몾 Artemis @mixic@nanao.cybtex.fr
247365
Inscrit·e en mar. 2022
serviceDetector
Detect whether a service is installed (blindly) and/or running (if exposing named pipes) on a remote machine via SMB without using local admin privileges.
ThreadlessInject-BOF
A novel process injection technique with no threat creation, released at BSides Cymru 2023
ThreadlessInject
Threadless Process Injection using remote function hooking
Cortex-XDR-Config-Extractor
Cortex XDR Agent (
Database Lock Files) parser
https://github.com/Laokoon-SecurITy/Cortex-XDR-Config-Extractor
KeePwn
Python tool to automate KeePass discovery & secret exfiltration
RustScan
RustScan is a tool that turns a 17 minutes Nmap scan into 19 seconds.
Dynamic Assembly Loader
DotNet Assembly Loader using a Dynamic Method & Emitted MSIL instructions
https://gist.github.com/sdcampbell/41dcaef1068b6b44fd05ac1d3a0dc661
asminject
Injects arbitrary assembly or precompiled binary payloads directly into x86-64, x86, and ARM32 Linux processes without the use of ptrace
몾 Artemis
a partagé
#AADInternals @bsidesorlando edition is out now!
New functionality:
▪ Get access tokens for managed identities
▪ Add new MOERA domains (.onmicrosoft.com)
And as demonstrated in my BSides Orlando talk:
▪ Modify #AzureAD policy details (including Conditional Access metadata) without detailed Audit Log events
Change log: https://aadinternals.com/aadinternals/#version-info
Havoc v0.4.1
Havoc is a modern and malleable post-exploitation command and control framework
Socks4aproxy support
https://github.com/HavocFramework/Havoc/commit/133f6ead8085147dc39beb368c41aead2873927e
ntfsDump
Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures
💭 Used successfully for reading ntds.dit on a DC
CrackMapExec module to dump Microsoft Teams cookies ( mpgn, ησυѕєℓєѕѕтє¢н, KuiilSec )
https://gist.github.com/mpgn/100ae809fde94ac58f4bc610580f705b
Mimikatz
2.2.0-20220919
[legacy] Backport djoin parser & Citrix SSO password extractor
https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20220919
Pyramid
The main purpose of the tool is to perform offensive tasks by leveraging some Python evasion properties and looking as a legit Python application usage.
RunasCs
Added flag
--bypass-uacthat allows to spawn a process as an Administrator (if password is known) with full privileges
247365
Inscrit·e en mar. 2022
