birg0 @_birg0

Paris, Ile-de-France Joined October 2015

Tweets

90
Followers

61
Following

327
Likes

363

Mobeta @MobetaSec

7 months ago

Nouvel article technique concernant les comptes machines dans Active Directory. Découvrez comment ils sont exploités et comment s’en protéger dans notre dernier blog post : mobeta.fr/active-directo… #cybersecurity #pentest #activedirectory

0 2 4 51 1

Charles Fol @cfreal_

a year ago

Since an exploit has been published, here's ours: #CosmicSting (2024-34102) + #CNEXT (CVE-2024-2961), giving RCE on #Magento github.com/ambionics/cnex…

2 68 216 20K 74

Ambionics Security @ambionics

a year ago

Scalpel is here: this @Burp_Suite extension lets you edit your requests, in Python 3, in the repeater or on-the-fly. ambionics.io/blog/scalpel

1 16 51 10K 10

Download Image

Ambionics Security @ambionics

a year ago

Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve…

3 126 300 53K 96

Charles Fol @cfreal_

2 years ago

Here's an educational POC for #xortigate (CVE-2023-27997). I'll cover the vulnerability at @hexacon_fr this Saturday, and @BlackAlpsConf a few days later! github.com/lexfo/xortigat…

0 65 187 28K 41

Lexfo @LexfoSecurite

2 years ago

#Fortinet patched #CVE-2023-27997, a critical vulnerability affecting its VPN #Fortigate. Our latest blogpost describes the technical details about the bug, a pre-auth heap overflow, with a twist. #xortigate blog.lexfo.fr/xortigate-cve-…

2 104 182 62K 21

Lexfo @LexfoSecurite

2 years ago

Our researchers found a pre-auth RCE on #Fortigate SSL VPN. Stay tuned for the blogpost ! (CVE-2023-27997)

Charles Fol @cfreal_

2 years ago

Our researchers found a pre-auth RCE on #Fortigate SSL VPN. Stay tuned for the blogpost ! (CVE-2023-27997)

25 295 700 371K 95

1 26 97 21K 18

Lexfo @LexfoSecurite

2 years ago

Introducing sshimpanzee, a reverse shell made by @TitouanLazard based on openssh's sshd. It supports DNS, ICMP and HTTP encapsulation as well as SOCKS and HTTP Proxies : blog.lexfo.fr/sshimpanzee.ht…

0 38 97 17K 19

BlackWasp @BlWasp_

3 years ago

Just dropped some new cool things on the AD cheatsheets: - SCCM primary site takeover - RODC attacks and pivoting - Techniques I have previously forgotten about retrieving credentials hideandsec.sh/books/cheatshe… hideandsec.sh/books/cheatshe…

10 95 229 23K 73

Lexfo @LexfoSecurite

3 years ago

A few months ago, we reported a pre-auth Remote Code Execution #RCE vulnerability to @vBulletin. The exploitation of this unserialize() bug was tricky, as vBulletin classes are not deserialisable. Discover the exploitation in our latest blogpost: ambionics.io/blog/vbulletin…

2 86 202 50K 29

Jeff McJunkin @jeffmcjunkin

3 years ago

Great new tool by @bananabr to find folders excluded from antivirus scanning by comparing file write times across tested folders. Writes to excluded folders finish much faster as they don't have their writes intercepted by AV. Clever! github.com/bananabr/TimeE…

3 88 222 28K 75

Thomas Seigneuret @_zblurx

3 years ago

New technique to dump NTDS remotely WITHOUT DSRUAPI: github.com/zblurx/certsync (Golden Certificates + UnPAC the hash automation) Thanks @ly4k_ for certipy, which my script heavily relies on.

7 248 553 49K 169

Oliver Lyak @ly4k_

3 years ago

Today we're publishing new techniques for recovering NTLM hashes from encrypted credentials protected by Windows Defender Credential Guard. These techniques also work on victims logged on before the server was compromised. research.ifcr.dk/pass-the-chall…

34 686 2K 215K 507

Orange Cyberdefense's SensePost Team @sensepost

3 years ago

In this post @Sant0rryu shows an attack chain where you can abuse ADCS to escalate from a Virtual Account / Service account to local SYSTEM. As homage to other *potato tools, it could even be called CertPotato. 👀 sensepost.com/blog/2022/cert…

3 66 147 0 25

/r/netsec @_r_netsec

3 years ago

Tunneling Internet through WhatsApp to avoid network restrictions github.com/aleixrodriala/…

0 57 187 0 69

Requiem @Requiem_fr

3 years ago

In early 2022 our @Mandiant team responded to an incident where #APT29 successfully phished a EU diplomatic entity and ultimately abused the Windows Credential Roaming feature. Today one of our #redteam colleagues wrote a blog about it! mandiant.com/resources/blog… #DFIR #teamwork

3 94 228 0 66

Mayfly @M4yFly

3 years ago

Welcome to the new AD Mindmap upgrade ! v2022_11 will be dark only (this is too painful to maintain two versions). Thx again to : @Vikingfr and @Sant0rryu for their help 👍 Full quality and zoomable version here : orange-cyberdefense.github.io/ocd-mindmaps/i… Overview :

40 440 1K 0 413

Download Image

sn🥶vvcr💥sh @snovvcrash

3 years ago

🧵 (1/) Forged Tickets Thread Golden 🔑 tickets are no longer in fashion, so here’s a short memo on using Diamond 💎 (@exploitph) and Sapphire (@_nwodtuhs) tickets with ticketer[.]py from #Impacket. At first let’s recap what we already know about Golden tickets ⤵️ #ad #kerberos

11 199 517 0 208

/r/netsec @_r_netsec

3 years ago

Audit your DNS config, you'd be shocked at how bad it can get github.com/punk-security/…

1 60 190 0 61

Charlie Clark @exploitph

3 years ago

Glad to finally get my AS-REQ research out there. @Microsoft decided requesting ST's from the AS was by design so here's a couple of ways to Kerberoast without any creds and bypass detections based on 4769's