몾 Artemis @mixic@nanao.cybtex.fr

ida-rust-untangler

An IDA plugin for demangling Rust function names

https://github.com/cxiao/ida-rust-untangler

GetLolDrivers.ps

https://raw.githubusercontent.com/gtworek/PSBits/master/Sysmon/GetLolDrivers.ps1

IDA kmdf

This # python plugin helps the reverser & offers some confort at the beginning of an analysis

https://github.com/thalium/ida_kmdf

aioSMB v0.4.6

Fully asynchronous SMB fuzzer written in pure #python

https://github.com/skelsec/aiosmb

gmsad

gmsad manages Active Directory group Managed Service Account on Linux

Given the keytab of an account which has the ability to retrieve the secret of a gMSA, gmsad creates a keytab for the service account and renew it when necessary. It can execute an arbitrary command just after renewing the keytab.

https://github.com/cea-sec/gmsad

OpenWEC

A free & open source (GPLv3) implementation of a Windows Event Collector server running on GNU/Linux & written in Rust.

https://github.com/cea-sec/openwec

Blink v1.0

Blink is a brand new unprivileged userspace virtual machine that can emulate x86-64-linux binaries on any POSIX platform.

https://github.com/jart/blink/releases

HyperDbg v3.0

Native debugging tool

https://github.com/HyperDbg/HyperDbg/releases

osslsigncode

OpenSSL based Authenticode signing PE/MSI/Java CAB files

https://github.com/mtrojnar/osslsigncode

• Cracking PKCS#12 passwords

https://tij.me/blog/finding-and-utilising-leaked-code-signing-certificates/

Demo 38:15 - 41:18

https://www.youtube.com/watch?v=YnxGW8Fvqvk

https://raw.githubusercontent.com/yardenshafir/conference_talks/main/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf

PE with spoofed sections

An undocumented trick to embed executable code within (what appears to be) a read-only PE section. The proof-of-concepts described above involve appending the payload to the end of the NT headers, but it is also possible to embed executable code within the headers.

Nice, x86matthew. Ping @siri_urz

https://secret.club/2023/06/05/spoof-pe-sections.html

• sample : https://secret.club/assets/pe_section_spoof/pe_section_spoof.zip

Abusing Microsoft SQL via ADSI

https://tarlogic.com/blog/linked-servers-adsi-passwords/

CVE-2023-2283 PoC

Public key auth bypass in libssh

https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283

fakeAmsiDll.cpp

Simply return `S_OK / AMSI_RESULT_CLEAǸ for every command

https://gist.github.com/eversinc33/beb43d05695de77a030c97ab769682ca

ShellSweep.ps1

https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/

🛠 nbutools

Tools for offensive security of NetBackup infrastructures

https://github.com/airbus-seclab/nbutools

Terminator

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

https://github.com/ZeroMemoryEx/Terminator

DavRelayUp

An universal no-fix local privilege escalation in domain-joined Windows workstations where LDAP signing is not enforced

https://github.com/Dec0ne/DavRelayUp