Matt Nelson

@enigma0x3

Security Researcher & Senior Operator | Enjoys abusing features |

Indianapolis, IN
Vrijeme pridruživanja: siječanj 2011.

Tweetovi

Blokirali ste korisnika/cu @enigma0x3

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @enigma0x3

  1. Prikvačeni tweet
    15. stu 2019.

    [Blog] CVE-2019–12757: Local Privilege Escalation in Symantec Endpoint Protection

    Poništi
  2. proslijedio/la je Tweet
    31. sij

    Pushed a new Rubeus release after getting some additional feedback from our most recent AT:RTO students. The full changes are detailed here . To highlight a few new features- "/nowrap" globally prevents base64 blobs from line-wrapping, (1/4)

    Prikaži ovu nit
    Poništi
  3. proslijedio/la je Tweet
    31. sij

    Join me and on Tuesday, February 11th as we unveil 3.0! We will demo new attack primitives, performance improvements, and changes in the GUI. Register for the webinar here (recording available afterwards):

    Poništi
  4. proslijedio/la je Tweet
    31. sij

    Fuck it, I can't focus at all today. It's a mess, sorry.. I've also uploaded the discussed bug to github. Maybe someone can make sense of it. It's a junction bug that's a little more complicated then a simple "bait and switch". Hope it's useful to someone.

    Prikaži ovu nit
    Poništi
  5. proslijedio/la je Tweet
    30. sij

    On this same note, disable Chrome sync in your organizations. I can't tell you how many times I've seen domain/server admin creds saved to Chrome with sync enabled. I can guarantee your admins' home computers and personal devices aren't secured as well as your corporate devices.

    Poništi
  6. proslijedio/la je Tweet
    30. sij

    For the past few months, I've been diving into Apple's Endpoint Security Framework. This post shares how I use the framework for detection engineering purposes.

    Prikaži ovu nit
    Poništi
  7. proslijedio/la je Tweet
    30. sij

    I have a few books to give away. If you are new to the infosec community, find me at , I'll give you a copy.

    Poništi
  8. proslijedio/la je Tweet
    30. sij

    A quick post on why you shouldn't use SYSTEM Tokens when you sandbox a process. Part 1 of N (where I haven't decided how big N is).

    Poništi
  9. proslijedio/la je Tweet
    29. sij

    Super stoked to have the opportunity to present here again! This is live streamed, I will be releasing the slides afterwards, and there will be a tool update to accommodate the new capabilities. I can’t wait!

    Poništi
  10. proslijedio/la je Tweet
    29. sij

    New from - Ghostwriter received an update today. A WYSIWYG editor, updated domain tracking, and auxiliary server addresses. Read more here: Project link:

    Poništi
  11. proslijedio/la je Tweet
    28. sij

    New blog (and tool): Attacking Azure, Azure AD, and Introducing PowerZure

    Prikaži ovu nit
    Poništi
  12. proslijedio/la je Tweet
    27. sij

    Move Faster, Stay Longer blog about extending CS and tools to go with it.

    Poništi
  13. proslijedio/la je Tweet
    22. sij

    Here is the link to the SpecterOps Adversary Tactics: PowerShell course material: Enjoy! For information about our current training offerings, information can be found here: (4/4)

    Prikaži ovu nit
    Poništi
  14. proslijedio/la je Tweet
    22. sij

    Despite its incredible security enhancements, PowerShell continues to be abused by adversaries. A strong knowledge of PowerShell enables defenders to effectively manage and respond to its abuse. (1/4)

    Prikaži ovu nit
    Poništi
  15. 22. sij

    "non-graphical authenticated remote command execution". Let that sink in for a second.

    Poništi
  16. proslijedio/la je Tweet
    22. sij

    Revisiting RDP lateral movement and releasing a project that will be part of a bigger tool coming next week

    Poništi
  17. proslijedio/la je Tweet
    21. sij

    Hey Defender friends. Turns out that removing those services with Unicode/non-printable characters is pretty hard, so I wrote you a tool to help with that. I'll be releasing the offensive PoC later this week or early next week.

    Poništi
  18. proslijedio/la je Tweet
    21. sij

    Just released Satellite, a payload hosting and proxy software for red team operations. In the blog post, I discuss the feature set of Satellite as well as why an operator would choose it over Apache or Nginx.

    Prikaži ovu nit
    Poništi
  19. proslijedio/la je Tweet
    17. sij

    Want to make service removal really fun? Create a service with a unicode name. The service will run but won't show in sc.exe, services.msc, or taskmgr.exe and will sometimes cause a critical error while trying to find it with PowerShell/WMI. Unicode wins again.🤦‍♂️

    Prikaži ovu nit
    Poništi
  20. 15. sij

    [Blog] Avira VPN Local Privilege Escalation Uses some fun tricks to circumvent service DACL and integrity checks.

    Poništi
  21. proslijedio/la je Tweet
    13. sij

    I've been poking around the Windows kernel a lot lately and one of my favorite samples I've referenced is Mimikatz's driver, Mimidrv. I took some time and documented all of its functions and included some write-ups on important kernel structures. Post: 1/3

    Prikaži ovu nit
    Poništi

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·