Sr. Information Security Engineer (red teamer) at a Fortune 500. I ❤️ CTFs, Photography, and video games. kaill@infosec.exchange
Joined August 2008
- Tweets1.6K
- Following1.2K
- Followers1.4K
- Likes8.1K
This has been the hardest week of my entire life while I sat by my dad and held his hand as he died a slow and horrible death.
Kail retweeted
Seeing a LOT of incorrect media reports — including from some meteorologists — tying AT&T outage to the back-to-back solar flares.
They are NOT related.
The R3 shortwave radio blackout was on the wrong side of Earth. Cell phones are also not in the 3 to 30 MHz frequency band.
Kail retweeted
We've just published a quick write up on CVE-2023-23397, which allows a remote adversary to leak NetNTLMv2 hashes: mdsec.co.uk/2023/03/exploiti… by @domchell
Kail retweeted
interesting APT28 malloc which uses no macro, the document is a PowerPoint file that exploits a code execution technique in a ahyperlink. which is designed to be triggered when the user starts the presentation mode and moves the mouse.
Kail retweeted
More car hacking!
Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.
Here's how we found it, and how it works:
Kail retweeted
PersistAssist v0.2 is live! Tons of cool additions in this version I'm excited to share including more tradecraft modules, new persistence methods, and some quality of life features. Keep an eye out for the upcoming blog post 🙂
Check it out here!
github.com/FortyNorthSecurit…
Kail retweeted
Imagine you'd get access to an unknown SIEM of a new customer & would be given 10min to find malicious activity by using keyword searches on raw data, what would you search for?
I'll start
'.dmp full'
'whoami'
'delete shadows'
'FromBase64String'
'save HKLM\SAM'
' -w hidden '
Kail retweeted
With Twitter's change in ownership last week, I'm probably in the clear to talk about the most unethical thing I was asked to build while working at Twitter.
🧵
Kail retweeted
this is how I run mimikatz today on a (default config) Defender for Endpoint protected host. just reused my recent stager with a basic custom socket server. this libpeconv stuff is more powerful than I first thought :)
here is a basic meterpreter protocol stager for PE stages using the libpeconv project by @hasherezade:
github.com/tothi/stager_libp…
no evasion included, using this only as a template. but already able to run it with a Sliver EXE beacon as a stage against Defender for Endpoint.
Kail retweeted
Introducing ShadowSpray, it's like password spray but with shadow credentials. More info in the repo.
Huge thanks to @elad_shamir for the amazing technique and to @harmj0y (and others) for the implementation in Rubeus from which a lot of code was taken.
github.com/Dec0ne/ShadowSpra…
I didn’t have much time to grieve over my mom’s death because I immediately had to take care of my dad who is very ill, get him to the hospital, figure out all the medicine he needs to live, plan a funeral by myself, get 24/7 care for him setup, and then figure out the estate.
Now that I’ve taken care of everything I can, I just feel nothing but pain, emptiness, and intense sadness. There’s also a lot of guilt, I should have done more and maybe this could have been prevented. Sometimes, these feelings are totally disabling.