Butler - GitHub Actions Oversight
Started as a security scanner and pivoted to a visibility/oversight tool for GitHub Actions. Identify 3rd party actions, deprecations, secrets etc across any GitHub org.
Tool and sample reports for large orgs at: github.com/sadreck/Butler
As of today, Codecepticon, Spartacus, CrackerJack, and SnitchDNS will be maintained under github.com/sadreck
Original repos have been archived.
Spartacus v2.2.0 is out!
👉Generate self-signed certificates and sign DLL/EXE files
👉Use the CommandLineGenerator.html to build your CLI command
👉Add commonly used examples in the release zip file
👉Bug fixes / PR merges
github.com/Accenture/Spartac…
Pavel retweeted
I made an easy decision tree for anyone considering using git submodules or a monorepo.
Pavel retweeted
Neutralising AMSI System-Wide as an Admin - @sadreck
pavel.gr/blog/neutralising-a…
I just got off a flight that was 50% children.
To the Sony engineers who worked on noise cancelling headphones, I wish your beer is always cold and the traffic lights are always green.
Proxying DLLs is more than just running your beacon.
Here's a blog post on how to use Spartacus v2.1 and "neutralise" AMSI by replacing the legit amsi.dll and keeping Defender happy. This post is more like a PoC than an exploit.
pavel.gr/blog/neutralising-a…
Pavel retweeted
A guide to building your engagement infrastructure, by André Tschapeller (@hipstertrojan)
#redteam
securesystems.de/blog/buildi…
Spartacus v2.0.0 is out, trying to unCOMplicate hijacking:
👉Added support for identifying COM hijacking
👉Still supports DLL hijacking (clearly!)
👉Generates full Visual Studio solutions for DLLs
👉Supports proxying individual DLL functions
github.com/Accenture/Spartac…
Pavel retweeted
And the good people at @securityfest cut the individual talks out of the recorded live stream and put them on YouTube.
This is my talk...
youtu.be/U36hAneQeZM
My talk "Tales from the %TEMP%" is available on the @securityfest live stream recording (starts at 1:04:56).
youtube.com/live/136Fe1Pnn2M…
Pavel retweeted
When Linux is the only solution
ALT First Saw movie, man holding handsaw realizing it's to cut through his leg not the chains
Huh, perhaps Person of Interest *did* predict the future about AI. If you haven't watched it, now is the time. One of the best shows out there!
m.imdb.com/title/tt1839578/
In the year 2023 companies are storing CVV numbers in plaintext. I found out the hard way as someone used my card at "battlelog.co".
Quite glad it was a @RevolutApp card which meant I could disable it straight away and get a new one without any dramarama.
Pavel retweeted
We've just released the first post in the Cobalt Strike reflective loader blog series! 🥷This one took allot of effort and I am excited to share it with you! The better it does, the better i'll make the next ones 😉
securityintelligence.com/pos…
Following a feature request, Spartacus v1.2.0 supports:
👉Replication of VERSIONINFO from the original DLL
👉Replication of date created/modified via timestomping
Both are automatically applied when creating a proxy using the --generate-proxy command
github.com/Accenture/Spartac…
A fresh blog post about using Codecepticon to obfuscate and sign #Rubeus, dropping detections from 50/70 to 16/70.
pavel.gr/blog/obfuscating-ru…
