Solution Architect @iCubed - I.T. Consultant, Speaker, Trainer, Red-Teamer,PenTester and Security Consultant, former Army Paratrooper. Opinions are my own
Italy
Joined January 2012
- Tweets2.3K
- Following254
- Followers577
- Likes23
Guglielmo Scaiola retweeted
#PingCastle 3.0 released !!!
pingcastle.com/download/
Active Directory & AzureAD security health check in seconds
>200k AD audited, management readable, no install, no admin, no data sent "to a cloud"
Example of report: pingcastle.com/PingCastleFil…
github: github.com/vletoux/pingcastl…
Guglielmo Scaiola retweeted
Today we're publishing new techniques for recovering NTLM hashes from encrypted credentials protected by Windows Defender Credential Guard.
These techniques also work on victims logged on before the server was compromised.
research.ifcr.dk/pass-the-ch…
Guglielmo Scaiola retweeted
Of course it's disputed... 😅 #keepass @harmj0y
Do not forget policies..., enforced ones !
> keepass.info/help/kb/config_…
"Disable trigger system" / "Disable trigger system, delete user triggers" + <ExportNoKey>false</ExportNoKey>
CVE-2023-24055 ** DISPUTED ** KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is th... cve.mitre.org/cgi-bin/cvenam…
Guglielmo Scaiola retweeted
Another #ShellcodePack video by @MC_Info_Sec! Stealthy XLL generation running a Sliver implant. With AV running in background of course :)
vimeo.com/728885276
Guglielmo Scaiola retweeted
"SharpEventPersist: Persistence by writing/reading shellcode from Event Log"
#pentest #redteam #infosec
github.com/improsec/SharpEve…
Guglielmo Scaiola retweeted
MS Defender for Endpoint detects Primary Refresh Token (PRT) extraction based on ProcessCreate event with BrowserCore.exe
Guess what?
Copy BrowserCore.exe to %TEMP%\random.exe - no more detections ¯\_(ツ)_/¯
Got it implemented in my sponsorware SharpPRT for anyone intersted :)
Guglielmo Scaiola retweeted
Reproduced the MS-MSDT Office RCE (on up-to-date Win10 and up-to-date Office 2019). Had some troubles with building the appropriate docx with external HTML reference, so quickly made some notes how to do it, step-by-step: gist.github.com/tothi/66290a…
Guglielmo Scaiola retweeted
Have multiple engagements, past and present? Wanting more flexibility in your download locations?
You asked, I listened. Now you can specify synchronization between Cobalt Strike download locations on a per TeamServer basis.
More tools coming shortly.
bit.ly/3FK0wM5
Guglielmo Scaiola retweeted
Today is #BOFFriday! Time for some new candy:
> New BOF for CVE-2022-26923
> New BOF KerbHash (hash passwds to kerberos keys)
> New BOF version of PetitPotam attack
> Domaininfo updated with Azure support
Check out the @OutflankNL C2-Tool-Collection repo: github.com/outflanknl/C2-Too…
Guglielmo Scaiola retweeted
"Shell Code Injector with AES Encryption - EDR Bypass"
#infosec #redteam #pentest
san3ncrypt3d.com/2022/03/24/…
Guglielmo Scaiola retweeted
Pull requests accepted for SharpUp! ProcessDLLHijack and ModifableScheduledTask modules are now available. github.com/GhostPack/SharpUp
Guglielmo Scaiola retweeted
"Taking the pain out of C2 Infrastructure (Part 1)"
#infosec #redteam #pentest
byt3bl33d3r.substack.com/p/t…
Part 2
#redteam #infosec #pentest
byt3bl33d3r.substack.com/p/t…
Guglielmo Scaiola retweeted
Obfuscating Malicious, Macro-Enabled Word Docs
#infosec #pentest #redteam
depthsecurity.com/blog/obfus…
Guglielmo Scaiola retweeted
New release: pe_to_shellcode (#pe2shc) v1.0 - with new stubs - added features & improvements: github.com/hasherezade/pe_to…
