@bitsadmin

Windows Offensive Security Enthusiast 🤠 Blog: https://xitter.cf/t.co/CAwdjs2rKS GitHub: https://xitter.cf/t.co/YG2YOxfosm

 Amsterdam, The Netherlands
bitsadmin.com/
Joined March 2016
  • Tweets240
  • Following107
  • Followers1.7K
42Media
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Malware authors often hide their tracks using COM, but our latest guide provides the roadmap you need to decode those cryptic vtable calls and finally see exactly what’s happening under the hood: cs.co/6014BDgbFs
4
14
2,356
Arris Huijgen retweeted
Abdul Mhanni
@abdo_mhanniJun 24
Wrote a new blog about caveats with tools detecting(or mis detecting) relay exploit primitives against http(ESC8) and MSSQL endpoints. Kept noticing issues in tools reporting the absence or presence of vulns that I thought others may have noticed too abdulmhsblog.com/posts/pitfa…

When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss

Recently on engagements I started experiencing two reoccurring patterns, the first being that certipy and certify would both show me that a endpoint is not vulnerable to the ESC8 attack even though...

abdulmhsblog.com
2
20
4
60
10,864
I just added @ExploitDB as additional source of exploits to #WESNG's collector making "Windows Exploit Suggester - Next Generation" even more comprehensive for identifying unpatched vulnerabilities and exploiting those. Happy hacking! 😎 github.com/bitsadmin/wesng

GitHub - bitsadmin/wesng: Windows Exploit Suggester - Next Generation

Windows Exploit Suggester - Next Generation. Contribute to bitsadmin/wesng development by creating an account on GitHub.

github.com
8
15
650
Small updated to DRSAT just pushed that will also allow Group Policy Editor and Certificate Authority / Templates MMC snap-ins work over a TCP only SOCKS connection. github.com/CCob/DRSAT

GitHub - CCob/DRSAT: Disconnected RSAT - A method of running Group Policy Manager, Certificate...

Disconnected RSAT - A method of running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domain joined machies - CCob/DRSAT

github.com
4
62
1
155
15,254
Many more examples are in the CHEATSHEET at github.com/bitsadmin/nopower… or use the Get-Help/man command followed by the cmdlet, e.g. man iwr. Regularly new cmdlets are added in NoPowerShell's DEV branch so keep an eye there to get the latest and greatest! 🔥 github.com/bitsadmin/nopower…
1
2
204
🔎 Inspecting ACLs and file hashes using the Get-Acl and Get-FileHash cmdlets.
1
224
📡 To accomplish persistence, creating a shortcut in the Startup folder using the (unofficial) New-Shortcut cmdlet.
1
112
🛜 Checking IP configuration and testing routing using Get-NetIPAddress and Test-NetConnection. 🔐 Checking TLS certificate chain details using Invoke-WebRequest.
1
142
🗄️ Running queries on Microsoft SQL Server using the Invoke-Sqlcmd cmdlet.
1
177
💻 User/session reconnaissance, on both the local as well as remote machines using the Get-LocalUser and Get-WinStation (unofficial) cmdlet. 📄 Hunting for authentication details of a specific user in the DC Security event log using Get-WinEvent.
1
1
350
Because the last release of #NoPowerShell was 2 years ago and to celebrate the repo has 999 stars, I just merged DEV ➡️ MASTER and published Release 1.50 containing over 60 offensive cmdlets! 🥳 github.com/bitsadmin/nopower… See examples of some of the cmdlets below 👇

GitHub - bitsadmin/nopowershell: PowerShell rebuilt in C# for Red Teaming purposes

PowerShell rebuilt in C# for Red Teaming purposes. Contribute to bitsadmin/nopowershell development by creating an account on GitHub.

github.com
1
46
2
139
8,390
Replying to @malmoeb
Interesting! Back in 2020 I wrote a blog on how to remotely over WMI create a shadow copy of SAM or NTDS.dit and use the @GMT syntax to download it over SMB. See details here: blog.bitsadmin.com/extractin…

Extracting credentials from a remote Windows system - Living off the Land

How to obtain the credentials from a remote machine or Domain Controller making only use of Windows' built-in functionality? This post will go through the steps of using WMI and SMB in PowerShell...

blog.bitsadmin.com
2
12
385
Arris Huijgen retweeted
Yuval Gordon@YuG0rd21 May 2025
🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️ Read Here - akamai.com/blog/security-res…
22
370
18
872
170,186
Arris Huijgen retweeted
Yehuda Smirnov@yudasm_16 May 2025
What if you skipped VirtualAlloc, skipped WriteProcessMemory and still got code execution? We explored process injection using nothing but thread context. Full write-up + PoCs: blog.fndsec.net/2025/05/16/t…

New Process Injection Class: The CONTEXT-Only Attack Surface

What happens when you skip memory allocation, skip writing, and weaponize thread context alone? This post explores a new class of process injection that lives entirely in the execution layer — no a…

blog.fndsec.net
6
73
1
220
13,981
Arris Huijgen retweeted
S3cur3Th1sSh1t@ShitSecure7 May 2025
Blogpost from my colleague about what’s still possible with recently published COM/DCOM toolings, Cross Session Activation and Kerberos relaying 🔥 r-tec.net/r-tec-blog-windows…

r-tec Blog | Windows is and always will be a Potatoland

This blog post will dive into the world of some of the recently published potato techniques that can lead to more serious risks than

r-tec.net
3
108
2
301
26,113
Arris Huijgen retweeted
Atsika
@_atsika30 Apr 2025
ProxyBlob is alive ! We’ve open-sourced our stealthy reverse SOCKS proxy over Azure Blob Storage that can help you operate in restricted environments 🔒 🌐 github.com/quarkslab/proxybl… Blog post for more details right below ⬇️

GitHub - quarkslab/proxyblob: SOCKS5 proxy tool that uses Azure Storage services as a means of...

SOCKS5 proxy tool that uses Azure Storage services as a means of communication. - quarkslab/proxyblob

github.com
quarkslab@quarkslab29 Apr 2025
Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS? It's ProxyBlob, a reverse proxy over Azure. Check out @_atsika's article on how it came to exist after an assumed breach mission ⤵️ 👉 blog.quarkslab.com/proxyblob…
Proxybloby is the red teamer's mascot. Be careful, if left alone in you network it will byte your SOCKS

ALT Proxybloby is the red teamer's mascot. Be careful, if left alone in you network it will byte your SOCKS

3
45
112
9,186
Cool, novel, lateral movement technique by @william_knows by dropping a .dll file on a remote host obtaining code execution! 💡
William Knowles@william_knows28 Apr 2025
.NET GAC and NIC hijacking for lateral movement: williamknowles.io/net-gac-an…
23
153
16,943
Arris Huijgen retweeted
Andrea P@decoder_it24 Apr 2025
I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…

From NTLM relay to Kerberos relay: Everything you need to know

While I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and …

decoder.cloud
2
149
2
348
19,769
The S is for Security. How to use WinRMS as a solid NTLM relay target, and why it’s less secure than WinRM over HTTP. By @Defte_ Writeup: sensepost.com/blog/2025/is-t… PR to impacket: github.com/fortra/impacket/p… Demo: youtu.be/3mG2Ouu3Umk
1
43
1
117
9,997
Load more