KrustyHack

{
    "name": "Integration Raindrop.io, OpenAI (ChatGPT, Whisper, DALL-E)",
    "flow": [
        {
            "id": 1,
            "module": "raindrop-io:watchBookmarks",
            "version": 1,
            "parameters": {
                "__IMTCONN__": 2363503,
                "collection": {

antonioCoco

/*
	TaskManagerSecret

	Author: @splinter_code

	This is a very ugly POC for a very unreliable UAC bypass through some UI hacks.
	The core of this hack is stealing and using a token containing the UIAccess flag set.
	A trick described by James Forshaw, so all credits to him --> https://www.tiraniddo.dev/2019/02/accessing-access-tokens-for-uiaccess.html
	From there it uses a task manager "feature" to run a new High IL cmd.exe.
	This has been developed only for fun and shouldn't be used due to its high unreliability.

brokensound77

Detecting RMM

ℹ️ This was duplicated to this blog for readability and reference

---

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

gitcnd

#!/usr/bin/python3

# From DOS commandline, run this as follows:-
#        python3 ejectusb.py
# -or- create C:\windows\ejectusb.bat to do the above in fewer characters.
#
# From WSL bash, run it as follows:-
#        cmd.exe /c start python3 C:\\windows\\ejectusb.py
# -or- create /usr/local/bin/ejectusb to do the above in fewer characters.

gladiatx0r

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

• Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
• Relaying that machine authentication to LDAPS for configuring RBCD
• RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

j1elo

#!/bin/bash

# Step 1: Obtain a list of our personal hosts.
# Export from Bitwarden, LastPass, 1Password, or similar:

my_passwords.txt

# Next commands will assume the LastPass export format, which is CSV with the URL in the first field:
# url,username,password,[... more fields]

si9int

#!/usr/bin/env python3
# v.0.3 | twitter.com/si9int
import requests, sys
from bs4 import BeautifulSoup as bs

domain = sys.argv[1]
subdomains = []

def get_csrf_params():
    csrf_params = {}

Irio

FROM golang:1.12 as build

WORKDIR $GOPATH/src/github.com/Irio/wohnung
COPY scraper scraper
COPY main.go .

RUN go get -d -v ./...
RUN go install

FROM gcr.io/distroless/base

nullenc0de

https://github.com/search?q=BROWSER_STACK_ACCESS_KEY= OR BROWSER_STACK_USERNAME= OR browserConnectionEnabled= OR BROWSERSTACK_ACCESS_KEY=&s=indexed&type=Code
https://github.com/search?q=CHROME_CLIENT_SECRET= OR CHROME_EXTENSION_ID= OR CHROME_REFRESH_TOKEN= OR CI_DEPLOY_PASSWORD= OR CI_DEPLOY_USER=&s=indexed&type=Code
https://github.com/search?q=CLOUDAMQP_URL= OR CLOUDANT_APPLIANCE_DATABASE= OR CLOUDANT_ARCHIVED_DATABASE= OR CLOUDANT_AUDITED_DATABASE=&s=indexed&type=Code
https://github.com/search?q=CLOUDANT_ORDER_DATABASE= OR CLOUDANT_PARSED_DATABASE= OR CLOUDANT_PASSWORD= OR CLOUDANT_PROCESSED_DATABASE=&s=indexed&type=Code
https://github.com/search?q=CONTENTFUL_PHP_MANAGEMENT_TEST_TOKEN= OR CONTENTFUL_TEST_ORG_CMA_TOKEN= OR CONTENTFUL_V2_ACCESS_TOKEN=&s=indexed&type=Code
https://github.com/search?q=-DSELION_BROWSER_RUN_HEADLESS= OR -DSELION_DOWNLOAD_DEPENDENCIES= OR -DSELION_SELENIUM_RUN_LOCALLY=&s=indexed&type=Code
https://github.com/search?q=ELASTICSEARCH_PASSWORD= OR ELASTICSEARCH_USERNAME= OR EMAIL_NOTIFI

TarlogicSecurity

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module: