Cortex XDR via repair function - Without tamper protection its trivial to deactivate Cortex.
• SCCM / MECM LAB - Part 0x0 - An SCCM lab lands in the GOAD universe. A great resource, but you are locked into the rigid setup of GOAD.
• Using Tailscale for persistence - Some great traitorware!
• Read code like a pro with our weAudit VSCode extension - vscode-weaudit is the new VSCode extension from the code auditing pros at Trial of Bits.

Tools and Exploits

• WhoIsWho - Alternatives to the command whoami
• dropper- Project that generates Malicious Office Macro Enabled Dropper for DLL SideLoading and Embed it in Lnk file to bypass MOTW
• Perfect DLL Proxy - Perfect DLL Proxying using forwards with absolute paths. [I'm partial to Spartacus]
• Jigsaw - Hide shellcode by shuffling bytes into a random array and reconstruct at runtime
• IoDllProxyLoad - DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly
• OpenTIDE - Open Threat Informed Detection Engineering is the European Commission DIGIT.S2 (Security Operations) open source initiative to build a rich ecosystem of tooling and data supporting Cyber Threat Detections.
• HttpRemotingObjRefLeak - Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting CVE-2024-29059.
• Pwned by the Mail Carrier - Compromising exchange with some defensive guidance on adjusting ACEs to limit Exchange's AD permissions and establishing security boundaries for Tier Zero assets. Jonas is on a tear lately.
• Another Dll Proxying Tool - DLL proxying for lazy people
• nimvoke - Indirect syscalls + DInvoke made simple.
• ActionsCacheBlasting - Proof-of-concept code for research into GitHub Actions Cache poisoning.
• CVE-2023-36424 - Windows Kernel Pool (clfs.sys) Corruption Privilege Escalation.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• SO-CON 2024 - SO-CON 2024 presentations released. Videos coming soon!
• The Top 100+ Developer Tools 2023 - Looking for a research target inspiration? "This year we analyzed well over 12 million data points shared by you - the StackShare community - to bring you these rankings."
• Devika - Devika is an Agentic AI Software Engineer that can understand high-level human instructions, break them down into steps, research relevant information, and write code to achieve the given objective. Devika aims to be a competitive open-source alternative to Devin by Cognition AI.
• VoiceCraft: Zero-Shot Speech Editing and Text-to-Speech in the Wild - VoiceCraft is a token infilling neural codec language model, that achieves state-of-the-art performance on both speech editing and zero-shot text-to-speech (TTS) on in-the-wild data including audiobooks, internet videos, and podcasts. The model weights aren't out yet but should be by the end of the month. This is going to make vishing deadly.
• lumentis - AI powered one-click comprehensive docs from transcripts and text.
• Cobalt Strike Resources - Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection.
• bincapz - Enumerate binary capabilities, including malicious behaviors.
• Mutual TLS (mTLS) Go client - How to build an mTLS Go client that uses the Windows certificate store.
• Windows vs Linux Loader Architecture - Side-by-side comparison of the Windows and Linux (GNU) Loaders.
• Twikit - Simple API wrapper to interact with twitter's unofficial API. You can log in to Twitter using your account username, email address and password and use most features on Twitter, such as posting and retrieving tweets, liking and following users. Curious on how long this will last.
• tracecat - 😼 The AI-native, open source alternative to Tines / Splunk SOAR.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• Stay ahead of the game with the latest updates to the Microsoft 365 Developer Program - Changes in M365 Developer program. What used to be a free M365 developer subscription is now a pay walled service; it requires an active subscription to Visual Studio Enterprise.
• Nuclei v3.2 Release with Authenticated Scanning, Advanced Fuzzing & more - Authenticated scanning support is great. Nuclei is a great example of the power of open-source.
• Open Release of Grok-1 - This is the raw base model checkpoint from the Grok-1 pre-training phase, which concluded in October 2023. This means that the model is not fine-tuned for any specific application, such as dialogue. It's up to you to determine if this is a PR play as Grok isn't useful for much that other smaller open source models can't do.
• SVG Files Abused in Emerging Campaigns - How TAs are using SVGs for HTML smuggling.
• Tor's new WebTunnel bridges mimic HTTPS traffic to evade censorship - A new censorship resistant method to connect to the Tor network!
• Using socially responsible marketing to fund non-commercial open source security tools - I dig this and it's working since they are getting "free" marketing out of it right now.
• New course: "Windows Instrumentation with Frida" - @FuzzySec is a well know researcher who has put out great content and tools. Excited to dig into this offering.

Techniques and Write-ups

• Attacking Android - Blog post some common attack vectors if you're assessing Android environments.
• Summoning RAGnarok With Your Nemesis - A Nemesis powered Retrieval-Augmented Generation (RAG) chatbot.
• Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data - Write-up on vulnerabilities found during this research on ChatGPT ecosystem including 0-click attacks. Note these flaws are in the earlier "plugins" not the custom "GPTs" feature commonly seen today.
• 2024 Threat Detection Report - Red Canary's 2024 Threat Detection Report. Emphasis on "Detection". Take a look at their most commonly identify tools. If you're a red teamer using unmodified versions of those tools, consider yourself caught. Another interesting comment in this report: "Our new industry analysis showcases how adversaries reliably leverage the same small set of 10-20 techniques against organizations, regardless of their sector or industry.". Red teamers don't need a bunch of fancy techniques. Stick to a few OPSEC friendly/effective techniques and focus on your objectives.
• Discovering Deserialization Gadget Chains in Rubyland - Write-up that details the process and insights gained from creating a Ruby deserialization gadget chain from scratch, utilizing libraries such as action_view, active_record, dry-types, and eventmachine, to demonstrate deserialization exploitation in Ruby apps.
• Fortinet FortiWLM Deep-Dive, IOCs, and the Almost Story of the “Forti Forty” - Technical analysis of some recent patched and unpatched (sigh) Fortinet vulnerabilities. Of course there is unauthenticated RCE as root...
• Azure Deployment Scripts: Assuming User-Assigned Managed Identities - Over-permissioned deployment Scripts and User-Assigned Managed Identities enables privilege escalation.
• Tales from the cloud trenches: Using malicious AWS activity to spot phishing campaigns - How poor OPSEC by threat actors against AWS burned them. IoCs at the end for all defenders.
• LTair: The LTE Air Interface Tool - LTair, a tool that allows NCC Group to perform different attacks on the LTE Control Plane via the air interface. Niche assessment type. Looks neat but the tool isn't actually released yet?
• Patch Tuesday Diffing: CVE-2024-20696 - Windows Libarchive RCE - A nice post on patch diffing Windows DLLs.
• CVE-2024-25153: Remote Code Execution in Fortra FileCatalyst - String obfuscation will not save you from logic bugs like path traversal.
• [PDF] GhostRace: Exploiting and Mitigating Speculative Race Conditions - These speculative execution style bugs have seemingly no end.

Tools and Exploits

• BlueSpy - Proof of concept to record and replay audio from a bluetooth device without the legitimate user's awareness.
• Introducing AzurEnum - The latest Azure tool - Intended to give pentesters/red teamers a good idea of the main security issues of an azure tenant and its permission structure. The code is here.
• Gungnir - Gungnir is a command-line tool written in Go that continuously monitors certificate transparency (CT) logs for newly issued SSL/TLS certificates.
• SymProcAddress - Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids)
• anfs - Asynchronous NFSv3 client in pure Python
• Pixel_GPU_Exploit - Android 14 kernel exploit for Pixel7/8 Pro.
• GamingServiceEoP - Exploit for arbitrary folder move in GamingService component of Xbox. GamingService is not default service. If service is installed on system it allows low privilege users to escalate to system.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Mythic Community Overview - Mythic agent capability matrix. Cool project for those that develop their own agents for Mythic.
• localsend - An open-source cross-platform alternative to AirDrop
• FindMeAccess - Finding gaps in Azure/M365 MFA requirements for different resources, client ids, and user agents. The tool is mostly based off Spray365's auditing logic.
• PurpleLab - PurpleLab is an efficient and readily deployable lab solution, providing a swift setup for cybersecurity professionals to test detection rules, simulate logs, and undertake various security tasks, all accessible through a user-friendly web interface
• DetectDee - Hunt down social media accounts by username, email or phone across social networks.
• Moriarty - Moriarty is designed to enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows environments.
• Miaow - Project Miaow is a prove of concept to escalate privileges in Microsoft Azure using an ARM template deployment
• Payload Wizard - AI assistant that utilizes GPT language models to interpret and generate cybersecurity payloads 🪄. Github repo is here.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• Incognito Darknet Market Mass-Extorts Buyers, Sellers - Getting your darknet market shutdown is the worst thing that can happen right? What if the market operators then extort both the buyers and sellers? We'll see if this becomes the largest darknet market data dump ever on April 1st.
• Update on Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard - Russian actors are still all up in Microsoft, this time using "secrets of different types" to gain access to source code and "internal systems."
• Chinese National Residing in California Arrested for Theft of Artificial Intelligence-Related Trade Secrets from Google - Defendant allegedly pilfered technology from Google while secretly working for two PRC-based technology companies.

Techniques and Write-ups

• Say Friend and Enter: Digitally lockpicking an advanced smart lock (Part 2: discovered vulnerabilities) - Digital locks are vulnerable to a variety of attacks, but for most threat models a brick is a bigger threat than an exposed debug port.
• Fuzzer Development 3: Building Bochs, MMU, and File I/0 - Must read series if you are at all interested in fuzzers.
• YARP as a C2 Redirector - C2 redirectors via the YARP project. This was the solution built my microsoft for internal engineers to use as a reverse proxy. Potential option for your team to explore if you're migrating away from apache/nginx rewrite rules.
• MacOS Malware Dev - This article explores macOS malware development, covering the architecture, security features, and coding practices. Good read!
• Leaking NTLM Credentials Through Windows Themes - This was patched in January (CVE-2024-21320) but serves as a reminder that NTLM will continue to be a pain point until eliminated.
• Git-Rotate: Leveraging GitHub Actions for Password Spraying - Good way to burn your github account but this outside the box thinking is awesome.
• Power Query for Red Teamers: Unleashing the Potential of M Language and Macros - This blog post explores Power Query's potential for red teamers, emphasizing the M language for data manipulation and macros for actionable insights.
• Network tunneling with… QEMU? - Creative way of using QEMU for internal access.
• Smishing with EvilGophish - Using EvilGophish to send those pesky texts. I wonder how many red teams are actually simulating/emulating this attack vector.
• Browserless Entra Device Code Flow - Performing every step in Entra's OAuth 2.0 Device Code flow — including the user authentication steps — without a browser!
• Hijacking & Spoofing Context Menu Options - Hijacking SentinelOne's “Scan For Threats” context menu option and creating your own option for persistence.
• Unwelcome Guest: Abusing Azure Guest Access to Dump Users, Groups, and more - Friendly reminder of what guest access can do for your organization. Guest access enumeration and attack vectors have been around for quite some time.
• Event Tracing for Windows (ETW): Your Friendly Neighborhood IPC Mechanism - Using ETW as your C2 communication channel? Wicked. No PoC was released but does spark some discussions and thoughts on how lateral movement traffic should look like to avoid detection.
• Misconfiguration Manager: Overlooked and Overprivileged - :fire: The Specterops team is crushing it. This introduces an SCCM Attack matrix and standardizes SCCM attack naming.
• Building a AITM attack tool in Cloudflare Workers (174 LOC) - The research on MITM detection and attacks keeps ramping up. This gist (cloudflare-worker-proxy.js) contains the PoC. Very powerful attack.
• CVE-2024-21378 — Remote Code Execution in Microsoft Outlook - NetSPIs write-up on how they discovered CVE-2024-21378 which is an authenticated RCE vulnerability via synced form objects.
• NextChat: An AI Chatbot That Lets You Talk to Anyone You Want To - Unpatched SSRF details disclosed for ChatGPT-Next-Web . Seems like a popular open-source project for those wanting to get a chatGPT UI.
• WebAssembly Smuggling: It WASM't me - Take your HTML smuggling to the next level with web assembly. Now your smuggling can make the whitehouse happy since you can write it in Rust.

Tools and Exploits

• Parasite-Invoke - Hide your P/Invoke signatures through other people's signed assemblies
• ADeleginator - A companion tool that uses ADeleg to find insecure trustee and resource delegations in Active Directory
• Misconfiguration Manager - Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.
• yasha - Yet another security header analyzer.
• nemesis - Nemesis agent for Mythic.
• NimPlant v1.3 - "a lot of code refactoring and various enhancements."
• brew-lpe-via-periodic - Brew Local Privilege Escalation exploit on Intel macOS.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Are We Helping? Interesting perspective. Thought provoking notes about the current state of infosec.
• Freyja Purple Team Agent - Freyja is a Golang, Purple Team agent that compiles into Windows, Linux and macOS x64 executables.
• Introducing CloudGrappler: A Powerful Open-Source Threat Detection Tool for Cloud Environments - Potential framework for those smaller teams that need a solution to look for known evil in their cloud environments. The question is, where do you get those indicators while they're still relevant?
• gitlab-secrets - This tool analyzes a given Gitlab repository and searches for dangling or force-pushed commits containing potential secret or interesting information.
• dockerc - container image to single executable compiler.
• PoolParty - A set of fully-undetectable process injection techniques abusing Windows Thread Pools.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• Kali Linux 2024.1 Release - They fixed this crippling bug in dpkg. Ludus will ship with Kali 2024.1 in 1.2.1 (next release).
• Binary Ninja 4.0: Dorsai - The latest major update for the much loved reverse engineering tool.
• HP wants you to pay up to $36/month to rent a printer that it monitors - Buy a black and white laser printer and never give another dollar to HP.
• Merck settles with insurers who denied $700 million NotPetya claim - The "11th-hour" settlement leaves more questions, but it seems that Merck got some payout. New policies are sure to include language exempting "state-sponsored" attacks, which will make attribution a multi-million dollar business.
• Nevada AG Asks Court to Ban Meta from Providing End-to-End Encryption to Minors - First they come saying, "won't you think of the children," then...
• 2024-03-01 listening in on the neighborhood - The ShotSpotter/SoundThinking location database has been leaked. Why do you care? These government controlled microphones have been used to record conversations that were then used in a court case.

Techniques and Write-ups

• Scrutinizing the Scrutinizer - What's more fun than getting an unauthenticated root shell on a network monitoring appliance?
• Leaking ObjRefs to Exploit HTTP .NET Remoting - You've heard of PS remoting (aka WinRM) but what about .NET Remoting? Turns out it can provide remote code execution. Sad that Microsoft didn't assign a CVE or give code white any credit, despite clearly patching this issue based on their report.
• CVE-2023-42942: xpcroleaccountd Root Privilege Escalation - A nice privesc for macOS.
• Covert TLS n-day backdoors: SparkCockpit & SparkTar - Some actors used the Ivanti Pluse Secure exploits to lay down some pretty sophisiticated backdoors.
• Persistence - Visual Studio Code Extensions - VSCode is found on nearly every developer's machine. This post presents a few options for how to use it for persistence.
• [PDF] ComPromptMized: Unleashing Zero-click Worms that Target GenAI-Powered Applications - An interesting approach to targeting retrieval-augmented generation (RAG) systems.
• ADCS ESC14 Abuse Technique - While not technically a new technique, its promotion to ESC14 will give it new prominence.
• Weaponization of Token Theft - A Red Team Perspective - Token theft isn't new, but this is a nice summary of a few techniques to leverage it.
• Dumping LSASS Like it's 2019 - A theme of using "old and discarded" tooling to dump LSASS in 2024 against an EDR via Cobalt Strike BOFs.
• Extracting Sensitive Information from the Azure Batch Service - Azure Batch service can be fruitful depending on your permissions. Keep a look out for these! Defenders, restrict who has these permissions in your tenants.
• Meet Silver SAML: Golden SAML in the Cloud - "Any attacker that obtains the private key of an externally generated certificate can forge any SAML response they want and sign that response with the same private key that Entra ID holds. With this type of forged SAML response, the attacker can then access the application—as any user." Compromised cloud environment could get messy. This (for the moment) is likely a great option to Entra ID persistence.
• DUALITY: Advanced Red Team Persistence through Self-Reinfecting DLL Backdoors for Unyielding Control - A lot to digest on this one. It's a long read. It's an interesting concept as "pesky" persistence. I have concerns on how loud it could be during red team ops. Code here.
• SSRF в Microsoft Designer - SSRF in Microsoft Designer.
• A Trip Down Memory Lane - The frustration and walkthrough of this one stuck out. It really shows the thought process and frustrations of evading endpoint detection. And "...do your dev work on a VM with no internet access...". We agree! Use Ludus. The post drops a tool called ldrgen - Template-based generation of shellcode loaders.
• GTPDOOR - A novel backdoor tailored for covert access over the roaming exchange - Some very stealth APT has to be upset with this post. Great find and RE work!

Tools and Exploits

• RKS - A script to automate keystrokes through a graphical desktop program (evilrdp may be a better choice).
• SilverSamlForger - Silver SAML Forger is C# tool that helps you create custom SAML responses. It can be used to implement the Silver SAML attack.
• dnsx 1.2.0 - This release adds the -recon flag which could eliminate/augment other tools in your recon pipeline.
• MultCheck - Identifies bad bytes from static analysis with any Anti-Virus scanner.
• SharpLansweeperDecrypt - Automatically extract and decrypt all configured scanning credentials of a Lansweeper instance.
• mail-in-the-middle - Typo squating + mail = shells. See the Mail in the Middle post for more info.
• Nemesis-Download-Watcher - Watches the Downloads folder for any new files and inserts it into Nemesis for analysis.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• winhttp A library to make HTTP requests with the Windows winhttp API
• GoAWSConsoleSpray - Tool to spray AWS Console IAM Logins
• Devolutions Gateway - A blazing fast relay server adaptable to different protocols and desired levels of traffic inspection.
• [PDF] Android-Security-Research-Playbook.pdf - Darkwolf publishes their android research playbook

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• ConnectWise ScreenConnect Vulnerabilities - What is there to say about this except 🤦.

  • ConnectWise ScreenConnect: Authentication Bypass Deep Dive
  • Unauthenticated RCE exploit module for ConnectWise ScreenConnect (CVE-2024-1709)
  • A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass

• Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates - LockBit is now the third major ransomware takedown. Love to see it.

• New Leak Shows Business Side of China's APT Menace - This is about the i-SOON leak from last week (which has been removed from GitHub...). See also: Srsly Risky Biz: China's free market espionage machine and Unmasking I-Soon.

• Keep your phone number private with Signal usernames. "You will still need a phone number to register for Signal." SimpleX is still the winner when it comes to fully anonymous chat/audio/video calls.

• FTC hits Avast with $16.5 million fine over allegations of selling users' browsing data - "extremely detailed re-identifiable data". This is interesting coming from an endpoint security vendor who's business is consumer based.

• iMessage with PQ3: The new state of the art in quantum-secure messaging at scale - Apple continues to up its game with security. Do push notifications next please.

Techniques and Write-ups

• Cloud storage - never fails to surprise - Some truly horrific finds in the world of open bucket storage.
• “To live is to fight, to fight is to live! - IBM ODM Remote Code Execution - Java deserialization and JNDI Injection, classics.
• Multi-modal prompt injection image attacks against GPT-4V - Prompt injections come for images and soon, video.
• Pluralistic: How I got scammed (05 Feb 2024) - Don't ever get too cocky and thing it can't happen to you just because you work in security. Cory literally writes books on scams. At least it wasn't $50,000 in a shoe box.
• SCCM Hierarchy Takeover with High Availability - SCCM is the gift that keeps on giving.
• re: Zyxel VPN Series Pre-auth Remote Command Execution - At least this SSL VPN pre-auth RCE is "limited" to an "unusual configuration."
• Pivoting from Microsoft Cloud to On-Premise Machines - This is the opposite direction of the typical lateral movement path, but as everything goes "cloud-first" it may become the more common path.
• Initial Access Operations Part 1: The Windows Endpoint Defense Technology Landscape - Looking forward to this series. Initial access is certainly one of the fastest moving targets for the offsec community.
• Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns - Serverless infrastructure being used by TAs to deliver payloads? Ya don't say.... Great write-up by Talos. Appreciate the statistics on how often they're seeing this.
• AWS Ransomware - Moving ransomeware operations to cloud infrastructure. Let the cycle continue!
• Extending (and Detecting) PersistAssist: Act II - WMI event subscriptions are usually not as detected as more popular persistence mechanisms on Windows in my experience.
• Hello: I'm your ADCS server and I want to authenticate against you - A fresh potato drop (ADCSCoercePotato) and new coercion method. Mind the limitations, as DFSCoerce will likely be more applicable, but good to have options!
• Extracting PEAP Credentials from Wired Network Profiles - A deep dive into DPAPI and even some Ghidra reversing to extract wired PEAP credentials from Windows.

Tools and Exploits

• RepoReaper - RepoReaper is an automated tool crafted to meticulously scan and identify exposed .git repositories within specified domains and their subdomains.
• CVE-2023-7235: OpenVPN 2.x GUI privilege escalation possible if installed outside default installation path on Windows - Less commonly seen than "enterprise" VPNs, OpenVPN is still prevalent.
• CrimsonEDR - Simulate the behavior of AV/EDR for malware development training.
• brutespray - Bruteforcing from various scanner output - Automatically attempts default creds on found services.
• SpawnWith - An experimental Beacon Object File (BOF) that provides an alternative to the spawnas and inject commands.
• Bloodhound CE JSON Uploader - A small go tool to upload JSON files to the BloodHound community edition API.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• SploitScan - is a sophisticated cybersecurity utility designed to provide detailed information on vulnerabilities and associated proof-of-concept (PoC) exploits.
• greenmask - PostgreSQL dump and obfuscation tool.
• wddbfs - Mount a sqlite database as a filesystem.
• ADeleg - Active Directory delegation management tool
• Projected File System - Solid write up on the ProjFS provider which provides various types of data to access with I/O APIs.
• 365Inspect - A PowerShell script that automates the security assessment of Microsoft Office 365 environments.
• go-secdump - Tool to remotely dump secrets from the Windows registry
• SmuggleFuzz - A customizable and rapid HTTP downgrade smuggling scanner written in Go.
• AzureAssess - "...gain a comprehensive understanding of your Azure resources and their security configurations."
• Subdominator - "The Internets #1 Subdomain Takeover Tool"

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• Free Nginx - It seems the maintainer of nginx is forking. Limited details at announcing freenginx.org - This seems to have stemmed over F5/Nginx issuing CVEs for experiemental QUIC code and Maxim not liking that. Here is the advisory, you be the judge.
• Snap Trap: The Hidden Dangers Within Ubuntu's Package Suggestion System - "We've examined the command-not-found package that is installed by default in Ubuntu, which suggests packages to install for unrecognized commands. Our findings reveal that besides searching for apt packages, it also queries the Snap Store for snap packages. Given that any user can upload to the Snap Store, an attacker could potentially manipulate the command-not-found package to recommend their own malicious package. This blog discusses the suggestion mechanism, how an attacker might exploit it, the risks associated with installing a malicious snap package, and our discovery that an attacker could impersonate 26% of the commands from apt packages."
• [UNVERIFIED] someone just leaked a bunch of internal Chinese government documents on GitHub - This could be spicy. No code, but lots of docs.
• Backdoors that let cops decrypt messages violate human rights, EU court says - The "confidentiality of communications is an essential element of the right to respect for private life and correspondence," and requiring messages to be decrypted by law enforcement "cannot be regarded as necessary in a democratic society."
• CVE Crowd - Picks up where cvetrends left off (killed by twitter API limits). CVE trends uses the "fediverse" (mastodon) for its data.

Techniques and Write-ups

• Bypassing EDRs With EDR-Preloading - A nice technique to block EDR DLL loading. No good if your EDR is using a kernel driver however... Code here.
• ADCS ESC13 Abuse Technique - ADCS is now up to 13 different attack paths!

• Azure Devops Zero-Click CI/CD Vulnerability - Pipeline triggers confused Azure to think that the pipeline was run from the project and not a fork, allowing access to secrets.
• Fuzzer Development: Sandboxing Syscalls - The fuzzer/emulator being built in this blog is interesting and its fun to watch its progress. This installment is all about sandboxing the Bochs emulator to prevent it from accessing anything outside of its environment.
• Delegated NT DLL - "Like the WOW64 table, the NT delegate table provides a simple way to intercept a variety of callbacks in 32-bit mode without the need to overwrite code with inline hooking." Code here.
• Cross Window Forgery: A Web Attack Vector - I'd say this isn't a vulnerability but certianly a neat hack. Convincing a user to agree to a SSO prompt without them realizing it is classic social engineering. This paired with a phish could be an interesting intial access method to online services.
• Beyond Process And Object Callbacks: An Unconventional Method. A technical post on a previously undocumented method for creating callbacks without registering with the object manager in Windows.
• The Most Dangerous Entra Role You've (Probably) Never Heard Of - TLDR: "Entra ID has a built-in role called “Partner Tier2 Support” that enables escalation to Global Admin, but this role is hidden from view in the Azure portal GUI." I'm not a hacker, I'm an "unathorized remote partner tier2 support engineer."
• SmartScreen Vulnerability: CVE-2024-21412 Facts and Fixes - The post text is light on details, but it looks like an ms-application handler and then an SMB hosted LNK. See this YouTube Video.
• Hello Lucee! Let us hack Apple again? - The PD team find some critical vulnerabilities within Lucee, a CFML server, with RCE capabilities. Decent payout $$$.
• Exploiting Empire C2 Framework - RCE in Empire C2 framework <5.9.3!

Tools and Exploits

• Microsoft Exchange Server Elevation of Privilege Vulnerability - "An attacker who successfully exploited this vulnerability could relay a user's leaked Net-NTLMv2 hash against a vulnerable Exchange Server and authenticate as the user." Sounds like fun.
• Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation "Improper input validation in Zoom... may allow an unauthenticated user to conduct an escalation of privilege via network access." Via network access!?
• github-secrets - This tool analyzes a given Github repository and searches for dangling or force-pushed commits containing potential secret or interesting information. Check out the blog post: Hidden GitHub Commits and How to Reveal Them.
• CVE-2023-50387 - KeyTrap (DNSSEC) [DoS]. See: KeyTrap: Serious Vulnerability in the Internet Infrastructure.
• FullBypass - A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell.
• InflativeLoading - Dynamically convert a native EXE to PIC shellcode by appending a shellcode stub.
• CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability - PoC for the NTLM leak from last week. Another one.
• UAC-BOF-Bonanza - Collection of UAC Bypass Techniques Weaponized as BOFs.
• SDD1 and SSD2 - Self delete DLLs PoCs.
• Announcing MITRE Caldera™ v5! - Cool update! Purple teamers will appreciate this.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• NullSection - NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes.
• sessionless - TokenSigner is a Burp Suite extension for editing, signing, verifying various signed web tokens.
• Forgejo forks its own path forward - Forgejo was a soft-fork of Gitea, but is now a fully independent hard-fork.
• sicat - The useful exploit finder.
• A final Kubernetes census - Cool data analysis of exposed kubernetes nodes has come to an end.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• End Of General Availability of the free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518) - The end of free vSphere is a great chance to migrate to Proxmox and ludus makes it easy!
• Feds Want to Ban the World's Cutest Hacking Device. Experts Say It's a 'Scapegoat'. Canada has banned the Flipper Zero due to an increase in car thefts where there is no evidence a Flipper Zero was used. 🧐 Here is the tweet announcing it.
• After a tip, ExpressVPN acts swiftly to protect customers - ExpressVPN users could have experienced DNS leaks for the past 2 years. Ouch. "The bug was introduced in ExpressVPN Windows versions 12.23.1 - 12.72.0, published between May 19, 2022, and Feb. 7, 2024, and only affected those using the split tunneling feature."
• CVE-2024-23109 - Yes, Fortinet again. Patch ASAP...
• SEC Fines Firms $81M For Off-Channel Communications Lapses - "Sixteen firms are collectively on the hook for more than $81 million to settle SEC charges that they failed to preserve off-channel electronic communications." The SEC is not a fan of personal Signal chats!
• Ransomware Payments Exceed $1 Billion in 2023, Hitting Record High After 2022 Decline - Mo money mo problems. Some interesting analytics surrounding the crime groups and their profits.

Techniques and Write-ups

• Directory.ReadWrite.All Is Not As Powerful As You Might Think Some deep dive into MS Graph API. Guaranteed escalations to Global Admin from RoleManagement.ReadWrite.Directory and AppRoleAssignment.ReadWrite.All roles.
• New attack vectors in EKS - In the recent enhancement of AWS's managed Kubernetes service, EKS, including EKS Access Entries, Policies, and Pod Identity, potential security risks are introduced, explored in the second blog post of a series, emphasizing the need for least privilege and awareness of new attack vectors.
• Active Directory Enumeration for Red Teams - Some post-ex LDAP fun by MDSec. There are detection considerations towards the end as well. TD;DR - Blend in where possible or else you'll stick out like a sore thumb. Assuming the defense is looking!
• Conditional Love for AWS Metadata Enumeration - This came with a tool release. An AWS metadata enumeration tool by Daniel Grzelak of Plerion. Use it to enumerate resource tags, account IDs, and org IDs.
• Securing AI: Azure Machine Learning Studio - This post covers the deployment of Machine Learning Studio, the creation of a test training model, and then attacking the AI/ML training infrastructure to deploy persistence. With AI being the hot thing right now, it's nice to see someone shelling some AI tooling.
• [PDF] Insights into Commercial Surveillance Vendors - Google reports on commercial espionage. Interested read considering their role in society. "Of the 72 known in-the-wild 0-day exploits affecting Google products since mid-2014, TAG attributes 35 of these 0-days to Commercial Surveillance Vendors." That's a huge percentage!
• The Crow Flies at Midnight — Exploring Red Team Persistence via AWS Lex Chatbots - Use AWS Lex chatbot as a persistence method for your ops. The blog post details the steps to modify a Lex bot to exfiltrate credentials as well.
• Fake LastPass password manager spotted on Apple's App Store - Insert creds everywhere meme. Not sure how this gets by Apple but LastPass can't catch a break!
• Sudo On Windows a Quick Rundown - The blog post provides an overview of the newly introduced sudo command in Windows Insider Preview build 26052, highlighting its implementation using User Account Control (UAC), its configuration options, and potential security vulnerabilities, including the lack of proper access control on the RPC server, despite being written mostly in Rust for enhanced security.
• Tracking ShadowPad Infrastructure Via Non-Standard Certificates - Some common OPSEC mistakes. Lock down your C2! Use something like headscale if you must! This is another related article from this week.
• Para Bailar La Bambda: Contributing to Burp Suite's New Filtering Capabilities - A simple example of how to use Bamdas in your Burp Suite workflow.
• When is it generally safe to CreateRemoteThread? - Short answer: probably ok if you wait for the C runtime initialization to take place and the process doesn't do any "wierd stuff."
• Offensive Lab Environments (Without the Suck) - Labs are so hot right now!
• CVE-2024-20328 - ClamAV Not So Calm - Send email with a EICAR test string and properly named file, get shell?
• A Technical Deep Dive: Comparing Anti-Cheat Bypass and EDR Bypass - The anti-anti-cheat developers and the EDR bypassers share a lot in common.

Tools and Exploits

• ParentProcessValidator.cpp - This C++ code snippet demonstrates how to verify if an executable is launched by explorer.exe to enhance security during red team operations.
• EternelSuspention - a simple poc showcasing the ability of an admin to suspend EDR's protected processes.
• NidhoggScript - NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg. Nidhogg is an all-in-one simple to use rootkit.
• TPM-Sniffing - Retrieving Bitlocker keys from the TPM using SPI, I2C or LPC communications requires an understanding of the specific protocol supported by the TPM chip, as well as the device's make and model.
• conditional-love - An AWS metadata enumeration tool.
• gocheck - GoCheck a blazingly fast™ alternative to Matterpreter's DefenderCheck which identifies the exact bytes that Windows Defender AV by feeding byte slices to MpCmdRun.exe
• NTLM Relay Gat - NTLM Relay Gat is a powerful tool designed to automate the exploitation of NTLM relays using ntlmrelayx.py from the Impacket tool suite. By leveraging the capabilities of ntlmrelayx.py, NTLM Relay Gat streamlines the process of exploiting NTLM relay vulnerabilities, offering a range of functionalities from listing SMB shares to executing commands on MSSQL databases.
• Native Threadpool - Work, timer, and wait callback example using solely Native Windows APIs.
• LoLCerts - A repository of code signing certificates known to have been leaked or stolen, then abused by threat actors
• Living off the False Positive! - Living off the False Positive is an autogenerated collection of false positives sourced from some of the most popular rule sets. The information is categorized along with ATT&CK techniques, rule source, and data source. Entries include details from related rules along with their description and detection logic. See the blog post Introducing LoFP for more info.
• BadExclusionsNWBO - BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR. An evolution of BadExclusions.
• Remote-buffer-overflow-over-wifi_stack-in-wpa_supplicant-binary-in-android-11-platform-samsung-a20e - Remote buffer overflow over wifi_stack in wpa_supplicant binary in android 11, platform:samsung a20e, stock options so like works out of the box.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• awesome-tunneling - List of ngrok alternatives and other ngrok-like tunneling software and services. Focus on self-hosting.
• gftrace - A command line Windows API tracing tool for Golang binaries.
• AutomatedBadLab - Scripts to provision vulnerable and testing environments using AutomatedLab.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• AnyDesk Incident Response 2-2-2024 - An RMM company, AnyDesk, was breached. "Customers Urged to Reset Passwords." Is breaching the upstream RMM company the ultimate traitorware?
• Ivanti - We're up to four (4) CVEs. CISA is ordering everyone to disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure solution products from agency networks. Even Assetnote is getting in the action with a new authentication bypass. What a mess!
• Thanksgiving 2023 security incident - Threat actor utilized stolen credentials from the October 2023 Okta compromise to access Cloudflare's network. TLDR - Threat actors were in Cloudflare's internal wiki, bug database, and established persistent access to the Atlassian server but 2FA prevented most lateral movement. Cloudflare even returned the hardware that was connected to a console server the actors attempted but failed to gain access to. Now that is serious remediation!
• First look: Windows 11 is getting native macOS or Linux-like Sudo command - The Sudo, “superuser do,” command is coming to Windows 11 as part of the developer settings. Embrace, extend, and extinguish.
• Externalizing the Google Domain Tiers Concept - Google's Security Team has introduced the concept of Domain Tiers to categorize approximately 10,000 domains based on sensitivity, helping prioritize security efforts. The tiering system, with five levels (Tier 0 being the highest sensitivity), aids in identifying potential vulnerabilities and influences Google Vulnerability Reward payouts. This is really dope!
• Hundreds of network operators' credentials found circulating in the Dark Web - An attacker named 'Snow' compromised RIPE NCC account credentials, leading to a three-hour service outage and over 1,572 compromised customer credentials across various regional internet registries. Fun times.
• Vastaamo hacker traced via 'untraceable' Monero transactions, police says - "KRP did not disclose the exact mechanism for tracing the Monero transactions, citing the need to protect sensitive investigative techniques that can prove invaluable in future cases. Thus, the exact methods involved are unclear." However, the suspect used a centralize exchange to exchange between BTC and XMR and eventually an email address linked to a server managed by the suspect. Seems like a lot of opportunities to find the suspect other than breaking XMR privacy, and I highly doubt that has happened. Binance Will Delist XMR on 2024-02-20, which may be related. Reminder: the Universal Declaration of Human Rights Article 12 states privacy is a universal human right and not a crime. Using XMR for crimes is a crime, the same way using USD cash for crimes is a crime.
• Arrests in $400M SIM-Swap Tied to Heist at FTX?. Three Americans charged with orchestrating SIM-swapping attacks resulting in over $400 million of stolen crypto, likely from FTX. The attacks took place between March 2021 and April 2023. There is no excuse to use SMS based 2FA for anything important after all these SIM swaps. Phone companies are not the place to outsource your identity verification!
• Qualys TRU Discovers Important Vulnerabilities in GNU C Library's syslog(). The two technical write ups are linked at the bottom of the post. Put CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780 on your PoC watch list as they will be nice Linux LPEs.
• Finance worker pays out $25 million after video call with deepfake 'chief financial officer'. The best deepfake we know about. Put this on your "why you should care" slide for your next vishing assessment.

Techniques and Write-ups

• How to Report the MFA Status for Entra ID User Accounts - Good defender/sysadmin article to deduce who's using MFA by combining authentication methods & signin logs.
• Sensecon 23: from Windows drivers to an almost fully working EDR - The author of the post wrote MyDumbEDR to learn more about EDRs and windows internals. Awesome write-up!
• Anonymous IP address involving Apple iCloud Private Relay - iCloud Private Relay is being used by their iPhone users to "anonymize" their traffic. Well, that is causing some issues for defenders. Some defenders might allowlist these relays on their SIEM or security tooling. Time for red teams to look into using this if you haven't already.
• The curious case of [email protected] - A detailed blog post on an AWS incident response use-case from a month long attack. Initial access via exposed access key, some recon via SES and IAM API calls, privilege escalation via AttachUserPolicy, and more.
• Unmanaged .NET Patching - Patching .NET functions from an unmanaged CLR host, to massage managed code at runtime by @kyleavery_.
• Evolution of UNC4990: Uncovering USB Malware's Hidden Depths - Always fun to read threat actor tradecraft. This one particularly stood out because threat actors are using vimeo[.]com and arstechnica[.]com to host payloads in addition to their usual registered domains.
• Microsoft Breach — What Happened? What Should Azure Admins Do? - Excellent blog post to summarize the Midnight Blizzard breach by Andy Robbins.
• Visualizing ACLs with Adalanche - An alternative to Bloodhound when enumerating AD. Maybe not as signatured as Sharphound for those looking for a quick option. We originally talked about Adalanche all the way back in LWiS 2021-06-14!
• CVE-2024-21733 Apache Tomcat HTTP Request Smuggling - Imaging getting creds as your initial access on a red team by pulling this off 🤯. Of course the password was Dec2023!.

Tools and Exploits

• RoleCrawl - PowerShell tool designed to audit User and Group role assignments in Azure, covering both subscription and resource scopes.
• hfinder - Help recon of hostnames from specific ASN or CIDR, thanks to Robtex and BGP.HE
• ThievingFox - A collection of post-exploitation tools to gather credentials from various password managers and windows utilities. Came with a blog post.
• IntelRAGU - An open-source initiative to document and share experiments to apply Retrieval Augmented Generation (RAG) techniques to Threat Intelligence searching capabilities.
• arachne is a Mythic webshell payload for Windows (aspx) and Linux (php). When run alone, the arachne container reaches out to the specified URL to issue tasking. When an agent links via P2P to an arachne agent, then that agent will remotely reach out to the specified URL to issue tasking. Check out the blog: Spinning Webs — Unveiling Arachne for Web Shell C2.
• ReverseSocks5 - Single executable reverse SOCKS5 proxy written in Golang. This is v2 which adds SOCKS5 support.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• certstream-server-go - This project aims to be a drop-in replacement for the certstream server by Calidog. This tool aggregates, parses, and streams certificate data from multiple certificate transparency logs via websocket connections to the clients.
• SigFinder - Identify binaries with Authenticode digital signatures signed to an internal CA/domain. This could be useful when pillaging SCCM distribution point servers.
• wirez - redirect all TCP/UDP traffic of any program to SOCKS5 proxy.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• How Russian spooks hacked Microsoft, the gap in its “morally indefensible” response, and what CISOs can learn from the attack - Fallout from the story that broke last week. We could see some changes coming to the Microsoft Graph API in the near future.
• Introducing the Mutator Kit: Creating Object File Monstrosities with Sleep Mask and LLVM - Cobalt Strike team has introduced the mutator kit, which uses an LLVM obfuscator to break in-memory YARA scanning of the sleep mask. This continues their "Evasion through flexibility" strategy.
• Top 10 web hacking techniques of 2023 - We look forward to this list every year. Cast your votes!
• WMI command line (WMIC) utility deprecation: Next steps - For the whoami.exe crew (thats not you of course), wmic.exe is being retired! WMI is still available via powershell.
• Introducing Windows Server 2025! - Yet we're still seeing 2003, 2008, and 2012 in almost every engagement? Sweet!
• Fastly to block domain fronting in February 2024. All good things must come to an end. Fastly was by far the largest CDN that supported fronting. Now it's just the smaller players. See [PDF] Measuring CDNs susceptible to Domain Fronting.
• Wyden Releases Documents Confirming the NSA Buys Americans' Internet Browsing Records. Did you read the terms of your ISP contract? Spoiler: they told you they are going to sell all your netflow and DNS to whomever they want. Remember: “We Kill People Based on Metadata”.

Techniques and Write-ups

• Bypassing browser tracking protection for CORS misconfiguration abuse Blog that talks about bypassing browser tracking protection through CORS misconfiguration abuse, explaining the CORS web protocol, detailing specific HTTP headers used in CORS, and highlights vulns associated with misconfigurations, with a focus on Access-Control-Allow-Credentials.
• Shipping your Private Key - CVE-2023-43870, Paxton do a Lenovo - A vuln (CVE-2023-43870) in Paxton Access's Net2 software, revealing that the default installation of Net2 includes a vulnerable certificate authority (CA) key, allowing an attacker to intercept HTTPS traffic on machines running Net2 or those that installed the CA as instructed by the Web API.
• Leveraging Fake DLLs, Guard Pages, and VEH for Enhanced Detection - Unconventional but very interesting detection mechanism used in conjunction with EDR, based on a combination of process environment block (PEB) modification, the use of fake DLLs and guard pages, and the use of vectored exception handling.
• Syscalls via Vectored Exception Handling - Executing the native APIs used in the context of loading shellcode using syscalls via Vectored Exception Handling (Vectored Syscalls). VEH has some haters.
• CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive - Fortras (yes the same Fortra that sells Cobalt Strike) GoAnywhere MFT product has an auth bypass. PoC for CVE-2024-0204 is already out.
• Macros Unleashed: Redefining Red Teaming with Advanced Macro Strategies-Part 2 - Not very OPSEC friendly but still good references nonetheless. Are macros making a comeback? Maybe they never left for some.
• GraphStrike: Anatomy of Offensive Tool Development. The GraphStrike tool was in last LWiS, but this blog post wasn't. Enjoy!
• Phishing Microsoft Teams for initial access - Not really news that Teams is being used to delivery payloads/links but this is a good write up with screenshots on how it is done. Discussed last year by BHIS in BSides Orlando 2023.
• BOFHound: Session Integration. bofhound has been around for a while but just got some extra powers related to session data and local group data.
• A christmas tale: pwning GTB Central Console (CVE-2024-22107 & CVE-2024-22108). A good run through from ISO download to RCE.
• Hunting for Unauthenticated n-days in Asus Routers. The use of Qiling to emulate the firmware is neat as they had to emulate nvram for configuration storage.
• A Practical Guide to PrintNightmare in 2024. PrintNightmare may be a memory, but the core of the issue - printer drivers install as SYSTEM on Windows - hasn't changed. I love these kinds of "work around the problem" hacks. This post is true hacking and even drops some automation (powershell) to help exploit vulnerable scenarios.
• Rook to XSS: How I hacked chess.com with a rookie exploit. Ah the days of myspace worms. Simpler times.
• How Apple accidentally broke my Spotify client. Not really cybersecurity related, but the level of depth in the investigation was so deep it was basically a vulnerability write up. Impressive. Spoiler: it was DNS (because of course it was).

Tools and Exploits

• SOAPHound - This made some noise this week. A custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.
• InjectKit - Modified versions of the Cobalt Strike Process Injection Kit
• Stardust - A modern 64-bit position independent implant template. Came with a good blog if you want to take a look here.
• Grroxy - Another competitor to Burpsuite Pro? Caido is another one that comes to mind.
• Frameless BITB - A new approach to Browser In The Browser (BITB) without the use of iframes, allowing the bypass of traditional framebusters implemented by login pages like Microsoft and the use with Evilginx. Even came with a demo.
• CsWhispers - Source generator to add D/Invoke and indirect syscall methods to a C# project.
• EventLogCrasher - Proof of concept for a bug, that allows any user to crash the Windows Event Log service of any other Windows 10/Windows Server 2022 machine on the same domain. The crash occurs in wevtsvc!VerifyUnicodeString when an attacker sends a malformed UNICODE_STRING object to the ElfrRegisterEventSourceW method exposed by the RPC-based EventLog Remoting Protocol.
• ExecIT - Execute shellcode files with rundll32.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Understanding Windows x64 Assembly - Add this to your Windows programming reading list.
• Trimarc Whitepaper: Owner or Pwnd? - This whitepaper touches on all aspects of AD ownership: Organizational Units (OUs), Computers, Groups, Users, AD Certificate Services (ADCS), Group Policy Objects (GPOs), and even Active Directory Integrated DNS (ADI DNS).
• jsoncrack.com - ✨ Innovative and open-source visualization application that transforms various data formats, such as JSON, YAML, XML, CSV and more, into interactive graphs.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• MiraclePtr: protecting users from use-after-free vulnerabilities on more platforms. The Chrome team has taken steps to protect against user-after-free vulnerabilities, and it's paying off (at the price of 1-3% worse performance)!
• Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard. Why could a non-production test tenant access senior leadership email? Interesting that these actors were looking for information about themselves. Very nation-statey.

Techniques and Write-ups

• Calling Home, Get Your Callbacks Through RBI - If you're a fan of cloudflare. This is a good read. Circumvent Remote Browser Isolation (RBI) technology during offensive assessments.
• Ransomware Deployment Attempts Via TeamViewer - Traitorware is back at it again!
• Level Up Your Reporting - Fundamental concepts of writing a good offensive security report. Except you should never use pixelation to redact data!
• Stealing your email with a .txt file - Haven't seen a lot of enterprise wide use of roundcube but still a cool bug being exploited.
• Web3's Achilles' Heel: A Supply Chain Attack on Astar Network - Another episode of self-hosted runner exploitation. The researcher is banned from a bug bountry platform after hacking all the things... "The vulnerability allowed anyone who could fix a typo in the astarNetwork/astar repository to modify the release binaries for their validator nodes and wasm runtimes." He modified a 2 week old release with a single print statement, a release that would not be pulled by anyone following the docs to set up a validator. Seems like a reasonable PoC to me. 🤷
• Tales from the cloud trenches: Amazon ECS is the new EC2 for crypto mining - We hope to see these more and more in the future. Technical write-ups of what threat actors are doing in the cloud can help shape our adversary simulation strategy.
• Outlook Vulnerability Discovery and New Ways to Leak NTLM Hashes - Another outlook vuln fresh off the press. Windows just really, really, wants to authenticate with NTLMv2.
• The Second Wednesday Of The First Month Of Every Quarter: Juniper 0day Revisited. I am no longer surprised by insecure security appliances.
• Do not trust this Group Policy!. Some interesting GPO based LPEs that won't be fixed (for now).
• Insomni'hack 2024 CTF Teaser - Cache Cache. Normally I don't post CTF write ups, but this is a unique, Windows challenge based on a real vulnerability class (and a well done write up by the challenge author).

Tools and Exploits

• Cobalt-Strike-Profiles-for-EDR-Evasion - Some ideas to modify CS profiles to bypass simple EDR checks. However, if you want to use SourcePoint I'm not sure I would trust the copy in this random repository...
• GraphStrike - Cobalt Strike HTTPS beaconing over Microsoft Graph API implemented as a user defined reflective loader (URDL). Appreciate the Why? section on this one. Better hope those Blue team network sensors have really good anomaly detection, because this will use legitimate microsoft domains for C2. However, now you have Microsoft's threat team to deal with, and there has been some discussion that they will ban accounts that conduct C2 over their API if they detect it.
• hi_my_name_is_keyboard. Zero click Bluetooth exploits for Android prior to the 2023-12-05 security patch (and Android <= 10 forever). Nice close access method to get payloads on an Android phone (assuming the target won't notice their screen acting up on its own). It also works against macOS and iOS (iOS < 17.2, Magic Keyboard Firmware < 2.0.6) if you can trigger it exactly when the computer/phone attempts to connect with an Apple Magic keyboard via Bluetooth.
• slippy-book-exploit - CVE-2023-44451, CVE-2023-52076: RCE Vulnerability affected popular Linux Distros including Mint, Kali, Parrot, Manjaro etc. EPUB File Parsing Directory Traversal Remote Code Execution.
• atril_cbt-inject-exploit - CVE-2023-44452, CVE-2023-51698: CBT File Parsing Argument Injection that affected Popular Linux Distros.
• Awaiting the Awaitables - Building the AwaitFuscator. I doubt this is practical for programs of any complexity, but it's got to be one of the most bizarre obfuscators since the movfuscator. Code here.
• proxy-helper-the-sequel - Port/rework of proxy-helper plugin for hak5 Pineapples.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• How to protect Evilginx using Cloudflare and HTML Obfuscation - Some solid OPSEC tips on protecting your RTA infrastructure.
• Realm - Realm is a cross platform Red Team engagement platform with a focus on automation and reliability. This was in the LWiS 2023-10-24, but the ShmooCon talk is what bubbled it back up for me and made me really look into it. The docs look great and I plan to play with this one very soon.
• GHunt - Recently got an update (OAuth based instead of cookies). Check it out!
• ADCSync - Use ESC1 to perform a makeshift DCSync and dump hashes.
• RemoteRegSave - A .NET implementation to dump SAM, SYSTEM, SECURITY registry hives from a remote host.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• Welcome To 2024, The SSLVPN Chaos Continues - Ivanti CVE-2023-46805 & CVE-2024-21887. At this point, if you have an SSL VPN, just throw it away. Use WireGuard and sleep better at night.
• It's 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable. No one took my advice from the previous story. These vulnerabilities are over two years old.
• Keeping Up With the Pwnses. A cybersecurity news aggregator? Wait, but thats what I am!?
• GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6. A vulnerability so bad it fits in a tweet.
• Seems like someone pushed a bunch of iBoot symbols to Hexrays's Lumina server. This is either an Apple employee or a researcher who (accidentally?) pushed their iBoot symbols to a public symbol server. A nice gift for iOS researchers.
• Airdrop doesn't use cryptographic salts, and rainbow tables are easily able to de-anonymize users. Due to the design of AirDrop, with a little pre-computing and hard drive space it is trivial to de-anonymize users with AirDrop enabled (at least get their phone number). Read more: [PDF] DEMO: AirCollect: Efficiently Recovering Hashed Phone Numbers Leaked via Apple AirDrop. This has been a known issue to Apple since 2019...

Techniques and Write-ups

• Python ❤️ SSPI: Teaching Impacket to Respect Windows SSO. With a little bring your own interpreter (i.e. Pyramid), impacket can now use the tickets already cached on the box you have access to without needing to know any plain text credentials.
• VBA: having fun with macros, overwritten pointers & R/W/X memory. The things that have been done with VBA that VBA was never supposed to do are impressive.
• Teams external participant splash screen bypass # 2. Phish where the users are. And if Microsoft "patches" a bypass of the external user warning, just... bypass it again!
• Writeup for CVE-2023-43208: NextGen Mirth Connect Pre-Auth RCE . Another entry in "a patch is not always the end of a vulnerability," one of my favorite series.
• CVE-2024-20656 - Local Privilege Escalation in the VSStandardCollectorService150 Service. Bind mounts strike again. Great find and write up. PoC: CVE-2024-20656.
• Privilege escalation using the XAML diagnostics API (CVE-2023-36003). Another Windows LPE! PoC: CVE-2023-36003-POC.
• Deobfuscating Android ARM64 strings with Ghidra: Emulating, Patching, and Automating. Some hardcore Android ARM64 reversing and debugging content.
• CICD-Goat Setup and Easy Challenge walkthrough (WhiteRabbit, MadHatter, Duchess). The fact you can deploy your own CTFd and multiple vulnerable CI systems with a single docker compose is awesome! There is a part 2 as well, but try to solve them on your own first!
• writeup_factorio - Writeup of a remote code execution in Factorio by supplying a modified save file.
• CVE-2023-49291 and More – A Potential Actions Nightmare - Loving all these github action attacks. The developer workflow is becoming more and more of an attack surface.
• The Covert Hardware Implant: Part 1 - "...we use our hardware implants in real-world Red Team operations while constantly evolving the form factor to align with the most effective solution for the mission"
• Deep Dive: http.favicon - Favicons have been making a come back the past few years. Don't sleep on this recon data point.
• ASLRn't: How memory alignment broke library ASLR . Oof. I guess that's why you do defense in depth.
• Bypassing Payments in Apple for Free Trails for Lifetime. The ability to create unlimited AppleIDs without a phone number or credit card may be responsible for the uptick in iMessage spam seen recently.

Tools and Exploits

• Kiosk Tooling. Next time you only have a browser and need to break out, browse to this site for some potential quick wins.
• CS-Aggressor-Scripts - Aggressor Scripts for Cobalt Strike (that post data to a Slack Channel).
• OpenVoice - Instant voice cloning by MyShell. I have warned of this, and now it is here and easy to use. Vishing will never be the same.
• BobTheSmuggler - "Bob the Smuggler": A tool that leverages HTML Smuggling Attack and allows you to create HTML files with embedded 7z/zip archives. The tool would compress your binary (EXE/DLL) into 7z/zip file format, then XOR encrypt the archive and then hides inside PNG/GIF image file format (Image Polyglots).
• SuperSharpShares - SuperSharpShares is a tool designed to automate enumerating domain shares, allowing for quick verification of accessible shares by your associated domain account.
• pinvoke.dev - Code-generated P/Invoke signatures.
• DFSCoerce-exe-2 - DFSCoerce exe revisited version with custom authentication.
• raddebugger - A native, user-mode, multi-process, graphical debugger.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• FlowMate - a BurpSuite extension that brings taint analysis to web applications, by tracking all parameters send to a target application and matches their occurrences in the responses.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

News

• This AI Chatbot is Trained to Jailbreak Other Chatbots. When the AIs fight, humans win?

• Twitter Hacks

  • Mandiant's X (Twitter) Account Hacked to Promote Crypto Scam
  • SEC says 'compromised' account to blame for tweet approving Bitcoin ETF

• Compromising Google Accounts: Malwares Exploiting Undocumented OAuth2 Functionality for session hijacking. And you thought Microsoft primary refresh tokens were powerful...

• NPM registry prank leaves developers unable to unpublish packages. A package that depended on every package on npm eventually got a circular dependency going and could not be removed. This also caused all public packages to be unable to be removed for a while.

Techniques and Write-ups

• The Mac Malware of 2023 👾 - A technical deep dive into every new macOS malware specimen of 2023.
• Crafting Malicious Pluggable Authentication Modules for Persistence, Privilege Escalation, and Lateral Movement - How PAM (Pluggable Authentication Modules) can be harnessed to create malicious binaries for capturing credentials to use in persistence, privilege escalation, and lateral movement.
• Entra ID Connect Arbitrary Password Overwrite - Did you compromise the AADConnect Server and want to pivot to Azure without having to crack NT hashes? Overwrite any users NT hash with an attacker-controlled value and give yourself access to the organizations Azure subscription as the compromised user.
• Research Uncovers AWS Account Numbers Hidden in Access Keys - Some recent updates to trufflehog because of "...simple base-32 decoding and bit shifting can transform any AWS access key credential type into the corresponding account number."
• Automating Managed Identity Token Extraction in Azure Container Registries - Azure Container Registries (ACRs) can have attached Managed Identities and you can create malicious tasks in the ACR that generate and export tokens for the Managed Identities. New function added to MicroBurst.
• PRT Abuse from Userland with Cobalt Strike - How to acquire an Azure AD Single Sign-On session from a non-privileged user session on a victim host. The token is later used to enumerate Azure AD via ROADTools.
• Phishing mobile devices, with DeviceCode phishing and QR codes. Get yourself some Primary-Refresh-Tokens and plunder the GraphAPI.
• Exploring Counter-Strike: Global Offensive Attack Surface. Good exploit development content. Disappointing vulnerability management by Valve.
• The SOCKS We Have at Home. As EDR gets better "C2s" that are just network bridges are becoming more popular.
• SafeHandle vs IntPtr. How safe are your C# handles?
• Cypher Queries in BloodHound Enterprise. Don't worry, it applies to open source BloodHound too.
• Bitwarden Heist - How to Break Into Password Vaults Without Using Passwords. If Windows Hello was enabled (fixed in October 2023) for Bitwarden, DPAPI could be used to extract a key that would unlock the vault without any user authentication or biometric prompts.
• How I pwned half of America's fast food chains, simultaneously.. To be fair it was the AI hiring chat bots/backend for a bunch of fast food chains, but still.

Tools and Exploits

• CVE-MAKER - Tool to find CVEs and Exploits. It's a CLI.
• SharpGhostTask - A C# port from Invoke-GhostTask.
• Handly - Abuse leaked token handles. Token handles in MSSQL's process (sqlservr.exe) can be abused to change security context and escalate privileges both locally and in the domain.
• SSH-Snake - A self-propagating, self-replicating, file-less script that automates the post-exploitation task of SSH private key and host discovery.
• Swarm - Formerly known as axiom, swarm is the next generation of distributed cloud scanning and attack surface monitoring.
• Moriarty - Moriarty is a comprehensive .NET tool that extends the functionality of Watson and Sherlock, originally developed by @_RastaMouse. It is designed to enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows environments.
• pendulum - Linux Sleep Obfuscation.
• CanaryTokenScanner - CanaryTokenScanner is a script designed to proactively identify Canary Tokens within office documents (docx, xlsx, pptx).

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• One Supply Chain Attack to Rule Them All - How self-hosted runners + supply chain attack led to these bounty hunters pwning a ton of orgs. Dope write-up!
• sessionprobe - A multi-threaded tool designed for penetration testing and bug bounty hunting. It evaluates user privileges in web applications by taking a session token and checking access across a list of URLs, highlighting potential authorization issues.
• msoffcrypto-tool - Python tool and library for decrypting MS Office files with passwords or other keys.
• ContinuousMage - Continuousmage is automated testing PoC for the Mythic framework.
• jsluice - Extract URLs, paths, secrets, and other interesting bits from JavaScript.
• COFF-Loader - A reimplementation of Cobalt Strike's Beacon Object File (BOF) Loader.
• DirtyCLR - An App Domain Manager Injection DLL PoC on steroids and it came with a blog post.
• deskhop - Fast Desktop Switching Device.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• Operation Triangulation: What You Get When Attack iPhones of Researchers. The most complex double-exploitation chain I have seen in a long time. Ask yourself - if the actor that deployed this is willing to burn and entire 1-click chain just to package it with a 0-click, what do they have on the shelf or are using very sparingly?
• BlackCat Ransomware Raises Ante After FBI Disruption. If you poke the bear, you best be prepared to wrestle it.
• Microsoft addresses App Installer abuse. This is actually the second time Microsoft has had to disable ms-appinstaller URI scheme. This time it's because Financially motivated threat actors misusing App Installer.
• Artificial intelligence can find your location in photos, worrying privacy experts. OSINT experts have been doing this for decades, AI just makes it avaialable to the masses, and easy.
• Google will no longer hold onto people's location data in Google Maps — meaning it can't turn that info over to the police. A rare privacy win out of Google.
• Ubiquiti users report having access to others' UniFi routers, cameras. When you connect your core infrastructure to the internet, you had better trust the security of whatever you connect it to.

Techniques and Write-ups

• CVE-2023-36033: Windows DWM Core Library Elevation of Privilege Vulnerability. This is an in-the-wild 0day Windows LPE that uses a two stage execution to get SYSTEM.
• Securing our home labs: Frigate code review. CodeQL finds some CVEs yet again.
• SonicWall WXA - Authentication Bypass and Remote Code Execution Vulnerability. A nice walkthrough of image download to RCE in a few hours.
• Finding that one weird endpoint, with Bambdas. Bambdas are a fun new feature of Burp Suite to quickly test for things in your project files directly inside the proxy. This post has some nice examples of how they can be used.
• Cueing up a calculator: an introduction to exploit development on Linux. A great intro to modern Linux exploit development that addresses mitigations found on modern Linux operating systems.
• Blind CSS Exfiltration: exfiltrate unknown web pages. The new :has selector can be used to exfiltrate data from sites that have a blind HTML injection vulnerability.
• Safari, Hold Still for NaN Minutes!. Some browser exploitation content from the team at Exodus.
• [PDF] Paged Out Volume 3. Hacker zines are making a comeback and I'm here for it.
• Silly EDR Bypasses and Where To Find Them. Bypass EDR detections with "forced exceptions." Code here. Confused by what user mode hooks are? Check out An Introduction to Bypassing User Mode EDR Hooks.
• Writing A Decent WIN32 Keylogger. This three part series covers the ins and outs of writing a keylogger for Windows that handles unicode and other edge cases. The tool is called keebcap.
• The Far-Reaching Consequences of LogoFAIL. That cool boot logo in UEFI is probably a vulnerability.
• BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses. This 10+ year old flaw in Bluetooth forces devices to negoitate a short session key which can be brute forced.
• RISC-Y Business: Raging against the reduced machine. Protect your "intelectual property" by writing your own RISC virtual machine in your binary. Code is at riscy-business.
• Browser Extension Pentesting Methodology. New detailed writeup on how to approach a Browser Extension.
• Rust Binary Analysis, Feature by Feature. An extreamly thurough break down of Rust binary analysis.
• Internal All The Things - Active Directory and Internal Pentest Cheatsheets. An impressive collection of Active Directory techniques.
• Ring0VBA - Getting Ring0 Using a Goddamn Word Document. Absolute madness.
• Introducing YARA-Forge. If you deal with yara rules (defense or testing your offensive tools), this project will likely help you organize and optimize all your rules.

Tools and Exploits

• sleepy - A lexer and parser for Sleep. Read more here.
• A (beta) Canarytoken for Active Directory Credentials. Perhaps one of the most effective canary tokens yet. Slightly more complicated than just dropping a file, but it will be extremely effective in catching red teams and adversaries.
• frinet - Frida-based tracer for easier reverse-engineering on Android, iOS, Linux, Windows and most related architectures.
• Christmas - By splitting up the injection actions across different spawned processes, none of the spawned processes generate enough signal to trip EDR (in theory).
• sj - A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files. See this post for more info.
• Ghidriff: Ghidra Binary Diffing Engine. Back in my day, BinDiff was paid software. This is a great addition to your reverse engineering/diffing toolbox, and fully open source!
• bbs - bbs is a router for SOCKS and HTTP proxies. It exposes a SOCKS5 (or HTTP CONNECT) service and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script (if built with PAC support), or through a JSON file.
• SignToolEx - Patching "signtool.exe" to accept expired certificates for code-signing.
• WMIProcessWatcher - A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
• Marble - The CIA's Marble Framework is designed to allow for flexible and easy-to-use obfuscation when developing tools.
• Def1nit3lyN0tAJa1lbr3akTool - A jailbreak tool for all arm64 devices on iOS 16.0 to iOS 16.5.
• Amnesiac - Amnesiac is a post-exploitation framework entirely written in PowerShell and designed to assist with lateral movement within Active Directory environments.
• SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC - Sharepoint RCE.
• EDRSilencer - A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server. This is similar to shutter (shoutout to @naksyn).
• Ghidra 11.0. 11.0 brings the "Bsim" binary similarity tool, better Go binary support, and initial Rust binary support.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Linpmem is a linux memory acquisition tool.
• tailspin - 🌀 A log file highlighter.
• CLR_Heap_encryption. This is a POC for a CLR sleep obfuscation attempt. It use IHostMemoryManager interface to control the memory allocated by the CLR. Turns out you can use both ICorRuntimeHost and ICLRRuntimeHost at the same time, so we can still use ICorRuntimeHost to run an assembly from memory while having all the benefits from ICLRRuntimeHost.
• sheye - Opensource assets and vulnerability scanning tool.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• About the security content of iOS 17.1.2 and iPadOS 17.1.2. Two webkit vulnerabilities may have been exploited in the wild. Not to be outdone, Chrome patched their sixth 0day this year. Browsers are where the data is and the most frequent way users execute untrusted code, so its where the high value exploitation is as well.

Techniques and Write-ups

• TRAP; RESET; POISON; - Taking over a country Kaminsky style. A CGNAT device allows for "Kaminsky style" DNS attacks.
• Securing our home labs: Home Assistant code review. A detailed write up of a few nice bugs in Home Assistant.
• O365 Phishing infrastructure. "Last year, mails sent by Dev Tenants got immediately flagged, but something changed." Oh boy. If there isn't a fix for this soon it will be abused.
• Owncloud: details about CVE-2023-49103 and CVE-2023-49105. Full details on the owncloud vulnerabilities from last week.
• Shooting Yourself in the .flags - Jailbreaking the Sonos Era 100. Some U-boot and hardware hacking of a smart speaker.
• We Hacked Ourselves With DNS Rebinding. A very neat usecase for DNS rebinding which is often a theoretical attack. I also like that the author didn't stop investigating when the change to IMDSv2 was made which prevented the outcome, but didn't solve the original "vulnerability."
• DeleFriend: Severe design flaw in Domain Wide Delegation could leave Google Workspace vulnerable for takeover. Juciy potential privesc for Google Workspace. They even included a nice tool: DeleFriend.
• stuxnet - Public open-source code of malware Stuxnet (aka MyRTUs).
• Tricard - Malware sandboxes fingerprinting. Create binaries that ship back system fingerprints to find sandboxes!
• Decompilation Debugging. Amazing post about how to debug complex code without source (they use the Windows RPC server as a target) using Ghidra.

Tools and Exploits

• EvilSlackbot - A Slack bot phishing framework for Red Teaming exercises. There is a blog post about its use as well.
• GhostDriver - yet another AV killer tool using BYOVD.
• ADOKit - Azure DevOps Services Attack Toolkit.
• standardlib - A complete standardlib for c for once.
• ClickOnce-AppDomain-Manager-Injection - ClickOnce + AppDomain Manager Injection.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• windiff - Web-based tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS.
• PySQLRecon - Offensive MSSQL toolkit written in Python, based off SQLRecon.
• Kerberos.NET - A Kerberos implementation built entirely in managed code.
• Scudo is a C++ class that encrypts and dynamically executes functions. This open-source repository offers a concise solution for securing and executing encrypted functions in your codebase.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• Diamond Sleet supply chain compromise distributes a modified CyberLink installer - Supply chain attack by North Korea-based group. Thus far, the malicious activity has impacted over 100 devices in multiple countries, including Japan, Taiwan, Canada, and the United States.
• State of Cloud Security - Datadog summarizes what cloud security looks like in 2023. Nothing groundbreaking.
• Secretive White House Surveillance Program Gives Cops Access to Trillions of US Phone Records. Signal calls are free.
• Mythic v3.2 Highlights: Interactive Tasking, Push C2, and Dynamic File Browser. The most flexible open source C2 gets some new features.
• Merlin's Evolution: Multi-Operator CLI and Peer-to-Peer Magic. Merlin also gets an update!
• Disclosure of sensitive credentials and configuration in containerized deployments. A 10.0 CVSS vulnerability. A bit awkward as the same day ownCloud becomes part of Kiteworks.
• Introducing Eclipse ThreadX. Azure RTOS becomes part of Eclipse ThreadX

Techniques and Write-ups

• lateralus (CVE-2023-32407) - a macOS TCC bypass - A macOS TCC bypass by exploiting a bug in the Metal framework's handling of the MTL_DUMP_PIPELINES_TO_JSON_FILE environment variable, allowing attackers to control file paths and potentially overwrite sensitive files, leading to a $30,500 bounty from Apple, who promptly addressed the issue and removed the problematic environment variable. POC. Want more TCC bypasses? sqlol (CVE-2023-32422) - a macOS TCC bypass also dropped last week.
• Executing from Memory Using ActiveMQ CVE-2023-46604 - Bypass current detections of existing PoCs. This post discusses the exploitation of the ActiveMQ CVE-2023-46604 by executing Nashorn JavaScript from memory.
• Low-Level Process Hunting on macos - This post discusses low-level process hunting on macOS, emphasizing the importance of understanding parent/child relationships and the nuances of process creation using fork, exec, and their combination. Decent read for those starting out macOS development.
• Okta for Red Teamers — Perimeter Edition - Identifying Okta portals, phishing infrastructure, hosting considerations, Evilginx phishlet setup, distributing phishing links, replaying captured session cookies, and evading Okta's behavioral detection policies. So much fuego in this one 🔥
• Mockingjay revisited - Process stomping and loading beacon with sRDI - "...a variation of hasherezade's Process Overwriting and it has the advantage of writing a shellcode payload on a targeted section instead of writing a whole PE payload over the hosting process address space."
• A “deep dive” in Cert Publishers Group - Members of Cert Publishers can add a malicious Certification Authority, potentially leading to trusted certificates for various malicious activities.
• A Touch of Pwn - Part I - Vulnerabilities in the fingerprint sensors of Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X/8 leading to auth bypass. Surprisingly, the Microsoft Surface was the worst of the bunch, despite the research being funded by Microsoft!
• Fun with another PG-compliant Hook - The article describes a technique for hooking SYSCALL in a PG-compliant manner using Event Tracing for Windows (ETW) and the HalPrivateDispatchTable. Useful for your next Windows rootkit.
• Stealth operations: The evolution of GitLab's Red Team - Solid write-up about building an internal red team. Some good content here about what a Red Team's goals should be and how to handle "deconfliction."
• That's FAR-out, Man. A detailed look into finding a Linux kernel infoleak.
• How to voltage fault injection. Some very detailed physical hacking content. Need something a little more beginner friendly? Start with Hardware Hacking - Dumping Flash Memory of a TrendNet-731BRv1 Router also released last week.
• Nemesis: Zero to Hero. The only thing better would have been an Ansible role.
• Really Useful Logging and Event Repository (RULER) Project. Good places to look during incident response, or post-compromise 😈.
• Creating an OPSEC safe loader for Red Team Operations. Everyone could use a better loader.
• Process Injection - Avoiding Kernel Triggered Memory Scans. Speaking of better loaders...

Tools and Exploits

• Kerbeus-BOF - BOF for Kerberos abuse (an implementation of some important features of the Rubeus).
• LocklessBof - A Beacon Object File (BOF) implementation of Lockless by HarmJ0y, designed to enumerate open file handles and facilitate the fileless download of locked files.
• LyinEagle - BETA C2 server that uses the legitimate FIN7 Griffon JScript as its implant.
• badgerDAPS - Brute Ratel LDAP filtering and sorting tool. Easily take BR log output and pull hostnames for ease of use with other red team tooling. Supports OU filtering and removes disabled hosts.
• AI Exploits - A collection of real world AI/ML exploits for responsibly disclosed vulnerabilities.
• ProcessStomping - A variation of ProcessOverwriting to execute shellcode on an executable's section.
• DumpS1.ps1 - Uses a CoSetProxyBlanket to call the dump function in SentinelAgent.exe to dump a PID to disk. Requires local admin. Love the traitorware aspect here.
• Proof of concept exploit for CVE-2023-46214 - Authenticated RCE. Comes with a blog.
• CoercedPotatoRDLL - Reflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege
• Pcapan: a PCAP analysis helper - Filter out known good and find suspicious connections in pcaps.
• waveterm - An open-source, cross-platform terminal for seamless workflows. Reminds me of an open source warp.
• genpatch - genpatch is IDA plugin that generates a python script for patching binary.
• faction - Pen Test Report Generation and Assessment Collaboration.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Home-Grown-Red-Team - Some cool tradecraft write-ups.
• Best EDR Of The Market (BEOTM) 🐲 - AV/EDR bypassing lab for training & learning purposes.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• Server Message Block (SMB) protocol changes - New firewall rules, SMB NTLM blocking exception list, alternative SMB ports, and more!
• [PDF] Charting China's Climb as a Leading Global Cyber Power - China has lots of 0day's attributed to it and the willingness to use them at scale.
• [PDF] Kaspersky Threat Intelligence - Modern Asian APT Groups - Recorded future releases an 18 page report on chinese APTs. Kaspersky says, hold my beer (370 pages) 😂.

Techniques and Write-ups

• Post-exploiting a compromised etcd - Full control over the cluster and its nodes - This paper aims to demonstrate that a compromised etcd is the most critical element within a k8s cluster, as it is not subject to role restrictions or the AdmissionControllers.
• Hacking Like Hollywood With Hard-Coded Secrets - A good write up on firmware blob to authentication bypass on a Ganz Security Solutions device.
• Attacking an EDR - Part 3 - The last post for the "Attacking an EDR" series.
• The Triforce of Initial Access - Initial access TTPs based on phishing + gathering loot automatically. Check out Bobber in the tools section.
• Abusing Slack for Offensive Operations: Part 2 - "Slack has followed the cookie storage blueprint used by browsers, like Google Chrome, making existing tooling and techniques adaptable for Slack exploitation." Easy to dump from memory on Windows, a bit more complicated on macOS.
• Hacking the Canon imageCLASS MF742Cdw/MF743Cdw (again) - Stack-based buffer overflow in the Canon firmware. Cool writeup.
• Abusing Microsoft Access “Linked Table” Feature to Perform NTLM Forced Authentication Attacks - The Microsoft Access "linking to remote SQL Server tables" feature that can automatically leak Windows user NTLM hashes via port 80. While most NTLM leaks are via port 445, this one is much more likely to make it out of the corporate firewall.
• Using SSL Certificates for Red Team Payloads - Interesting idea. "I found out that you could embed x.509 extensions into a certificate in the form of OIDs". You can use these x.509 extensions to inject your payload.
• Demystifying Cobalt Strike's “make_token” Command - Nice little deep dive into make_token.
• systemd hardening made easy with SHH. Could be used to audit for weak services 😉.

Tools and Exploits

• Nuclei AI - Browser Extension - Browser Extension for Rapid Nuclei Template Generation (requires a cloud account).
• fastsync - Fast synchronization across networks using speedy compression, lots of parallelization and fast hashmaps for keeping track of things internally.
• MAAS - Malware As A Service. This project describes a DevOps approach which leverages the CI/CD capabilities of gitlab to build a malware artifact generation pipeline.
• SharpVeeamDecryptor - Decrypt Veeam database passwords.
• proxyhub - An advanced [Finder | Checker | Server] tool for proxy servers, supporting both HTTP(S) and SOCKS protocols. 🎭
• Bobber - Evilginx database monitoring with exfiltration automation.
• SharpReflectivePEInjection - Reflectively load and execute PEs locally and remotely bypassing EDR hooks
• CVE-2023-32629 & CVE-2023-2640: Privilege escalation - Ubuntu Privilege Escalation bash one-liner
• .NetConfigLoader - List of .Net application signed by Microsoft that can be used to load a dll via a .config file (AppDomain Hijacking). Ideal for EDR/AV evasion and execution policy bypass.
• Bloodhound_Community_Docker - Generator of docker-compose file to allow secure configurations and multi-deployment strategy.
• CVE-Half-Day-Watcher - a security tool designed to highlight the risk of early exposure of Common Vulnerabilities and Exposures (CVEs) in the public domain.
• GoSleepyCrypt - In-memory sleep encryption and heap encryption for Go applications through a shellcode function.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• the !CVE Program - The mission of the !CVE Program is to provide a common space for cybersecurity !vulnerabilities that are not acknowledged by vendors but still are serious security issues.
• hakrevdns - Small, fast tool for performing reverse DNS lookups en masse.
• RoastInTheMiddle- Roast in the Middle is a rough proof of concept (not attack-ready) that implements a man-in-the-middle ARP spoof to intercept AS-REQ's to modify and replay to perform a Kerberoast or Sessionroast attack.
• Implementing Tic Tac Toe with 170mb of HTML - no JS or CSS 🤯

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• Joint Industry statement of support for Consumer IoT Security Principles. A good idea, but without teeth, what is there to keep these labels honest?
• Post Mortem on Cloudflare Control Plane and Analytics Outage. Perhaps the worst outage in Cloudflare history. Big props for such a timely and technical Post Mortem. It's going to be a busy end of the year for their reliability engineers.
• Introducing HAR Sanitizer: secure HAR sharing - In response to the latest Okta breach, Cloudflare is recommending folks to sanitize their HAR files to minimize attack surface. We wouldn't recommend sending anyone your HAR files but this is a good response and idea for all using HAR files in your debugging workflow. I think think of a couple infosec vendors asking for HAR files for debugging. This was an interesting turn of events.
• SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures. I guess you should actually implement the controls you tell investors you have - allegedly.

Techniques and Write-ups

• Running PEs Inline Without a Console. Woah. It can even run powershell without any process creation.
• Lateral Movement: Abuse the Power of DCOM Excel Application - ActivateMicrosoftApp() method within the DCOM Excel application for lateral movement.
• EC2 User-data to RCE - Instance Metadata Service v1 strikes again. Migrate to SSRF -> Creds -> User-Data -> RCE. Migrate to IMDSv2!
• Welcome to the Offensive ML Framework - Excited to see if this project gets some traction. They're keeping tabs of ML use cases in offsec.
• Phishing With Dynamite - Pretty nifty implementation of phishing users in accessing an environment you control via the browser. Similar to phishing with noVNC by Mr.d0x.
• By-design AV bypass with "dev drive" - Probably good for a few weeks. Interesting feature by MSFT. Walkthrough of Dev Drive on Windows 11.
• Data-Bouncing - The art of indirect exfiltration. - "....by directing web requests to certain domains that process hostnames in headers, you can relay small pieces of data to your DNS listener, allowing you to collect and reconstruct data, be it strings, files, or anything else." Using web requests to "font" a DNS request. Good to get data out of restrictive network - slowly.
• LDAP authentication in Active Directory environments. Great low level detail on how LDAP works and can be protected, and how to patch your tools to incorporate the new protections and continue working.
• Old CVEs Leading to New Vulns - Reverse Engineering TrendNet-731BRv1. Always educational to see someone else's though process as the take a known vulnerability and recreate an exploit for it.
• Citrix Bleed: Leaking Session Tokens with CVE-2023-4966. From patch diff to exploit.
• Building an Exploit for FortiGate Vulnerability CVE-2023-27997. Exploit development content for the FortiGate pre-authentication remote code injection vulnerability.
• LocalPotato HTTP edition. Another potato LPE. I really appreciate the lab setup section.
• Cisco IOS XE CVE-2023-20198: Deep Dive and POC. Not much of a deep dive as the exploit is simple.
• Fuzzer Development: The Soul of a New Machine. Develop a fuzzer from scratch? Impressive.
• Introducing CS2BR pt. III - Knees deep in Binary. I love authors that post their process even when it does not end in success. We learn a lot from failure!
• Persistence - Windows Telemetry. Another LOLBin and persistence mechanism.

Tools and Exploits

• Defender-Exclusions-Creator-BOF - A BOF to add or remove Windows Defender exclusions.
• cookie-monster - BOF to steal browser cookies.
• GhostTask - Create/modify scheduled tasks directly in the registry to avoid event logs and alerts.
• LdrLockLiberator - A collection of techniques for escaping or otherwise forgoing Loader Lock while executing your code from DllMain.
• Kernel_VADInjector - Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver.
• maliciousCodeMatchingMFA - A small executable to trick a user to authenticate using code matching MFA.
• PsMapExec - The cme saga continues. This project is in powershell and inspired by CrackMapExec.
• cuddlephish - Weaponized Browser-in-the-Middle (BitM) for Penetration Testers.
• pandora - A red team tool that assists into extracting/dumping master credentials and/or entries from different password managers.
• WIP Mockingjay BOF Conversion - Cobalt Strike Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique.
• LdrLibraryEx - A small x64 library to load dll's into memory.
• ReleaseTheHounds - Tool to upload large datasets and interact with BloodHound CE API.
• sshx - A secure web-based, collaborative terminal.
• DayBird - Extension functionality for the NightHawk operator client.
• porch-pirate - Porch Pirate is the most comprehensive recon / OSINT client and framework for Postman that facilitates the automated discovery and exploitation of API endpoints and secrets committed to workspaces, collections, requests, users and teams. Porch Pirate can be used as a client or be incorporated into your own applications.
• NerfDefender - BOF and C++ implementation of the Windows Defender sandboxing technique described by Elastic Security Labs/Gabriel Landau.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• hashcathelper - Got some creds? Has a couple different modules. One allows operators to insert new relationships into an existing BloodHound database such as when users have the same password. Improve those screenshots!
• postleaks - Search for sensitive data in Postman public library.
• OffensiveGo - Looking to do some offensive dev in go? Start here. Notable golang tools at the bottom such as sliver and merlin.
• Hijacking Someone Else's DCSync - Friendly reminder that your AADConnect server are tier 0 assets. Pwn the AADConnect server -> wait for cloud takeoff -> catch hashes in flight.
• Mido - The Secure Microsoft Windows Downloader.
• Exploring SCCM by Unobfuscating Network Access Accounts - These Network Access Accounts (NAA) accounts have been very fruitful lately...
• PyMeta - Pymeta will search the web for files on a domain to download and extract metadata. This technique can be used to identify: domains, usernames, software/version numbers and naming conventions.
• LME - Logging Made Easy (LME) is a free and open logging and protective monitoring solution serving all organizations. Good resource for a detection lab (RIP), but very manual setup.
• Get-LoggedOn.py - Lookup logged in users using itm4n's session enum via registry.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• Tracking Unauthorized Access to Okta's Support System. Okta had another compromise.

  • BeyondTrust Discovers Breach of Okta Support Unit. Bad when your customers tell you that you're pwned.
  • How Cloudflare mitigated yet another Okta compromise. Worse when its multiple customers.
  • [PDF] Security Incident report [Internal Report]. "[the suspected compromised endpoint] was scanned with the free version of Malwarebytes, which reported no findings." I'm not sure what I'm more concerned about: the IR process at 1Password is to run free AV against the endpoint or that the CTO happily published that fact.

• The Sky Has Not Yet Fallen - Curl (CVE-2023-38545). With the hype from the curl author himself ("Buckle up.") I was expecting more out of this bug. It's a pretty niche use case that is exploitable (client using a malicious proxy with curl). Here is the hackerone report.

• Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature. A CVSS 10.0 - yikes. Please stop putting admin interfaces for these critical network devices on the internet. I haven't found a legitimate public PoC yet (probably for the best).

Techniques and Write-ups

• Critically close to zero(day): Exploiting Microsoft Kernel streaming service. A nice new attack surface in Window. PoC here.
• Attacking AWS Cognito with Pacu . Don't miss part 2. More good cloud assessment content from Rhino security labs.
• An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit. Some very hardcore analysis of a complicated bug chain with a simple buffer overflow to kick it off - with a nice bit of shade toward Apple in the conclusion.
• A Deep Dive into TPM-based BitLocker Drive Encryption. I always love an itm4n post - the right amount of depth and screenshots.
• CVE-2023-33466 - Exploiting Healthcare Servers with Polyglot Files. A good real-world example of a polygot file exploit.
• (Un)Hooking, COWs and Meow Meow. When you modify ntdll in memory (i.e. hooking/unhooking), you really load a second copy into your process memory space.
• Phishing for Primary Refresh Tokens and Windows Hello keys. A nice method to go from device code phish to persistent in Entra ID. Check the deviceCode2WinHello script as well.
• Preventing Type Confusion with CastGuard. A new yet-undocumented Windows exploit mitigation feature is coming.
• The Nightmare of Apple's OTA Update: Bypassing the Signature Verification and Pwning the Kernel. A nice bug chain that led to kernel compromise (even with SIP enabled). Great work.
• Ghost In The Wire, Sonic In The Wall - Adventures With SonicWall. End result is a few DoS bugs, but the process is nicely documented.

Tools and Exploits

• legba - A multiprotocol credentials bruteforcer / password sprayer and enumerator.
• pico_dma - Autonomous pre-boot DMA attack hardware implant for M.2 slot based on PicoEVB development board.
• Kernel Driver Utility v1.4.0 - 4 new providers and a dump command!
• Proxy-DLL-Loads - A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.
• Jomungand - Shellcode Loader with memory evasion.
• NovaLdr - Threadless Module Stomping In Rust with some features.
• WolfPack - WolfPack combines the capabilities of Terraform and Packer to streamline the deployment of red team redirectors on a large scale.
• FalconHound - FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool.
• GraphRunner - A Post-exploitation Toolset for Interacting with the Microsoft Graph API.
• EvilSln - A New Exploitation Technique for Visual Studio Projects.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• GATOR - GCP Attack Toolkit for Offensive Research, a tool designed to aid in research and exploiting Google Cloud Environments.
• CVE-2023-36723 - PoC for arbitrary directory creation bug in Windows Container Manager service.
• tinyproxy - a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems.
• SMBLibrary - Free, Open Source, User-Mode SMB 1.0/CIFS, SMB 2.0, SMB 2.1 and SMB 3.0 server and client library.
• Shaco - Shaco is a linux agent for havoc.
• realm - Realm is a cross platform Red Team engagement platform with a focus on automation and reliability.
• CoercedPotato - From Patate (LOCAL/NETWORK SERVICE) to SYSTEM by abusing SeImpersonatePrivilege on Windows 10, Windows 11 and Server 2022.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• Impacket Updates: We Love Playing With Tickets - Impacket is starting to crank out some kerberos improvements. You can create a Sapphire Ticket a bit easier now with Impacket without having to use a fork.
• Defending new vectors: Threat actors attempt SQL Server to cloud lateral movement - The instance metadata service (IMDS) was the target. The cloud metadata service has been a popular target for AWS attacks in the past, and Azure is no different now.
• 90s Vulns In 90s Software (Exim) - Is the Sky Falling? - "So, our advice is the usual - patch when you can, once patches are available (Exim have stated they will release patches at 12:00 UTC today, Monday 2nd October). But in the meantime, don't panic - this one is more of a damp squib than a world-ending catastrophe." Unless you have a Sophos Firewall, in which case you should patch ASAP.
• Expanding our exploit reward program to Chrome and Cloud - It's neat they pay for n-day PoCs not just 0days.
• Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11 - This is drectly from the curl author, unlike other reported "high severity" curl issues in the past that turned out to be nothing.
• Russia plans to try to block VPN services in 2024 - Good luck!

Techniques and Write-ups

• Looney Tunables: Local Privilege Escalation in the glibc's ld.so (CVE-2023-4911) - Is this the Dirty COW of 2023? Perhaps not quite as ubiquitous as it relies on a range of glibc versions (glibc 2.34+). Props to Qualys for keeping the old school phrack-esqe disclosures alive. PoC 1. PoC 2. [Direct Download] PoC 3. PoC 4.
• MacOS "DirtyNIB" Vulnerability - It's possible to hijack the entitlements of Apple apps by swapping out the interface (NIB) file. This is currently unpatched, even on macOS 14.0. Weaponize this for camera/mic/keychain/file access once you get code execution. Or maybe even bundle it in with your dropper.
• Launch and Environment Constraints Deep Dive. A great companion to the previous post that details what Launch and Environment Constraints are and what kind of bugs they hamper.
• Solving The “Unhooking” Problem - Unhooking gets complicated when the user can run arbitrary code (BOF/C#) that may load libraries without the protection of the C2 agent. Outflank presents their solution to this issue - visibility, automation, and on-demand unhooking.
• Reflective call stack detections and evasions - An updated BokuLoader has some new methods to avoid call stack spoofing detection.
• Sliver and Cursed Chrome for Post Exploitation - With sensitive information moving to SaaS and other browser based apps, being able to operate as a compromised user in the context of their browser is essential for modern red teams.
• Yet More Unauth Remote Command Execution Vulns in Firewalls - Sangfor Edition. I will always be impressed with unauth RCE on a firewall. 🤦
• Behind the Shield: Unmasking Scudo's Defenses - Scudo is LLVM's hardened allocator. This post is a dense exploration of how exploitation of scudo may be possible.

Exploring the STSAFE-A110 Analysing I2C communications between host and the secure element - Some physical device hacking with a logic analyzer to read I2C of a secure element.

• Cobalt Strike Aggressor Callbacks - Shows how to use the new callbacks feature of Cobalt Strike 4.9. Much better than setting global flags and parsing all beacon output in a timer function which is what we had to do before.
• Trends From the Trenches: Social Engineering - Some really solid examples in this post. I've used similar pretexts to great effect.
• Perfect Loader Implementations - Some good Linux and Windows loader work, see fuse-loader and perfect-loader for PoCs. These are great raw material for custom C2s.
• Coordinated Disclosure: 1-Click RCE on GNOME (CVE-2023-43641) - Lots of protections bypassed to get RCE - excited for the follow up post.
• Using Cloudflare to bypass Cloudflare - Defaults can be dangerous. Be sure to validate the host headers!
• Binarly REsearch Uncovers Major Vulnerabilities in Supermicro BMCs - Authenticated command injection and a slew of XSS. Theoretically you could chain these to be unauth remote RCE, but you'd need a click from a logged in admin.

Tools and Exploits

• linWinPwn - Bash script that automates a number of Active Directory Enumeration and Vulnerability checks. Will be interesting if they keep up with this project. Interesting new project since it's using the new NetExec . Will other tools do the same?
• LatLoader - PoC module to demonstrate automated lateral movement with the Havoc C2 framework.
• sccmhunter v.0.0.2 - Updated Admin Module - SCCM is the gift that keeps on giving. This is a new easy way to execute commands on managed machines (Administration Service API).
• archive_pwn - A Python-based tool to create zip, tar and cpio archives to exploit common archive library issues and developer mistakes. Blog Post.
• SmmBackdoorNg - Updated version of System Management Mode backdoor for UEFI based platforms: old dog, new tricks.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Browser cache smuggling - Interesting payload delivery technique.
• Registry Attack Vectors(RTC0018) - A big list of interesting reg keys.
• Kerberos 102 - Overview Three part blog series on kerberos, delegation, and cross-realm. You can never read enough about kerberos.
• ted_api - TED is a limited general purpose reverse engineering API, and hybrid debugger, that allows for inspection and modification of a program's inner workings. TED carries out its functionality by being injected into a target process and starting a gRPC server, which clients can then connect to.
• agent - SSH Session Monitoring Daemon.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• From ScreenConnect to Hive Ransomware in 61 hours. Solid write-up of how traitorware wreaks havoc.
• Nighthawk 0.2.6 - Three Wise Monkeys. The C2 wars continue. New Nighthawk version introduces API call stack masking.
• [PDF] People's Republic of China-Linked Cyber Actors Hide in Router Firmware. Cisco vuln leads to firmware backdoors by PRC. The decision to not share the actual trigger packet is unfortunate for defenders.
• Encrypted Client Hello - the last puzzle piece to privacy. A wise man once said Domain fronting is dead, long live domain fronting. This is very similar to my 2020 talk, except all sites share the cloudflare-ech.com unencrypted SNI value vs being able to spoof it.
• Default outbound access for VMs in Azure will be retired — transition to a new method of internet access. This is how AWS has always worked - you need a NAT gateway.
• Cloudflare is free of CAPTCHAs; Turnstile is free for everyone. Let the cat-and-mouse bot vs anti-bot wars continue!

Techniques and Write-ups

• JA4+ Network Fingerprinting. The evolution of the JA3, JA3S, and JARM fingerprints. Break out Cloak to blend in. You're proxying your C2 traffic via legitimate web servers to blend in already right?
• AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp. Pretty cool report/find!
• Bypass Two-Factor Authentication of Facebook Accounts ($25,300). In todays episode of crazy bug...
• Summiting the Pyramid: Level Up Your Analytics. New methodology for detection engineering. "...This methodology shifts the advantage to defenders, even as adversaries evolve, and allows us to change the game on the adversary."
• Active Directory Hardening Series - Part 1 - Disabling NTLMv1 - Last week we reported that SMB NTLM is able to be disabled in the latest insiders builds of Windows 11, now Microsoft is pushing this. Relay those NTLM hashes while you still can!
• SCCM Hierarchy Takeover. "...if an attacker gains control of any primary site, they gain control of the entire SCCM hierarchy." SCCM has been a huge are of domain privilege escalation on recent assessments. Due to its complexity, I wager that more attacks will come out of it in the coming months.
• Teams external participant splash screen bypass. Teams external participant splash screen can be bypassed.
• Introducing ntdissector, a swiss army knife for your NTDS.dit files. Blog post to a tool release. The tool convert an NTDS file to well formatted JSON objects.
• EDR Evasion Part II: Your very own Scarecrow. A guide on what are some changes you can make to Scarecrow to evade EDRs. Part one of this series did a good job of walking through the capabilities of ScareCrow.
• A Thousand Sails, One Harbor - C2 Infra on Azure. Operational guidance on using Azure to hide your C2. Domain fronting in Azure is back on the menu!
• .NET Assembly Obfuscation for Memory Scanner Evasion. Having an automated way to obfuscate your payloads is becoming expected for moderately advanced red teams. How does your pipeline compare?
• Home Grown Red Team: LNK Phishing Revisited In 2023. Threat actors are using lnks with some truly gross command lines to great effect. This post has some alternative techniques for lnk based initial access.
• [P2O Vancouver 2023] SharePoint Pre-Auth RCE chain (CVE-2023-29357 & CVE-2023-24955). Wow. Makes you wonder what else has unauth RCE waiting to be discovered.
• nftables Adventures: Bug Hunting and N-day Exploitation (CVE-2023-31248). More good exploitation content from Star Labs; this time a nice Linux 6.2 LPE.
• Long Live the Pwn Request: Hacking Microsoft GitHub Repositories and More. GitHub actions and other types of CI/CD can be setup to run on pull requests or other actions where others control the code. Make sure they are appropriately locked down!
• MSIFortune - LPE with MSI Installers. Some excellent LPE ideas and even initial access ideas in this post.
• ZipLink - Combine Zips and Lnk for fun and profit. If the above was giving you ideas for initial access, check this post. A few clicks (zip + pop up), but not bad!
• Exploiting stale ADIDNS entries. Some fun DNS based tricks for domain compromise.
• A problem with .NET Self-Contained Apps and how to pop calculators in dnSpy. Update your dnSpy or get pop'd in the NK's next campaign targeting security researchers.

Tools and Exploits

• ExtractBitlockerKeys - Post-ex script to automatically extract the bitlocker recovery keys from a domain.
• transitiveObjectControl.py - Given transitive object control: output info on last hop, chain length, and type.
• MaldevAcademyLdr.1 - The team at Maldev Academy drop their first "openly released" loader.
• LOLBins- The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders understand how LOLBin binaries are used by threat actors during an intrusion in a graphical and digestible format for the TIPs platform using the STIX format.
• proxy_calls - Proof of Concept - Custom Call Stack for LoadLibrary with TrySubmitThreadpoolCallback/TpSimpleTryPost.
• LDAPWordlistHarvester - A tool to generate a wordlist from the information present in LDAP, in order to crack passwords of domain accounts.
• REC2 - New rust-based C2 (Yes another C2). Uses VirusTotal and Mastodon APIs.
• HeaderLessPE - A memory PE loading technique using HVNC.
• CVE-2023-29357- Patched June 2023 but... Microsoft SharePoint Server priv esc.
• JonMon - @jsecurity101 with a tool drop for defenders/attackers. "...collection of open-source telemetry sensors designed to provide users with visibility into the operations and activity of their Windows systems". Add this to your maldev boxes to see what defenders could be collecting on your actions.
• AD_Miner - Use your existing neo4j DB to find some quick wins (may not work well against large environments based on our testing).
• Sub7 - Source code for SubSeven 2.1.3 (if you're feeling nostalgic).
• CVE-2023-32364-macos-app-sandbox-escape - Exploit for CVE-2023-32364.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• Windows Hook Events. Short read by Mr. Yosifovich. Discusses the SetWinEventHook API in Windows for intercepting and processing user interface-related events.
• haylxon. Gowitness replacement? Blazing-fast tool to grab screenshots of your domain list right from terminal.
• graftcp. A flexible tool for redirecting a given program's TCP traffic to SOCKS5 or HTTP proxy.
• VcenterKit. vCenter Comprehensive Penetration and Exploitation Toolkit.
• go-exploit. A Go-based Exploit Framework.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• SMB NTLM blocking now supported in Windows Insider. The beginning of the end for NTLM relay attacks, but you know enterprise will still have it enabled for "legacy" support for 20 years.
• WASI support in Go. The Sliver crew is already looking at doing fun things with this.
• When MFA isn't actually MFA. "The caller claimed to be one of the members of the IT team, and deepfaked our employee'≈s actual voice." It finally happened. It's time to buy hardware keys for all your employees. There is no better defense against this type of advanced attack.
• 38TB of data accidentally exposed by Microsoft AI researchers. In the cloud, a signed URL can become a single factor that exposes a lot of data.
• Fileless Remote Code Execution on Juniper Firewalls. I can't decide if we should laugh or cry. Firewalls, do your one job!
• Cobalt Strike 4.9: Take Me To Your Loader. The Forta team is working hard to make Cobalt Strike even more modular as well as a bunch of other great enhancements.

Techniques and Write-ups

• Deleting Your Way Into SYSTEM: Why Arbitrary File Deletion Vulnerabilities Matter. Detailed write up of how to use a file delete for much more than denial of service.
• Azure Active Directory Domain Services Escalation of Privilege. Curious if the patch was just the PetitPotam patch...
• Bypassing UAC with SSPI Datagram Contexts. It's messy in the PoC state (creates a service) but a nice UAC bypass.
• Attacking an EDR - Part 2. With EDR going to the cloud for the heavy lifting in detection, if you can tamper with that network traffic, you can often blind the EDR.
• Using AI for extracting Usernames, Emails, Phone Numbers, and Personal Names from large datasets. Neat, but you'll need a local model to operate on any sensitive data.
• Hypervisor Detection with SystemHypervisorDetailInformation. Detect those sandboxes a little easier with cpuid - A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class.
• Okta for Red Teamers - This is fuego 🔥. The addition of a SAML authentication endpoint has been used by threat actors recently.
• CVE-2023-38146: Arbitrary Code Execution via Windows Themes. Looks like the fix might be incomplete - more research needed here! The PoC is: themebleed.
• Peeling back the curtain with call stacks. The elastic team has been on a good run recently with very technical posts.
• I hacked macOS!!! CVE-2022-32947 - With Lina✨ & Cyan💎. Very creative site to explain an extremely technical exploit. The final "demo" is impressive. Some people are truly wizards and Lina is one of them.
• Android 14 Still Allows Modification of System Certificates. Lots of claims stating Android 14 would break TLS interception, turns out, its still possible.
• The Not So Pleasant Password Manager. Some tough restrictions on XXS were bypassed to successfully leak credentials.

Tools and Exploits

• EchoDrv - Exploitation of echo_driver.sys.
• Caro-Kann - Encrypted shellcode Injection to avoid Kernel triggered memory scans
• malrdp-deploy - Automated (kinda) deployment of MalRDP infrastructure with Terraform & Ansible
• Periscope - Fully Integrated Adversarial Operations Toolkit (C2, stagers, agents, ephemeral infrastructure, phishing engine, and automation). Note: purposely broken by the author.
• NetExec - Crack Map Exec fork with different maintainers. Queue the drama.
• POSTDump is the C# / .NET implementation of the ReactOS minidump function (like nanodump), thus avoiding call to the Windows API MiniDumpWriteDump function.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• donut-decryptor - Retrieve inner payloads from Donut samples
• TierZeroTable - About Table of AD and Azure assets and whether they belong to Tier Zero
• Evilginx3-Phishlets - This repository provides penetration testers and red teams with an extensive collection of dynamic phishing templates designed specifically for use with Evilginx3.
• tracker-radar - Good for OSINT.
• GPOZaurr - Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.
• electroniz3r - Take over macOS Electron apps' TCC permissions.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.

News

• Mullvad on Tailscale: Privately browse the web - In case the Tailscale/Mullvad fans missed it.
• Active North Korean campaign targeting security researchers - Researchers have been and will always be a target. Share with those starting out in security research as well. You opened that project in a disposable VM, right?
• DEF CON 31 recordings are out! - In case you missed it.
• BLASTPASS NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild. Another zero click for iOS? Perhaps this prompted the new Apple Security Research Device Program.
• Google is aware that an exploit for CVE-2023-4863 exists in the wild.. Not to be left out of the 0day fun, Chrome also got an update to in-the-wild 0day.
• Results of Major Technical Investigations for Storm-0558 Key Acquisition. So a debug log contained the key due to a race condition, and it eventually got moved to a compromised machine (or so they think). Did the Storm-0558 actors get "lucky?" I suppose, but if you aren't waiting for a debug log containing the key by having compromised workstations, you won't get "lucky." And then to figure out how to use it to pillage emails from government customers... clearly this APT is serious.

Techniques and Write-ups

• Leveraging VSCode Extensions for Initial Access - Targeting developers? Try this for initial access.
• Bypassing Defender's LSASS dump detection and PPL protection In Go - A little PPL bypass with sysinternal drivers. Sysinternal drivers tend to flag against EDRs so test before use. Blog came with a tool.
• 4,500 of the Top 1 Million Websites Leaked Source Code, Secrets - Friendly reminder to include repos and source-code analysis in your recon workflow. Don't forget to try API keys even if they came from a previous commit, the developer may or may not have revoked those keys...
• GPOddity: exploiting Active Directory GPOs through NTLM relaying, and more! - "A new versatile attack vector: spoofing GPO location through the gPCFileSysPath attribute." Check out the GPOddity tool release as well.
• Lolbins for connoisseurs… Part 2 - Follow up to part 1. Good reminder that LOLbins may be used by other third-part software. This could break basic detections.
• Revisiting the User-Defined Reflective Loader Part 2: Obfuscation and Masking - "...introduced the User-Defined Reflective Loader Visual Studio (UDRL-VS) template"
• RE of LR3 - Peeking under the bonnet of the Litter Robot 3. Great, in depth, physical and mobile app hacking.
• Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023. A great Linux LPE write up and exploit code as well. This is the first LPE I've seen written in Go!
• From NTAuthCertificates to “Silver” Certificate. Some novel if not too sneaky persistence for a Windows domain.
• Shadow Wizard Registry Gang: Structured Registry Querying. Full steam ahead with the structured data train. Really excited to watch (and help?) Nemesis expand. The day tools adapt to it as the industry standard we'll know it has won.

Tools and Exploits

• guestlist - Labor day release from a DEF CON 31 talk. A tool for identifying guest relationships between companies.
• ETWListicle - List the ETW provider(s) in the registration table of a process.
• Issue 2451: Windows: System Drive Replacement During Impersonation EoP. Windows LPE patched 2023-08-14 with PoC.
• Introducing Session Hijacking Visual Exploitation (SHVE): An Innovative Open-Source Tool for XSS Exploitation. This is the coolest browser tool since the OG beef and Shadow Workers.
• Introducing Free Attack Surface Recon API by RedHunt Labs. Limited for now but free!
• caldera-ot - Caldera OT Plugin & Capabilities.

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• PurpleOps - An open-source self-hosted purple team management web application.
• Sekiryu - Comprehensive toolkit for Ghidra headless.
• Supernova - Real shellcode encryption tool.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing. This post is cross-posted on SIXGEN's blog.