v1n3gr3p retweeted
大企業でも被害が続く中、中小企業はどうセキュリティ対策を進めるか。
限られた人員と予算で、管理する資産やアクセスを整理する。その変更で攻撃者ができることを減らせたか、確かめる。
攻撃者の視点も交え、実際の改善につなげるための考え方をまとめてみました。
v1n3gr3p retweeted
Slides for my OffensiveCON - Japan '26 presentation 🇯🇵
blacktop.github.io/presentat…
v1n3gr3p retweeted
While everybody is prompting for PHP, recently I ended up having to dump the LSA in a custom way.
I have written a short article on the entire LSA decryption stack, with the C implémentation. 💫
Cross posted here blog.advens-c.tf/articles/ls… and here hideandsec.sh/books/windows-…
v1n3gr3p retweeted
AD Explorer snapshots without Windows.
github.com/crypt0p3g/adexsna…
adexsnap is a Python CLI that talks LDAP from Linux or macOS and writes a real AD Explorer .dat file. Open it in AD Explorer, feed it to ADExplorerSnapshot.py or BOFHound, ingest into BloodHound.
NTLM, Kerberos (ccache/kirbi), LDAPS. Built-in verifier.
Authorized use only. Hope it will be useful.
v1n3gr3p retweeted
Wrote a blog post about abusing signed Google Chrome installers to achieve arbitrary code execution
blog.amberwolf.com/blog/2026…
v1n3gr3p retweeted
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.
Now you can. Enjoy!
netspi.com/blog/technical-bl…
v1n3gr3p retweeted
Introduction to Windows shellcode development series
Part 1:- securitycafe.ro/2015/10/30/i…
Part 2:- securitycafe.ro/2015/12/14/i…
Part 3:- securitycafe.ro/2016/02/15/i…
#redteam #exploit #shellcode
v1n3gr3p retweeted
Babe, wake up. Someone finally dropped a sick macOS/Linux implant.
minorimpact.dev/posts/dark-a…
v1n3gr3p retweeted
Your browser is a C2 agent waiting to happen.
@KingOfTheNOPs shows how to silently sideload a Chromium extension, no prompts or GUI, and turn Chrome/Edge into a persistent implant with SOCKS, cookie theft, and OS access.
Read more 👇 ghst.ly/4g8AZif
v1n3gr3p retweeted
My recent talk from @x33fcon is now available on YouTube ☝️
v1n3gr3p retweeted
DEFCON 34: You can find our research here:
plugandpwn.com
You don't need a USB. You need to look like one.
Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen.
DEF CON 34 talk w/ @Qm9yamFN.
Link at the first comment.
v1n3gr3p retweeted
‼️ BREAKING: An active npm supply chain attack has compromised at least 868 packages carrying over 2 billion monthly installs with a credential-stealing worm. Shai-Hulud is back.
It started with the compromise of the GitHub account of the maintainer behind keyv, a library with roughly 127 million weekly npm downloads.
A preinstall hook fires on npm install and drops a stealer that sweeps npm, GitHub, AWS, Kubernetes and Vault secrets, and then spreads to more maintainers.
v1n3gr3p retweeted
New blog
Spent way too much time reverse engineering CrowdStrike Falcon.
Somewhere along the way, I found a bug. It's low and not practically exploitable... but a bug is a bug :)
Publishing soon
0xdbgman.github.io/posts/ins…
v1n3gr3p retweeted
Something seems to be brewing from beloved @ChaoticEclipse0 , git.projectnightcrawler.dev/… . Looking forward to it.
v1n3gr3p retweeted
During an engagement, and in an effort to bypass Crowdstrike, I figured out a new method to locally privilege escalate when having code execution as a Microsoft Virtual account using only a LoLbin(certreq) and some AD-CS magic.
I was successfully able to compromise the target with Crowdstrike present without needing to use potatoe class exploits. I wrote a blog about it here! abdulmhsblog.com/posts/iamma…
v1n3gr3p retweeted
Onelogon: Taking over Active Directory Accounts via Netlogon🔑
We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵
ALT Compromise an Active Directory Domain with the Onelogon vulnerability
ALT Scanning an AD domain for accounts vulnerable to Onelogon
