Sr. Information Security Engineer (red teamer) at a Fortune 500. I ❤️ CTFs, Photography, and video games. [email protected]
Joined August 2008
- Tweets1.6K
- Following1.2K
- Followers1.4K
- Likes8.1K
Kail retweeted
Seeing a LOT of incorrect media reports — including from some meteorologists — tying AT&T outage to the back-to-back solar flares.
They are NOT related.
The R3 shortwave radio blackout was on the wrong side of Earth. Cell phones are also not in the 3 to 30 MHz frequency band.
Kail retweeted
We've just published a quick write up on CVE-2023-23397, which allows a remote adversary to leak NetNTLMv2 hashes: mdsec.co.uk/2023/03/exploiti… by @domchell
Kail retweeted
interesting APT28 malloc which uses no macro, the document is a PowerPoint file that exploits a code execution technique in a ahyperlink. which is designed to be triggered when the user starts the presentation mode and moves the mouse.
Kail retweeted
More car hacking!
Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.
Here's how we found it, and how it works:
Kail retweeted
PersistAssist v0.2 is live! Tons of cool additions in this version I'm excited to share including more tradecraft modules, new persistence methods, and some quality of life features. Keep an eye out for the upcoming blog post 🙂
Check it out here!
github.com/FortyNorthSecurit…
Kail retweeted
Imagine you'd get access to an unknown SIEM of a new customer & would be given 10min to find malicious activity by using keyword searches on raw data, what would you search for?
I'll start
'.dmp full'
'whoami'
'delete shadows'
'FromBase64String'
'save HKLM\SAM'
' -w hidden '
Kail retweeted
With Twitter's change in ownership last week, I'm probably in the clear to talk about the most unethical thing I was asked to build while working at Twitter.
🧵
Kail retweeted
this is how I run mimikatz today on a (default config) Defender for Endpoint protected host. just reused my recent stager with a basic custom socket server. this libpeconv stuff is more powerful than I first thought :)
here is a basic meterpreter protocol stager for PE stages using the libpeconv project by @hasherezade:
github.com/tothi/stager_libp…
no evasion included, using this only as a template. but already able to run it with a Sliver EXE beacon as a stage against Defender for Endpoint.
Kail retweeted
Introducing ShadowSpray, it's like password spray but with shadow credentials. More info in the repo.
Huge thanks to @elad_shamir for the amazing technique and to @harmj0y (and others) for the implementation in Rubeus from which a lot of code was taken.
github.com/Dec0ne/ShadowSpra…
Kail retweeted
Jesus… can open, worms everywhere. You basically can’t find anyone more credible than @dotMudge in infosec so this is a massive deal
edition.cnn.com/2022/08/23/t…
Kail retweeted
If you're interested by an alternative way to dump domain users' NT hashes and TGT without touching LSASS, take a look at the new Masky tool :)
Everything is explained in this article: z4ksec.github.io/posts/masky…
Thanks @harmj0y, @tifkin_ and @ly4k_ for their amazing work on ADCS!
Kail retweeted
🔥 New Post: Announcing InAppBrowser - see what JavaScript commands get injected through an in-app browser
👀 TikTok, when opening any website in their app, injects tracking code that can monitor all keystrokes, including passwords, and all taps.
krausefx.com/blog/announcing…
Kail retweeted
github.com/CodeXTF2/Burp2Mal…
turn burpsuite HTTP requests into malleable c2 profiles (work in progress)
Kail retweeted
New blog post for HInvoke. It allows calling .NET runtime functions or accessing properties using only hashes as identifiers. Reducing obvious identifiers for analysts. Post also includes a little trick to avoid using PInvoke.
dr4k0nia.github.io/dotnet/co…
Kail retweeted
16 new entries added to lots-project.com
Thanks for the contributions.
