Offensive Twitter

😈 [ drm @lowercase_drm ]

TIL you can ask the DC to resolve a foreign security principal by querying the msds-principalname (hidden) attribute. The DC will use the trust secret to perform authentication against the foreign domain and then call LsarLookupSids3 (so it even works with selective auth).

🐥 [ tweet ]

😈 [ mpgn @mpgn_x64 ]

If you want to first blood a windows box in @hackthebox_eu every minute counts ! 🩸
I've added a special flag --generate-hosts-file so you just have to copy past into your /etc/hosts file and be ready to pwn as soon as possible 🔥

🐥 [ tweet ]

😈 [ Octoberfest7 @Octoberfest73 ]

There are some interesting detections for U2U/UnPAC the hash in certipy/rubues/mimiktaz/impacket based on TGS ticket options. Did some tinkering and by removing a few flags you can shake detection while still recovering the NT hash from a TGT.

🔗 https://medium.com/falconforce/falconfriday-detecting-unpacing-and-shadowed-credentials-0xff1e-2246934247ce

🐥 [ tweet ]

😈 [ Cerbersec @cerbersec ]

nc -lvnp 4444
python -c 'import pty; pty.spawn("/bin/bash")'

🐥 [ tweet ]

спать, режим

😈 [ Thomas Roccia 🤘 @fr0gger_ ]

New LOL project, LOLAD a collection of Active Directory techniques!👇

🔗 https://lolad-project.github.io/

🐥 [ tweet ]

Лайфхак, как найти офсеты до интересующего символа в пачке PE разных ревизий Windows

1. Идем на winbindex.m417z.com, ищем нужный бинарь.
2. Сохраняем страничку локально (нормальной апихи не завезли, а результаты формируются на клиент сайде).
3. Граббим версии и ссылочки на загрузку (pup в помощь):
curl -s 'http://127.0.0.1/ntdll.dll%20-%20Winbindex.htm' | pup 'td:nth-of-type(5) text{}'
curl -s 'http://127.0.0.1/ntdll.dll%20-%20Winbindex.htm' | pup 'td:nth-of-type(8) a[href] attr{href}'
4. Формируем команды вида (ниже), копипастим в консоль, ждем пока все загрузится:
curl -sSL https://msdl.microsoft.com/download/symbols/ntdll.dll//ntdll.dll -o ntdll_.dll
5. Питоним скрипт для Binary Ninja по базовому экзамплу, получаем список офсетов:
import sys
import hashlib
from pathlib import Path
from multiprocessing import Pool, cpu_count, set_start_method

import binaryninja as bn

pe_dir = Path(sys.argv[1])
symbol_name = sys.argv[2]

def spawn(dll_path):
bn.set_worker_thread_count(2)
with bn.load(dll_path, update_analysis=True) as bv:
symbol_obj = bv.get_symbol_by_raw_name(symbol_name)
if symbol_obj:
with open(dll_path, 'rb') as f:
md5sum = hashlib.md5(f.read()).hexdigest()
print(f'[*] {dll_path.name}:{md5sum} -> {hex(symbol_obj.address)}')

if __name__ == '__main__':
set_start_method('spawn')
processes = cpu_count()-1 if cpu_count() > 1 else 1
pool = Pool(processes=processes)

results = []
for dll_path in pe_dir.glob('*.dll'):
results.append(pool.apply_async(spawn, (dll_path,)))

output = [result.get() for result in results]
Результат может быть полезен, например, для оценки примерных границ при поиске паттерна, когда заморачиваться с крафтом более аккуратного паттерна под все ОС лень, а так можно считерить и вывезти на грязном паттерне и более узких границах поиска:
PVOID getPattern(BYTE* pattern, DWORD patternSize, BYTE* startAddress) {
BYTE* addr = startAddress;
while (addr != (BYTE*)startAddress + 0xffff - patternSize)
{
if (addr[0] == pattern[0])
{
DWORD j = 1;
while (j < patternSize && (pattern[j] == '?' || addr[j] == pattern[j])) j++;
if (j == patternSize) return addr;
}
addr = addr + 1;
}

return NULL;
}