Windows Drivers Reverse Engineering Methodology
https://voidsec.com/windows-drivers-reverse-engineering-methodology
@WindowsHackingLibrary
https://voidsec.com/windows-drivers-reverse-engineering-methodology
@WindowsHackingLibrary
VoidSec
Windows Drivers Reverse Engineering Methodology
Methodology for reverse engineering Windows drivers, finding vulnerabilities and understanding their exploitability.
Sandboxing Antimalware Products for Fun and Profit
https://elastic.github.io/security-research/whitepapers/2022/02/02.sandboxing-antimalware-products-for-fun-and-profit/article
@WindowsHackingLibrary
https://elastic.github.io/security-research/whitepapers/2022/02/02.sandboxing-antimalware-products-for-fun-and-profit/article
@WindowsHackingLibrary
Forwarded from w0rk3r's Blue team Library (Jonhnathan Jonhnathan Jonhnathan)
Exploring Windows UAC Bypasses: Techniques and Detection Strategies
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
@BlueTeamLibrary
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
@BlueTeamLibrary
Introducing the Golden GMSA Attack
https://www.semperis.com/blog/golden-gmsa-attack
@WindowsHackingLibrary
https://www.semperis.com/blog/golden-gmsa-attack
@WindowsHackingLibrary
Semperis
gMSA Active Directory Attacks | Semperis AD Guides
Group Managed Service Accounts (gMSAs) are vulverable to attacks called a "Golden gMSA". Learn more about GMSA Active Directory attacks on our blog.
Group Policy Folder Redirection CVE-2021-26887
https://decoder.cloud/2022/04/27/group-policy-folder-redirection-cve-2021-26887
@WindowsHackingLibrary
https://decoder.cloud/2022/04/27/group-policy-folder-redirection-cve-2021-26887
@WindowsHackingLibrary
Decoder's Blog
Group Policy Folder Redirection CVE-2021-26887
Two years ago (march 2020), I found this sort of “vulnerability” in Folder Redirection policy and reported it to MSRC. They acknowledged it with CVE-2021-26887 even if they did not real…
KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).
https://github.com/Dec0ne/KrbRelayUp
@WindowsHackingLibrary
https://github.com/Dec0ne/KrbRelayUp
@WindowsHackingLibrary
GitHub
GitHub - Dec0ne/KrbRelayUp: KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP…
KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings). - Dec0ne/KrbRelayUp
Analysing LastPass, Part 1
https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1
@WindowsHackingLibrary
https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1
@WindowsHackingLibrary
MDSec
Analysing LastPass, Part 1 - MDSec
Having been in IT longer than I care to remember, one issue keeps coming up. It doesn’t matter how well you have implemented <insert security mechanism> what really matters is...
Fantastic Rootkits: And Where to Find Them (Part 1)
https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1
@WindowsHackingLibrary
https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1
@WindowsHackingLibrary
Cyberark
Fantastic Rootkits: And Where to Find Them (Part 1)
Introduction In this blog series, we will cover the topic of rootkits — how they are built and the basics of kernel driver analysis — specifically on the Windows platform. In this first part, we...
At the Edge of Tier Zero: The Curious Case of the RODC
https://posts.specterops.io/at-the-edge-of-tier-zero-the-curious-case-of-the-rodc-ef5f1799ca06
@WindowsHackingLibrary
https://posts.specterops.io/at-the-edge-of-tier-zero-the-curious-case-of-the-rodc-ef5f1799ca06
@WindowsHackingLibrary
Medium
At the Edge of Tier Zero: The Curious Case of the RODC
The read-only Domain Controller (RODC) is a solution that Microsoft introduced for physical locations that don’t have adequate security to host a Domain Controller but still require directory…
External Trusts Are Evil // Breaking Trust Transitivity
https://exploit.ph/external-trusts-are-evil.html
@WindowsHackingLibrary
https://exploit.ph/external-trusts-are-evil.html
@WindowsHackingLibrary
I’ve Got a Golden Twinkle in My Eye
The Kerberos Ticket Granting Ticket (KRBTGT) account is one of the most important accounts in a Windows Active Directory (AD) domain. Once the KRBTGT account has been exposed to an attacker this can allow them to conduct the Golden Ticket (GT) attack, which can grant them persistence, unfettered access, and may allow for privilege escalation in AD. This talk will stress the importance of the KRBTGT account and why it is often a high value target (HVT) for attackers. A detailed examination of the GT attack and defence techniques will be demonstrated.
https://www.youtube.com/watch?v=ABd0dm8MbDo
@WindowsHackingLibrary
The Kerberos Ticket Granting Ticket (KRBTGT) account is one of the most important accounts in a Windows Active Directory (AD) domain. Once the KRBTGT account has been exposed to an attacker this can allow them to conduct the Golden Ticket (GT) attack, which can grant them persistence, unfettered access, and may allow for privilege escalation in AD. This talk will stress the importance of the KRBTGT account and why it is often a high value target (HVT) for attackers. A detailed examination of the GT attack and defence techniques will be demonstrated.
https://www.youtube.com/watch?v=ABd0dm8MbDo
@WindowsHackingLibrary
YouTube
I’ve Got a Golden Twinkle in My Eye
SANS PenTest HackFest 2022
Speakers: Andrew Schwartz, Practice Lead, TrustedSec & Charlie Clark, Security Researcher, Semperis
The Kerberos Ticket Granting Ticket (KRBTGT) account is one of the most important accounts in a Windows Active Directory (AD)…
Speakers: Andrew Schwartz, Practice Lead, TrustedSec & Charlie Clark, Security Researcher, Semperis
The Kerberos Ticket Granting Ticket (KRBTGT) account is one of the most important accounts in a Windows Active Directory (AD)…
Windows Secrets Extraction: A Summary
https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary
@WindowsHackingLibrary
https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary
@WindowsHackingLibrary
Synacktiv
Windows secrets extraction: a summary
CVE-2023-38146: Arbitrary Code Execution via Windows Themes
https://exploits.forsale/themebleed/
@WindowsHackingLibrary
https://exploits.forsale/themebleed/
@WindowsHackingLibrary
Inside Microsoft's plan to kill PPLFault
"In this research publication, we'll learn about upcoming improvements to the Windows Code Integrity subsystem that will make it harder for malware to tamper with Anti-Malware processes and other important security features."
https://www.elastic.co/security-labs/inside-microsofts-plan-to-kill-pplfault
@WindowsHackingLibrary
"In this research publication, we'll learn about upcoming improvements to the Windows Code Integrity subsystem that will make it harder for malware to tamper with Anti-Malware processes and other important security features."
https://www.elastic.co/security-labs/inside-microsofts-plan-to-kill-pplfault
@WindowsHackingLibrary
www.elastic.co
Inside Microsoft's plan to kill PPLFault — Elastic Security Labs
In this research publication, we'll learn about upcoming improvements to the Windows Code Integrity subsystem that will make it harder for malware to tamper with Anti-Malware processes and other important security features.
Pwned by the Mail Carrier
> How MS Exchange on-premises compromises Active Directory and what organizations can do to prevent that.
https://posts.specterops.io/pwned-by-the-mail-carrier-0750edfad43b
@WindowsHackingLibrary
> How MS Exchange on-premises compromises Active Directory and what organizations can do to prevent that.
https://posts.specterops.io/pwned-by-the-mail-carrier-0750edfad43b
@WindowsHackingLibrary
Medium
Pwned by the Mail Carrier
How MS Exchange on-premises compromises Active Directory and what organizations can do to prevent that
SeeSeeYouExec: Windows Session Hijacking via CcmExec
https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec
@WindowsHackingLibrary
https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec
@WindowsHackingLibrary
Google Cloud Blog
SeeSeeYouExec: Windows Session Hijacking via CcmExec | Google Cloud Blog
The Windows Registry Adventure #1: Introduction and research results
https://googleprojectzero.blogspot.com/2024/04/the-windows-registry-adventure-1.html
@WindowsHackingLibrary
https://googleprojectzero.blogspot.com/2024/04/the-windows-registry-adventure-1.html
@WindowsHackingLibrary
Blogspot
The Windows Registry Adventure #1: Introduction and research results
Posted by Mateusz Jurczyk, Google Project Zero In the 20-month period between May 2022 and December 2023, I thoroughly audited the Win...
w0rk3r's Windows Hacking Library
The Windows Registry Adventure #1: Introduction and research results https://googleprojectzero.blogspot.com/2024/04/the-windows-registry-adventure-1.html @WindowsHackingLibrary
The Windows Registry Adventure #2: A brief history of the feature
https://googleprojectzero.blogspot.com/2024/04/the-windows-registry-adventure-2.html
@WindowsHackingLibrary
https://googleprojectzero.blogspot.com/2024/04/the-windows-registry-adventure-2.html
@WindowsHackingLibrary
Blogspot
The Windows Registry Adventure #2: A brief history of the feature
Posted by Mateusz Jurczyk, Google Project Zero Before diving into the low-level security aspects of the registry, it is important to u...