I'm a constant seeker and maker of troubles | InfoSec | Shortcut maniac | Virtualization junkie | Puzzles addicted
IT
Joined February 2010
- Tweets1.1K
- Following395
- Followers1.4K
- Likes1.2K
Pinned Tweet
I'm releasing with @decoder_it: Juicy Potato, another Local Privilege Escalation tool from a Windows Service Accounts to SYSTEM by abusing the golden privileges (ohpe.github.io/juicy-potato/)
Giuseppe`Ohpe`Trotta retweeted
During @offensive_con our @marver presented his research on security aspects of embedded SIM cards.
We are releasing SMShell, an SMS based implant proof of concept for Red Teaming that can evade out of band.
Blogpost: persistent-security.net/post…
GitHub: github.com/persistent-securi…
Embedded Threats: A Deep Dive into the Attack Surface and Security Implications of eSIM Technology by @marver now #OffensiveCon23
Giuseppe`Ohpe`Trotta retweeted
What’s it like to work at @Doyensec? Read below 👇 We’re hiring again appsec engineers
If you're the kind of person who enjoys performing innovative security research, complete flexibility in your work location and schedule, and being remote (permanently), while breaking software at the world's leading tech companies, @Doyensec is hiring !!
doyensec.com/careers.html
Giuseppe`Ohpe`Trotta retweeted
As I couldn't find anyone else who'd documented it, thought I'd look at SeTrustedCredmanAccessPrivilege. tiraniddo.dev/2021/05/dumpin…
Giuseppe`Ohpe`Trotta retweeted
This is some spectacular counterintelligence work and exploitation.
Research to discover a vulnerability, and then careful exploitation of that vulnerability so it never gets burned.
Tennis 0day
Giuseppe`Ohpe`Trotta retweeted
RemotePotato0 Update:
We can confirm that cross session activation works in the relay scenario too so you can get rid of session 0 limitation! Now the real fun will ensue 😈
cc @decoder_it
Inspired by @decoder_it and @splinter_code recent NTLM relay tricks I thought I'd check if it's possible to combine cross session and IStorage COM activation. The answer may surprise you! (not really) tiraniddo.dev/2021/04/standa…
Giuseppe`Ohpe`Trotta retweeted
When (NTLM) relaying potatoes lead you to domain admin...
A "permanent" 0day Privilege Escalation Vulnerability in Windows RPC Protocol ;-)
cc @splinter_code
Our writeup here:
labs.sentinelone.com/relayin…
Giuseppe`Ohpe`Trotta retweeted
v2.31.0 is out!
The number of fixes and new features is just too long to fit in a single screenshot :D
github.com/bettercap/betterc…
Giuseppe`Ohpe`Trotta retweeted
a tenacious kernel panic, happening in macOS network stack when bettercap tries to inject packets in the interface in monitor mode (read only works) ... happening on M1 as well ... can somebody at Apple fix this please? github.com/bettercap/betterc…
Giuseppe`Ohpe`Trotta retweeted
Following my "old" blog post decoder.cloud/2020/05/30/the… , I have published the very quick & dirty "juicy_2" code github.com/decoder-it/juicy_… , maybe useful when you have impersonation privs on newer versions of Windows 10 & Server 2019 cc @splinter_code @Giutro
Giuseppe`Ohpe`Trotta retweeted
MuraenaTeam strikes again.
Together with @Giutro we released the new Muraena and NecroBrowser. Lots of new code+features.
Phishing and post-phishing automation at scale for all your needs. Office365 and GitHub examples added. More coming soon 🎣🪝😎
github.com/muraenateam
Giuseppe`Ohpe`Trotta retweeted
Hands off my service account! decoder.cloud/2020/11/05/han…
Giuseppe`Ohpe`Trotta retweeted
love offensive mobile security and are looking for a job? my new company is hiring! shoot us an email at [email protected]
Giuseppe`Ohpe`Trotta retweeted
It has a few more prerequisites, but I finally managed to get a #Zerologon exploit working that doesn't rely on resetting passwords to exploit. Use the printerbug to make DC1 connect to you, then with lots of magic relay that to DC2 directly to DRSUAPI to DCSync 😁
Giuseppe`Ohpe`Trotta retweeted
RELEASE: Evilginx 2.4 "Gone Phishing" update is OUT NOW!
Read all about it: breakdev.org/evilginx-2-4-go…
Giuseppe`Ohpe`Trotta retweeted
We’re hiring interns at @BHinfoSecurity for a bunch of R&D projects! (All internships are payed & remote). Applicants must of some basic C# and Python knowledge. If you’re interested send me your resume and we’ll talk! (DMs are open)
Giuseppe`Ohpe`Trotta retweeted
My new post on my new blog :D
Weaponizing Mapping Injection with Instrumentation Callback for stealthier process injection
splintercod3.blogspot.com/p/…
Giuseppe`Ohpe`Trotta retweeted
Just released a paper titled 'hematic for Success in Real-World Offensive Cyber Operations – How to make threat actors work harder and fail more often' - research.nccgroup.com/2020/0…
Giuseppe`Ohpe`Trotta retweeted
Today we release our blog post that demonstrates a new single request exploit for CVE-2019-19781 that is effective even if all of the "vulnerable" Perl files have been deleted 🙀
We also share stats on devices that are patched but still contain backdoors
blog.fox-it.com/2020/07/01/a…
Giuseppe`Ohpe`Trotta retweeted
Finally, my research is published. It has everything you might wish for in browser security: universal XSS, mutation XSS, CSS data exfiltration, and others. Check this out! In a few days, we'll also release a 30-minute presentation about this topic.
We are publishing the research of Copy&Paste issues in browsers by @SecurityMB. Over $30k in bounties for bugs in Chromium, Firefox, Safari, Google Docs, Gmail, TinyMCE, CKEditor, and others. Includes also 0-day in Froala.
research.securitum.com/the-c…