AO
@cloudmeister_hx
Followers
79
Following
426
Media
21
Statuses
231
Red Team Operator, Ex DMU Hackers Chair, InfoSec enthusiast and general hackist. All views/opinions are my own.
England, United Kingdom
Joined November 2019
Try red teaming a Finnish bank as a non-native speaker.... Where every group, user, computer etc looks like "verkkotunnuksen järjestelmänvalvojat"
Security though obscurity doesn’t really work….
10
27
224
Please reply with other weird Windows admin tricks
Dumb trick: To send Ctrl+Alt+Del to an RDP within RDP, on the jumpbox (2nd-layer) open OSK.exe and click Ctrl+Alt+End. This will send it to the 3rd-layer.
34
52
333
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
117
906
1K
Another AMSI bypass alternative, usable from for example C++/C/Nim binaries as amsi.dll is not loaded there by default: https://t.co/4isRAszjLC
waawaa.github.io
Hi everyone! Here suffering (again) the high temperatures and hoping winter to come back again.
2
85
216
Just added the two new AMSI bypass PoC's via Provider Patching into my Amsi-Bypass-Powershell repo. Plus one PoC in Nim as pull request for OffensiveNim: https://t.co/CSqnqAuUaz
https://t.co/4W8RSPuzVG Tested both, works perfectly fine. 👌 (1/2)
6
172
453
Oh holy Nimikätz / custom invoke-mimikatz If you want the l33t shit for your next engagement you should: Read -> https://t.co/ZCP5OP1M9e Read -> https://t.co/8ulbUEyZJY Use -> https://t.co/WNRJrDGGIz from @danielhbohannon Use -> private tools from @ShitSecure by sponsoring him
2
114
317
I found an IDOR vulnerability in two @Halfords_uk services in January and April that is leaking customer data such as: full name, home address, email, phone number, VRM + more. I've tried to responsibly disclose this for over 5 months but have had no real response.
3
7
16
Don't even bother activating #windows. It's so easy to get all the locked features without paying or using some weird activator (a thread👇)
29
237
956
You will see more if you configure your #SysInternal tools properly. 💡 1. dbghelp.dll from WinDbg 2. symbols path
2
35
151
I hate tweets like this but as a last resort... does anyone have a security contact for @Halfords_uk
0
8
5
Fancy some new garms? For the chance to win a @PortSwigger t-shirt (as modelled by our @JesscaHaworth) and a bag of Swig goodies RT this and follow us (if you haven't already)✌️
17
149
174
It always gets confusing for me to understand the difference between a URL, URI, and a URN until I stumbled upon this brilliant article from @DanielMiessler. https://t.co/hn00bpNFDC
2
59
187
Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam
48
817
3K
PowerView similar tools, but on Linux: Impacket (PR Pending): https://t.co/gAaSvUB1RB BloodyAD: https://t.co/PE2oe8VUyN acltoolkit: https://t.co/mGHiQVs52a Useful for ACL attack paths
6
83
224
Pretty stoked that I finally got Red Team Ops approved against the CREST Certified Simulated Attack Specialist (CCSAS) examination.
21
44
464
alternate but similar for domain initial access: 1.) unauth #PetitPotam against (unpatched) DC 2.) ntlmrelay it (with socks) to any SMB with no sign enforced (using #impacket) 3.) RID cycle through the socks using the relayed session: profit = userlist 4.) pw spray
[HackTip ⚒] If you're having troubles brute forcing Net-NTLMv2 captured with responder/mitm6, it may be time to spray some P@ssw0rds 💨 To get a list of domain users with no creds you can relay SMB auth to any domain host with signing OFF and go for RID cycling via #impacket ⬇️
6
60
219
Microsoft Security has been tracking criminal actor DEV-0537 (LAPSUS$) targeting organizations with data exfiltration and destructive attacks - including Microsoft. Analysis and guidance in our latest blog:
microsoft.com
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model...
15
583
1K
Short write-up, covering AppLocker bypass by hash caching misuse:
gtworek.github.io
Simple (relatively) things allowing you to dig a bit deeper than usual.
As #AppLocker verifies the CACHE of a hash, and not the real hash of a file, you can manipulate the file content and then run it without any warning. The only requirement is to change your file in a way not spotted by the NTFS driver. Enjoy the video:
2
40
96
