몾 Artemis @mixic@nanao.cybtex.fr

PE with spoofed sections

An undocumented trick to embed executable code within (what appears to be) a read-only PE section. The proof-of-concepts described above involve appending the payload to the end of the NT headers, but it is also possible to embed executable code within the headers.

Nice, x86matthew. Ping @siri_urz

https://secret.club/2023/06/05/spoof-pe-sections.html

• sample : https://secret.club/assets/pe_section_spoof/pe_section_spoof.zip

Abusing Microsoft SQL via ADSI

https://tarlogic.com/blog/linked-servers-adsi-passwords/

CVE-2023-2283 PoC

Public key auth bypass in libssh

https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283

fakeAmsiDll.cpp

Simply return `S_OK / AMSI_RESULT_CLEAǸ for every command

https://gist.github.com/eversinc33/beb43d05695de77a030c97ab769682ca

ShellSweep.ps1

https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/

🛠 nbutools

Tools for offensive security of NetBackup infrastructures

https://github.com/airbus-seclab/nbutools

Terminator

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

https://github.com/ZeroMemoryEx/Terminator

DavRelayUp

An universal no-fix local privilege escalation in domain-joined Windows workstations where LDAP signing is not enforced

https://github.com/Dec0ne/DavRelayUp

• ntrlmrelay.py_to_exe

https://github.com/LuemmelSec/ntrlmrelay.py_to_exe

🎸 Pinyo Kinyo r0x

ObjectWalker v2.1.6 by Rémi Gascou

#Python module to explore the object tree to extract paths to interesting targets / objects in memory

https://github.com/p0dalirius/objectwalker

• Process_String_Extractor.ps1

This scriplet is also able to extract Cookies for Microsoft O365 / Microsoft Azure PTC Attack

https://gist.github.com/LuemmelSec/3f2c4b7642dc7b2ae63601ed02ec3db5

A simple client for LOLDrivers

https://github.com/rtfmkiesel/loldrivers-client

dpapi-ng v0.1.0

Python DPAPI NG Decryption Library

https://github.com/jborean93/dpapi-ng

​​LOLDrivers

Living Off The Land Drivers is a curated list of Microsoft Windows drivers used by adversaries

https://www.loldrivers.io

The game of chess is like a sword fight. You must think first, before you move.

hem-hashes

HIEW module to calc MD5, SHA-1 & SHA-256 hashes of a given file/block

https://github.com/merces/hem-hashes

Hunt-Weird-Syscalls

This project uses kernel based ETW providers to monitor for IOCs

https://github.com/thefLink/Hunt-Weird-Syscalls