몾 Artemis @mixic@nanao.cybtex.fr

OpenWEC

A free & open source (GPLv3) implementation of a Windows Event Collector server running on GNU/Linux & written in Rust.

https://github.com/cea-sec/openwec

Blink v1.0

Blink is a brand new unprivileged userspace virtual machine that can emulate x86-64-linux binaries on any POSIX platform.

https://github.com/jart/blink/releases

HyperDbg v3.0

Native debugging tool

https://github.com/HyperDbg/HyperDbg/releases

osslsigncode

OpenSSL based Authenticode signing PE/MSI/Java CAB files

https://github.com/mtrojnar/osslsigncode

• Cracking PKCS#12 passwords

https://tij.me/blog/finding-and-utilising-leaked-code-signing-certificates/

Demo 38:15 - 41:18

https://www.youtube.com/watch?v=YnxGW8Fvqvk

https://raw.githubusercontent.com/yardenshafir/conference_talks/main/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf

PE with spoofed sections

An undocumented trick to embed executable code within (what appears to be) a read-only PE section. The proof-of-concepts described above involve appending the payload to the end of the NT headers, but it is also possible to embed executable code within the headers.

Nice, x86matthew. Ping @siri_urz

https://secret.club/2023/06/05/spoof-pe-sections.html

• sample : https://secret.club/assets/pe_section_spoof/pe_section_spoof.zip

Abusing Microsoft SQL via ADSI

https://tarlogic.com/blog/linked-servers-adsi-passwords/

CVE-2023-2283 PoC

Public key auth bypass in libssh

https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283

fakeAmsiDll.cpp

Simply return `S_OK / AMSI_RESULT_CLEAǸ for every command

https://gist.github.com/eversinc33/beb43d05695de77a030c97ab769682ca

ShellSweep.ps1

https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/

🛠 nbutools

Tools for offensive security of NetBackup infrastructures

https://github.com/airbus-seclab/nbutools

Terminator

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

https://github.com/ZeroMemoryEx/Terminator

DavRelayUp

An universal no-fix local privilege escalation in domain-joined Windows workstations where LDAP signing is not enforced

https://github.com/Dec0ne/DavRelayUp

• ntrlmrelay.py_to_exe

https://github.com/LuemmelSec/ntrlmrelay.py_to_exe

🎸 Pinyo Kinyo r0x

ObjectWalker v2.1.6 by Rémi Gascou

#Python module to explore the object tree to extract paths to interesting targets / objects in memory

https://github.com/p0dalirius/objectwalker

• Process_String_Extractor.ps1

This scriplet is also able to extract Cookies for Microsoft O365 / Microsoft Azure PTC Attack

https://gist.github.com/LuemmelSec/3f2c4b7642dc7b2ae63601ed02ec3db5