Twitter has a "like" bug that lets you artificially inflate by repeatedly clicking the like button. Wrote quick POC, just copy the xpath from the heart of a tweet and paste in chrome console:
for (var i = 0; i < 100; i++) { var hax = document.evaluate(COPIED_XPATH, document,
Want to create great phishing links using an open-redirect on ? While they don't last forever, they are a great way to trick unsuspecting victims into clicking a legit looking URL before expiring! Follow the 🧵for how it works..
Dropping a new initial access technique via RDP that I dubbed "Rogue RDP". Use malicious .RDP files to bypass email/servers/security gateways and then run code to binary plant/exfil from your own RDP server, blinding EDR. Bonus: Target runs HyperV? RCE!
A quick method to bypass an EDR. Even aggressive EDR's can be bypassed. Allocate your shellcode, overwrite a WNF subscription callback in a userland process, and trigger the WNF state change.. Old but relevant example follow for more fun soon to come!
I got caught hacking the Buzz Lightyear ride at Disney by the in-game cameras. I was tired of my wife beating me every time so I took a picture of the high value target and repeatedly shot the picture on my phone. I had the idea too late to win but it’s game on next time! 🤓
FireProx has been released! If you're tired of using limited proxy servers or expensive EC2/VPS instances for rotating IP addresses then check out FireProx. It spins up a pass-through API Gateway proxy on AWS which will rotate your IP with every request!
New process injection technique dropped from BlackHat EU! Freaking cool.
Dirty Vanity abuses the Windows forking (process reflection and snapshotting) to evade EDR using.
Slides:
POC:
Shout-out to
@eliran_nissan
!
Healthy reminder: there are troves of amazing infosec people that you have never heard of because they don’t speak at conferences or have a platform on Twitter... like troves..
CrowdStrike has some of the most sophisticated technology and smartest engineers I've ever known. I've seen the inside of the sensor and read through lots of eng docs when I worked there, it's just a simple mistake with huge ramifications.
If you gain access to a company GitHub, look for <filename>.PublishSettings (don't forget commit history) and you might just find access to Microsoft Azure resources in plain-text.
#azure
#redteam
Check out a new tool I just released! An asynchronous password spraying tool in C# for Windows environments that takes into consideration fine grained password policies and can be ran over Cobalt Strike's execute-assembly.
I didn't realize Google dropped a neat open-source vulnerability scanner written in Go. Looks like it scans lockfiles, packages, and commit hashes. Performs the scan using the OSV API.
I know a lot of people are always asking about good OSCP study resources. After stumbling onto this while looking for something else, I figured I’d share it in case others might find it useful.
Shout-out to
@sgtdede
!
I wanted to share some exciting news I've been sitting on. I recently started a new role at
@CrowdStrike
doing R&D for their red team. The last few years have been an amazing journey w/ BHIS, who will always be fam! My new direction has me back in the lab weaponizing TTPs. 👨🔬🧪💥
So.. I've picked up a new non-tech side hobby and am excited to finally launch! If you are a coffee drinker, check out my new Zero Day Roast at ! Also looking for swag sponsors who want to throw in infosec related swag. New roasts every Monday/Tuesday.
My life is a complete mess right now.. falling apart at the seams. Not even going to fake it. I know It’ll get better but right now, I’m not doing good. I know where my strength comes from tho, I got this - friends or no friends.
Gaining Access to AWS Web Console via stolen access keys & awscli in 7 steps. (thread)
Step 1) Create a temp user
aws iam create-user --user-name haxuser
1/7
I also dropped a fun POC for ChatGPT. AWS + ChatGPT = CloudGPT. Pull your AWS policies and check to see if they are vulnerable by asking ChatGPT. :) Just set your OpenAI key and configure your AWS CLI. A real tool will be released soon, webcast coming soon
First of many to come from the new
@CrowdStrike
Red Team Labs .. :) Some pretty awesome tradecraft for "Staying Off the Land" written by a co-worker of mine. Check it out!
My big news: Running a consulting firm is stressful, I've also grown weary of only cloud testing. I'm stoked to share, I joined the Targeted Operations Red Team at
@TrustedSec
💪🏼back to the red team grind! Shout out to an old friend,
@curi0usJack
, for the invite to join🫡
OpenAI is hiring for a red team lead up to $370k salary. Highest salary I’ve seen but I guess for San Francisco that’ll probably get you a nice size apartment.
Awesome! For Sublime Text 3 cached files it’s
Windows: C:\Users\user\AppData\Roaming\Sublime Text 3\Local
Mac: ~/Library/Application Support/Sublime Text 3/Local/
Linux: ~/.config/sublime-text-3/Local/
Red-Teamers:
[lazy]People like me use Notepad++ as a note-taking thing. We create a 'new', then never get around to saving them.
They get cached here:
C:\Users\{username}\AppData\Roaming\Notepad++\backup
If you hit a dev/sysadmin, you'll find all kinds of crazy stuff.
My girls were practically begging me to teach them to skate so I busted out my board. Thought about you
@DAkacki
the entire time! First try in double digit years and I almost actually landed it hah
Released a new tool to password spray using AWS Lambdas for IP rotation across regions. Currently, it supports spraying GSuite accounts, be on the lookout for more plugins soon. It auto-provisions execution role, lambdas and the deployment package. Enjoy!
@424f424f
and I dropped some new initial access TTP's for your red team engagement at
@WWHackinFest
. You can leverage RDP files to bypass email attachment blocklists to plant C2 binaries, exfil data & steal clipboards.. or just phish Azure tokens!
#wwhf
Haven't tested in a few months but here's a quick method to bypass a well-known EDR.
Compile your C# payload as a DLL, stage the DLL on a file share, create a loader that uses Assembly.LoadFile() with the file share path for the DLL and Invoke()!
Follow for more fun soon to come
I just released a tool I wrote awhile back called Gold Digger. It's nothing fancy but can be pretty helpful when needing to scan through a lot of files looking for credentials and other sensitive information. I use it on cloud pentests.
Password spraying AD? Check the badPwdCount for the account before trying a password and if doesn't increase afterwards then it's one of the previous 2 passwords.
Just dropped a super simple ChatGPT terminal client which uses the OpenAI API. It's nothing fancy but it's very useful. No more fighting users on the web interface or waiting for it to come back online. Enjoy!
Like Evilginx? Like GoPhish? Check out
It even has the ability to leverage CloudFlare Turnstile for stopping bots and some new phishlets for O365, KnowBe4, and Cisco VPN.
On an AWS pentest, I found cleartext passwords in CloudFormation Stack Outputs. Here's an easy way to check:
for region in {"us-east-1","us-east-2"}; do aws --region $region cloudformation describe-stacks --query 'Stacks[*].[StackName, Description, Parameters, Outputs]'; done
Most people know about Assembly.Load() but there are a number of alternative System.Reflection Assembly loaders for C#:
UnsafeLoadFrom()
LoadFile()
LoadFrom()
LoadModule()
ReflectionOnlyLoad()
ReflectionOnlyLoadFrom()
Enjoy!
Tried running PowerView on an end-point with multiple EDR products.. detected and blocked as expected. Decided to copy/paste into notepad, search and replace
@harmj0y
and
@mattifestation
names along with the script name.. bypassed and worked fine. smh 🤦♂️
Someone was learning afl and fuzzed ping to find a 24 year old bug lol goes to show that just because you read about people finding cool stuff doesn’t mean there’s still not other cool stuff to find.
Here are my slides from "Welcome to the Jungle: Pentesting AWS" at
@BSidesTampa
today. Met a lot of cool people! Feel free to hit me up if you have questions about AWS pentesting.
So most of you know by now that I launched an infosec coffee last year and the support has been pretty legit. A lot of people asked for a dark roast and it's finally here! Check out the Intense dark roast using the coupon code REDTEAM
Pretty cool blog on finding gold in SCCM distribution points. I find these shares all the time but don't investigate them. Definitely not passing them up from now on, I've likely been missing creds, keys, certs, etc!
SCCMContentLib$ for the win
CloudGPT is now public! A vulnerability scanner for AWS customer-managed policies using ChatGPT w/ built-in account redaction and reconciliation. Enjoy!
I support
@defcon
in their mask policy, they should have the freedom to run the con how they see fit. Don’t like it? Don’t go. I don’t like it, it’s mainly why I stayed home. They followed their convictions and I can respect that. How about appreciating them for holding the con?
Looks like my relationship with Google has started the reconciliation process. :) They contacted and invited me into the Google Vulnerability Research Program then gave me a grant for my security research into GSuite! Awesome opportunity to work at making GSuite even stronger.
Dropped a small utility that splits a large BloodHound/AzureHound JSON file into a bunch of smaller files. Is helpful when you encounter a large environment and have a multi-gb JSON file.
I've been coding all weekend and using ChatGPT for everything from converting SQLite queries into Python3 classes to having ChatGPT generate a bunch of safe queries. It's way better than using StackOverflow and Google. It turns all the tedious work into copy/paste.
Excellent summary from my co-workers on some quick wins using misconfigurations for red teamers to leverage on an engagements. It also has some great feedback for IT/security remediations .. definitely worth the read!
Excellent post from
@424f424f
on using DirectSend to spoof Microsoft 365! Special shout out to
@33y0re
&
@jack_halon
for introducing me to this originally.
If you knew about this but not why it works in some cases but not others, check out the post.
27 days left until I begin the life of a farmer. It’s kind of surreal yet exciting! Solar powered farming + crypto mining on a homestead ran by technology. I also think I’ve convinced the wife to let me call it “Crypto Farms” 🤠 maybe I’ll start blogging again ..
I'm convinced AWS insecurity with open policies is actually because no one wants to burn 4 hours trying to configure VPC's, NAT gateways, route tables, subnets, security groups, elastic IP's, and internet gateways just so a lambda can talk to internal/external resources
#ragequit
Just to answer a few q’s.. CrowdStrike is a great company with great talent and a great product, it was just a wrong turn for me personally. I decided to accept my mistakes and cut my loss now so I can recalibrate on what matters. I’ve received so much love from the community! ❤️
If you admin AWS, you should check to make sure none of your AMIs are set to public if you don't want them mounted/exfil'd by an attacker who gains access to the AMI ID. An attacker launching an EC2 instance w/ a public AMI from a free tier account is easy w/ huge implications 🤷♂️
This is bad. Don't do this..
"Action": "SNS:Publish",
"Effect": "Allow",
"Principal": { "AWS": "*" }
If you this on an AWS pentest, you can publish to a topic and potentially trigger phishing email/SMS notifications to distribution groups. All from a free tier AWS account. 😏
tool drop time! powerpwn is an offensive/defensive security toolset for Microsoft 365 focused on Power Platform
give it a guest account to get full dumps of sql/azure data you shouldn't have access to
but wait, there's more
#BHUSA
@BlackHatEvents
@defcon615
More GPT gold! IATelligence extracts the import address table from a portable executable then uses GPT to provide context around the Windows API and cross-references to Mitre ATT&CK techniques. Shout-out to
@fr0gger_
2nd day back skateboarding after double digit years. Almost road away from my hardflip .. bummed I only have a few trick attempts before being drained of energy.
#skatesec
#almost40hardflip
Bypassing AV & EDR detection by playing with file names. The security tools think the files MUST end in .exe or .dll, but they don't.
Currently, it's bypass Defender AV & EDR, Crowdstrike, and Palo.
Thanks for
@mrd0x
for this info!
Super cool and invisible credential brute forcing in AzureAD (no event logs) that Microsoft deems a design choice and won’t patch. Anyone know if lockout thresholds still apply in this scenario? cc:
@dafthack
@424f424f
My wife and I have been home schooling our kids for a number of years and I work from home. If anyone needs any advice, recommendations, or just wants to chat.. shoots DM my way and I’ll help support you through this. Love y’all!
Interested in leaking NTLM v1/v2 hashes over the internet w/ MS Office? Check out how
@dafthack
and I pulled it off in this weeks episode of Tradecraft Security Weekly Episode 21
JQ - is one of the most popular command line utilities for extracting and processing data from JSON files.
Here is a ultimate cheatsheet to the most useful JQ functions for
#osint
,
#dfir
, and
#forensics
:
Contributors
@SANSInstitute
@DavidSzili
Excellent post from
@kxngcodes
using a modified version of
@SwiftOnSecurity
Sysmon config to catch Rogue RDP! Other good intel discussed too. Worth a read
When new pentesters aren’t prepared for real life roadblocks because the cert testing environments they practiced in are by default vulnerable, they lose hope. Don’t give up when you hit a wall, take a break and know it’s broken somewhere... you just have to find where.
Quick and easy way to retrieve emails for all git commit authors. There's probably an easier way, but this worked.
git log | grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" | sort | uniq -c | sort -nr
Need a tool to circumvent firewall restrictions? I built FireProx so people could rotate their IP using AWS, to access websites without restrictions. Be sure to add/set the header My-X-Forwarded-For so your IP doesn’t leak. Stay safe out there.
For everyone that asked about slides or didn't get to attend
@joff_thyer
& I's talk at BSides Tampa, here is the deck/repo. The talk was recorded and will be made available!
Offensive Python for Pentesting
Super grateful for the opportunity to share back with the community through the invitation of
@TribeOfHackers
!
#redteamedition
Can't wait to get my copy, I am glad to be a part of the book and look forward to reading the stories of those I admire in the industry.
Found this pretty useful cheatsheet/deep-dive that explains firewalls by referencing the ufw wrapper for iptables. Figured I'd share since it brought me some value.
Grace is when your wife wakes up for breakfast only to find you left all the groceries in the trunk after grocery shopping the evening before, everything is spoiled, and she doesn't kill you but laughs it off instead. 💀
Solid call stack spoofing implementation that uses cool techniques to hide the original stack, remove the base image, and a ROP gadget to restore everything. Really good work and research in this area! Shout-out to
@waldoirc
@KlezVirus
and
@trickster012