@snowscan
 Canada
snowscan.io
Joined January 2009
  • Tweets377
  • Following436
  • Followers6.2K
14Media
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet. Now you can. Enjoy! netspi.com/blog/technical-bl…

BOFScale: A CDN-Fronted Tailnet from a BOF-PE

Discover how BOFScale leverages a modified Tailscale daemon compiled as a BOF-PE to seamlessly hide C2 traffic and DERP relays behind CDNs using standard WebSockets.

netspi.com
15
197
11
754
67,891
Snowscan retweeted
0xedh@0xedhAug 7
You don't need a USB. You need to look like one. Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen. DEF CON 34 talk w/ @Qm9yamFN. Link at the first comment.
17
267
14
1,268
144,421
Snowscan retweeted
Soroush Dalili
@irsdlJul 16
YSoNet now supports interactive mode + autocomplete in PowerShell. String obfuscation has also been added to GitHub builds to reduce false detections, alongside several bug fixes. Enjoy, and contributions are always welcome! ysonet.net | ysonet.com
3
13
41
4,405
Snowscan retweeted
SpecterOps@SpecterOpsApr 2
Relayed NTLM creds are powerful, if you can use them. @senderend shows why browsers fail through ntlmrelayx SOCKS and introduces ghostsurf to make NTLM-authenticated web apps accessible. Read more ⤵️ ghst.ly/4tnJOtx

ghostsurf: From NTLM Relay to Browser Session Hijacking

Why ntlmrelayx's HTTP SOCKS proxy fails with browsers, how kernel-mode auth silently kills relay sessions, and a tool built to fix both.

specterops.io
2
91
2
274
18,183
And the source code: github.com/hasherezade/waiti…

GitHub - hasherezade/waiting_thread_hijacking: Waiting Thread Hijacking - injection by overwriting...

Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread - hasherezade/waiting_thread_hijacking

github.com
2
22
103
6,356
My new blog for Check Point Research - check it out! 💙 // #ProcessInjection : #WaitingThreadHijacking
Check Point Research
@_CPResearch_14 Apr 2025
Thread Execution Hijacking is one of the well-known methods that can be used to run implanted code. In this blog we introduce a new injection method, that is based on this classic technique, but much stealthier - Waiting Thread Hijacking. Read More : research.checkpoint.com/2025…

Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking - Check Point Research

Research by: hasherezade Key Points Introduction Process injection is one of the important techniques used by attackers. We can find its variants implemented in almost every malware. It serves...

research.checkpoint.com
18
132
4
471
92,412
Snowscan retweeted
SkelSec@SkelSec27 Feb 2025
#pypykatz new version 0.6.11 is out on github and pip. Big thanks to all awesome contributors!! Besides the fixes, the two important things in this version: - Kerberos aes keys extraction is now supported - !!!!Windows 24H2 support is here!!!!! github.com/skelsec/pypykatz/…

Release 0.6.11 · skelsec/pypykatz

What's Changed Supporting Windows 24H2 dumps @skelsec :) Fixing Service User Bug by @brettgus in #169 Fix Python 3.12 SyntaxWarning (use raw strings) by @X0RW3LL in #163 aesKey extraction by @...

github.com
5
52
1
141
14,619
Snowscan retweeted
NetSPI@NetSPI14 Nov 2024
Introducing PowerHuntShares 2.0 Release! NetSPI VP of Research @_nullbind introduces new insights, charts, graphs, & LLM capabilities that can be used to map the relationships & risks being exposed through the network shares: ow.ly/6Rjo50U7tNr
3
35
4
106
15,883
Just got some nice swag from @vulnlab_eu 😄
6
4
128
8,625
CcmPwn is equipped with various modules. The “exec” module runs an AppDomainManager Injection payload for every logged-in user. The “coerce” module coerces SMB/HTTP authentications, which can then be used for password cracking or relay attacks. 👇 github.com/mandiant/CcmPwn

GitHub - mandiant/ccmpwn

Contribute to mandiant/ccmpwn development by creating an account on GitHub.

github.com
17
67
4,742
Found a flaw in NetBSD's utmp_update allowing injection of ASCII escape sequences into utmpx logs, leading to unexpected terminal emulator behavior and utmpx database integrity concerns. ftp.netbsd.org/pub/NetBSD/se… #NetBSD #Security
1
14
2
20
6,672
Struggeling to get those precious certificates with #certipy and AD CS instances that do not support web enrollment and do not expose CertSvc via RPC? @qtc_de has you covered and added functionality to use DCOM instead of good old RPC #redteaming github.com/ly4k/Certipy/pull…

Add DCOM support for req command by qtc-de · Pull Request #201 · ly4k/Certipy

In the last few months, we encountered more and more ADCS instances that neither supported web enrollment, nor exposed the CertSvc via plain RPC. The output of certipy req looks like this in that c...

github.com
3
70
150
13,605
Snowscan retweeted
Dirk-jan
@_dirkjan1 Dec 2023
It's been quiet for a while around bloodhound Python, however I'm happy to share that I am now maintaining the project at my personal GitHub. The latest version fixes many bugs/issues, also thanks to the many PRs that were submitted (thanks all!). github.com/dirkjanm/bloodhou…

GitHub - dirkjanm/BloodHound.py: A Python based ingestor for BloodHound

A Python based ingestor for BloodHound. Contribute to dirkjanm/BloodHound.py development by creating an account on GitHub.

github.com
11
195
3
622
60,862
Do you want to start the RemoteRegistry service without Admin privileges? Just write into the "winreg" named pipe 👇
24
304
9
1,075
259,499
Did Bethesda hire the Microsoft UX team to work on Starfield? This is so shit. Really disappointed with the game so far.
5
2,128
Thanks to the generous folks @bcsecurity @hackthebox_eu @SANSOffensive @sektor7net and @nostarch for sponsoring prizes at the DEF CON Red Team Village CTF!
1
9
2,463
You can use the Windows Search Protocol to coerce authentication from hosts running the Windows Search Service (Win10/11 only by default) as a regular domain user. Haven't been able to do WebDAV with it though so usefulness is limited. PoC: github.com/slemire/WSPCoerce

GitHub - slemire/WSPCoerce: PoC to coerce authentication from Windows hosts using MS-WSP

PoC to coerce authentication from Windows hosts using MS-WSP - slemire/WSPCoerce

github.com
5
96
281
30,950
🔥 Excited to share my latest @Mandiant Red Team blog on "Escalating Privileges via Third-Party Windows Installers" mandiant.com/resources/blog/… Learn how attackers exploit this privilege escalation vector and ways to defend against it. Includes BOF release and a couple CVEs!

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
7
145
6
346
35,829
Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain + left-to-right mark (U+200E) Links in <a> tags will show the fake domain, but open the real domain. No need to buy .zip! :) Convincing #phishing #redteam
12
226
8
798
117,268
Been playing with the .zip TLD for phishing, apparently Outlook on Windows doesn't let you click links containing credentials, mitigating the "attack". haven't seen anyone talk about this, weirdly. after looking into this a bit, I found a way to bypass this behaviour!
1
8
17
3,010
Load more