iDigitalFlame

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package runtime

import (
	"runtime/internal/atomic"
	"unsafe"
)

paralax

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- "https://malware.news/t/20-common-tools-techniques-used-by-macos-threat-actors-malware/46801" -->
<!-- "https://objective-see.org/blog/blog_0x71.html" -->
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.mylaptop.watchhostconfig</string>
    <key>ProgramArguments</key>
    <array>

muesli

run:
  tests: false

issues:
  include:
    - EXC0001
    - EXC0005
    - EXC0011
    - EXC0012
    - EXC0013

gladiatx0r

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

• Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
• Relaying that machine authentication to LDAPS for configuring RBCD
• RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

ajpc500

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$wc = New-Object System.Net.WebClient

if (!(Test-Path "C:\Tools")) {
    New-Item -Path "C:\" -Name "Tools" -ItemType "directory"
}

# SYSMON
# Download Sysmon
$SysmonDirectory = "C:\Tools\Sysmon\"

svch0stz

$WMI = @{
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'MSFT_MpPreference' AND TargetInstance.DisableRealtimeMonitoring=True"
    Action = {
	      #$Global:Data = $Event
        Write-Host "Defender Configuration change - DisableRealtimeMonitoring:"$Event.SourceEventArgs.NewEvent.TargetInstance.DisableRealtimeMonitoring"(Old Value:"$Event.SourceEventArgs.NewEvent.PreviousInstance.DisableRealtimeMonitoring")"
    }
	Namespace = 'root\microsoft\windows\defender'
    SourceIdentifier = "Defender.DisableRealtimeMonitoring"
}
$Null = Register-WMIEvent @WMI

mgraeber-rc

# Log the time prior to executing the action.
# This will be used as parth of an event log XPath filter.
$DateTimeBefore = [Xml.XmlConvert]::ToString((Get-Date).ToUniversalTime(), [System.Xml.XmlDateTimeSerializationMode]::Utc)

# Do the thing now that you want to see potential relevant events surface...
$null = Mount-DiskImage -ImagePath "$PWD\FeelTheBurn.iso" -StorageType ISO -Access ReadOnly

# Allow a moment to allow events to populate
Start-Sleep -Seconds 5

mubix

function Get-CSharpProcess {
    $proclist = Get-Process
    foreach($proc in $proclist) {
        foreach($mod in $proc.Modules)
        {
            if($mod.ModuleName -imatch "mscoree")
            {
                Write-Output(".NET Found in:`t" + $proc.Name)
            }
        }

psifertex

My recommended settings for setting up a slack that you plan to allow public access to. Methods for adding public users include third-party utilities like slackin (https://github.com/emedvedev/slackin-extended) which enable active user badges, or simpler methods such as using the Share Invite Link from slack itself.

SUPER IMPORTANT

If you only do two things, make it these two: Make sure to disable all app integrations. There's a bunch that aren't secure for public slacks. Either deny all, or require review by an admin: https://YOURSLACK.slack.com/apps/manage/permissions Second, disable email in the profile view: https://binaryninja.slack.com/admin/settings#display_email_addresses

The reset are optional settings that may or may not be required depending on the slack:

ahhh

package main

import(
  "io/ioutil"
  "fmt"
  "github.com/Binject/binjection/bj"
)

var (
example_path = "example.exe"