Windows Offensive Security Enthusiast 🤠 Blog: https://xitter.cf/t.co/CAwdjs2rKS GitHub: https://xitter.cf/t.co/YG2YOxfosm
Amsterdam, The Netherlands
Joined March 2016
- Tweets240
- Following107
- Followers1.7K
- Likes266
📡 To accomplish persistence, creating a shortcut in the Startup folder using the (unofficial) New-Shortcut cmdlet.
🛜 Checking IP configuration and testing routing using Get-NetIPAddress and Test-NetConnection.
🔐 Checking TLS certificate chain details using Invoke-WebRequest.
💻 User/session reconnaissance, on both the local as well as remote machines using the Get-LocalUser and Get-WinStation (unofficial) cmdlet.
📄 Hunting for authentication details of a specific user in the DC Security event log using Get-WinEvent.
Cool, novel, lateral movement technique by @william_knows by dropping a .dll file on a remote host obtaining code execution! 💡
Per suggestion of @jelleverg, added the memory-efficient json2csv.py script to the dir2json repository. As a bonus also added dir2csv.py to convert the output of cmd.exe's dir /s /a command to csv. Useful to avoid PowerShell's logging mechanisms 😉 Enjoy!
Have you ever been stuck at a red team and needed to plow through the local filesystem/shares in an attempt to find credentials? 🧐 This blog and new tool will greatly increase successes and efficiency for this tedious job! 😃
📖 blog.bitsadmin.com/blog/digg…
⚙ github.com/bitsadmin/dir2jso…
Because in the 24H2 release of Windows 11 vbscript is being phased out, the missingkbs utility for Windows Exploit Suggester - Next Generation (#WESNG) is now also available in PowerShell flavor! 🙂
🎯 Check out missingkbs.ps1 @ github.com/bitsadmin/wesng
ALT missingkbs.ps1 running on Windows 11
Windows Exploit Suggester - Next Generation v1.0 has been released! Including the new missingkbs.vbs utility and an in-depth blog post on how to use it: Windows Security Updates for Hackers. Latest #WESNG release: github.com/bitsadmin/wesng, blog: bitsadm.in/blog/windows-secu…
#LOFLCAB highlight: reg.exe
Persistence in registry or reconnaissance, e.g. listing recent mstsc.exe connections: "\\W10\HKEY_USERS\S-1-5-...\Software\Microsoft\Terminal Server Client\Servers"
📄 Details: lofl-project.github.io/loflc…
🎞 Full quality video: blog.bitsadmin.com/living-of…
Excited to finally publish research which in the background I have been working on for several years!😃
Introducing Living Off the FOREIGN Land (#LOFL), using a Windows VM over SOCKS as offensive platform✨
📖 blog.bitsadmin.com/living-of…
🏝 lofl-project.github.io/
More info ⬇️
ALT Illustration of the Living Off the Foreign Land (LOFL) setup where an attacker can use Living Off the Foreign Land Cmdlets and Binaries (LOFLCABs) go over the Linux routing VM which uses SOCKS to reach the target network.
#LOFLCAB highlight: New-NetEventSession cmdlet
Using Event Tracing for Windows (ETW) for offensive purposes: Sniff network traffic on a remote machine without installing additional tooling 🔥
📄 Details: lofl-project.github.io/loflc…
🎞 Full quality video: blog.bitsadmin.com/living-of…
Excited to finally publish research which in the background I have been working on for several years!😃
Introducing Living Off the FOREIGN Land (#LOFL), using a Windows VM over SOCKS as offensive platform✨
📖 blog.bitsadmin.com/living-of…
🏝 lofl-project.github.io/
More info ⬇️
ALT Illustration of the Living Off the Foreign Land (LOFL) setup where an attacker can use Living Off the Foreign Land Cmdlets and Binaries (LOFLCABs) go over the Linux routing VM which uses SOCKS to reach the target network.