Telegram Web Link
bootg.com » United States » Ralf Hacker Channel » Telegram Web
Ralf Hacker Channel
It's a tool to interact with remote hosts using the Windows Search Protocol and coerce authentication. The target host will connect over SMB to the listener host using the machine account.

https://github.com/slemire/WSPCoerce

#git #tools #pentest #redteam #ad #relay
15.5K viewsRalf Hacker, 
Ralf Hacker Channel
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
🔨KRBUACBypass

By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges.

Research:
https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html

Source:
https://github.com/wh0amitz/KRBUACBypass

#ad #kerberos #uac #bypass
18.2K viewsRalf Hacker, 
Ralf Hacker Channel
Escalate Service Account To LocalSystem via Kerberos.

https://github.com/wh0amitz/S4UTomato

#privesc #ad #redteam #pentest
GitHub
GitHub - wh0amitz/S4UTomato: Escalate Service Account To LocalSystem via Kerberos
Escalate Service Account To LocalSystem via Kerberos - wh0amitz/S4UTomato
20.0K viewsRalf Hacker, 
Ralf Hacker Channel
Пока тут тихо, кину Твиттер) Информация не дублируется, там много интересного...

https://twitter.com/hacker_ralf

P. S. А то ощущение, что почти одна АПТа подписывается😁
26.0K viewsRalf Hacker, 
Ralf Hacker Channel
This media is not supported in your browser
VIEW IN TELEGRAM
SCCM AdminService API уязвим к релей атакам🙈 Интересненько...

https://posts.specterops.io/site-takeover-via-sccms-adminservice-api-d932e22b2bf

#ad #redteam #pentest #sccm #relay
18.7K viewsRalf Hacker, 
Ralf Hacker Channel
Доклады с Black Hat USA 2023

https://github.com/onhexgroup/Conferences/tree/main/Black%20Hat%20USA%202023%20slides

#git #notes #pentest
GitHub
Conferences/Black Hat USA 2023 slides at main · onhexgroup/Conferences
Conference presentation slides. Contribute to onhexgroup/Conferences development by creating an account on GitHub.
40.6K viewsRalf Hacker, 
Ralf Hacker Channel
Forwarded from Pwn3rzs
acunetix_23.7_linux-pwn3rzs_cyberarsenal.7z
263.4 MB
acunetix_23.7_windows-pwn3rzs+cyberarsenal.7z
219.7 MB
added another check in bat file for admin rights (sigh)
15.7K viewsRalf Hacker, 
Ralf Hacker Channel
This media is not supported in your browser
VIEW IN TELEGRAM
CVE-2023-36874: Windows LPE

https://github.com/Wh04m1001/CVE-2023-36874

#git #exploit #lpe
17.5K viewsRalf Hacker, 
Ralf Hacker Channel
Спасибо всем, кого встретил и с кем пообщались на offzone))
12.4K viewsRalf Hacker, 
Ralf Hacker Channel
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
⚛️ Nuclei Templates AI Generator

Nuclei Template Editor - AI-powered hub to create, debug, scan, and store templates. Covering a wide array of vulnerabilities using public templates & rich CVE data.

📝 Note:
Current focus is HTTP, more protocols coming soon

🌐 Source:
https://templates.nuclei.sh
https://docs.nuclei.sh/editor

#nuclei #template #generator
13.2K viewsRalf Hacker, 
Ralf Hacker Channel
Довольно интересна и свежая серия статей, в частности по AD и чуть-чуть туннелям

1. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform

2. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2

3. https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3

#ad #pentest #redteam #lofl
15.7K viewsRalf Hacker, 
Ralf Hacker Channel
Ну вот и дождались... Теперь в Excel доступен python🫣

https://techcommunity.microsoft.com/t5/microsoft-365-blog/introducing-python-in-excel-the-best-of-both-worlds-for-data/ba-p/3905482

P.S. Майкрософт: макросы - это опасно, а python - норм😅

#pentest #redteam #blueteam #fishing
TECHCOMMUNITY.MICROSOFT.COM
Introducing Python in Excel: The Best of Both Worlds for Data Analysis and Visualization | Microsoft Community Hub
 
 
 
 
 
 
Today, we are excited to introduce the Public Preview of Python in Excel – making it possible to integrate Python...
21.5K viewsRalf Hacker, 
Ralf Hacker Channel
WinRAR <= 6.22: code execution PoC

https://github.com/b1tg/CVE-2023-38831-winrar-exploit

#git #exploit #pentest #redteam #fishing #initial
19.0K viewsRalf Hacker, 
Ralf Hacker Channel
Прикольный скрипт (PyQt) для проверки, эксплуатации и постэксплуатации VMWare vCenter

https://github.com/W01fh4cker/VcenterKit

#git #vmware #pentest #soft
15.1K viewsRalf Hacker, 
Ralf Hacker Channel
Хорошая статья от MDSec, как они "редтимили" разработчиков. Наиболее интересный момент - это разработка и публикация вредоносного расширения VSCode для фишинга и получения первоначального доступа.

https://www.mdsec.co.uk/2023/08/leveraging-vscode-extensions-for-initial-access/

#redteam #pentest #pishing #initial
MDSec
Leveraging VSCode Extensions for Initial Access - MDSec
Introduction On a recent red team engagement, MDSec were tasked with crafting a phishing campaign for initial access. The catch was that the in-scope phishing targets were developers with technical...
18.1K viewsRalf Hacker, 
Ralf Hacker Channel
Вот смотрю ещё один свежий материал по фишингу от TrustedSec. Главная идея: с помощью HTML инъекции отправить сообщение с доверенного домена.

https://www.trustedsec.com/blog/crafting-emails-with-html-injection

Т.е. это двойной фишинг получается?! Сложно пока, но интересно...

#pentest #redteam #fishing
TrustedSec
Crafting Emails with HTML Injection
Crafting emails with HTML injection vulnerabilities allows attackers to alter the email body, potentially revealing sensitive information or executing…
16.5K viewsRalf Hacker, 
Ralf Hacker Channel
Про NetNTLMv1 downgrade & relay в 2023 году

https://www.r-tec.net/r-tec-blog-netntlmv1-downgrade-to-compromise.html

#pentest #redteam #relay #creds
www.r-tec.net
NetNTLMv1 Downgrade to compromise
Easy to understand NetNTLMv1 downgrade, relaying stuff and further resources for those who want to get the bigger picture at the end of this post.
18.8K viewsRalf Hacker, 
Ralf Hacker Channel
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
🔄 Active Directory GPOs through NTLM relaying, and more!

Learn about a attack vector that exploits GPOs through NTLM relaying, potentially allowing unauthenticated attackers to abuse.

🌐 Source:
https://www.synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more

#ad #gpo #relay #ntlm
15.7K viewsRalf Hacker, 
Ralf Hacker Channel
Forwarded from SHADOW:Group
​​💻Что поискать на сайте с IIS?

1. Используем shortscan, для поиска коротких (а по возможности и полных) имен файлов и расширений.

2. Проверяем наличие реверс прокси и пробуем directory traversal:
/backend/ -> 10.0.0.1/api/
/backend/..%2Ftest -> 10.0.0.1/test
Подробнее можно почитать тут.

3. Когда удастся получить раскрытие файлов, смотрим ключи в web.conf и пробуем получить RCE через дисериализацию. Почитать об этом тут.

4. Пробуем грузить файлы .asp, .aspx, .ashx и тд (полный список тут)

#web #iis #rce
Please open Telegram to view this post
VIEW IN TELEGRAM
19.9K viewsRalf Hacker, 
2025/07/06 18:06:56
Back to Top
HTML Embed Code: