MSF6

MSF6

Reading Time: 4 minutesMSF (Metasploit) version 6. Network possible detection ? OJ ( @TheColonial ) is a clever guy and a main contributor to the open source project of Metasploit. One of MSF6’s goal is to get rid of Strings in order to fly even lower … so close to...

Lsass Minidump file seen as Malicious by McAfee AV

Reading Time: 3 minutesThe other day, I was shadowing a colleague of me who was doing a red team. The client was running McAfee AV. While the reputation of that AV isn’t the best, it got a bit in the way for a few minutes. After doing a lateral movement, my...

IOCTL demistified

Reading Time: 5 minutesThis article is more of a my own notes and it may profit to others. This is a DRAFT for the moment. Recently, I followed a course on developement on Offensive Driver Developpement from zeropointsecurity (link here). I recommend following it,...

Escalate privileges with RemotePotato

Reading Time: 3 minutesGithub repo for the tool of Antonio Cocomazzi @splinter_code and Andrea Pierini @decoder_it : https://github.com/antonioCoco/RemotePotato0 Potato what ? In the last few years, we saw tools likes RottenPotato, RottenPotatoN, SweetPotato, Juicy...

webclient_activation

Reading Time: < 1 minuteFollowing reading an article from @CyberWarship : https://twitter.com/CyberWarship/status/1485623439633362946 The following test was done in my lab. in a share that users are connected on, create a file called...

RBCD WebClient attack

Reading Time: 6 minutesIn this post, I will explore the RBCD WebClient attack which has been described in many tweets and other forums, but I wanted to understand the main intricasis as I was learning it during a pentest engagement I had the chance to work on. I...

Log4j Detection with XDR

Reading Time: < 1 minuteA tiny articles to show that I implemented a Log4J scanner into XDR as a script you can run. XDR is not a vulnerability management tool, even do host-insight offers some kind of list of vulnerabilities. I used the original code created by...

Windows emtpy Hash

Reading Time: 2 minutesThis will be a very very small note article. When running Responder you might have gotten back hashes or while dumping LSASS memory or doing a DCSync. You might have read about the value : AAD3B435B51404EEAAD3B435B51404EE or from the NTDIS file...