Ninja - Open Source C2 Server Created For Stealth Red Team Operations

Ninja C2 is an Open source C2 server created by Purple Team to do stealthy computer and Active directoty enumeration without being detected by SIEM and AVs , Ninja still in beta version and when the stable version released it will contains many more stealthy techinques and anti-forensic to create...

SharePoint Workflows XOML Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SharePoint Workflows XOML Injection', 'Description' = %q This module exploits a vulnerability within SharePoint and its .NET backend that allows ...

Starkiller - A Frontend For PowerShell Empire

Starkiller is a Frontend for Powershell Empire. It is an Electron application written in VueJS. If you'd like to contribute please follow the Contribution guide. Getting Started To run Starkiller, you can download the installers for Mac, Linux, and Windows on the Releases page. For more info on...

SharePoint Workflows XOML Injection

This module exploits a vulnerability within SharePoint and its .NET backend that allows an attacker to execute commands using specially crafted XOML data sent to SharePoint via the Workflows functionality. This module requires Metasploit: https://metasploit.com/download Current source:...

How to Collect Veeam ONE SMTP Logging

Purpose This article provides information on enabling extended SMTP email logging, which is necessary when investigating issues with Veeam ONE emails, such as missed alarm notifications, unexpected email content, or other email-related problems. SMTP logging is not enabled by default and must be...

CVE-2020-9326

BeyondTrust Privilege Management for Windows and Mac aka PMWM; formerly Avecto Defendpoint 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash...

Design/Logic Flaw

BeyondTrust Privilege Management for Windows and Mac aka PMWM; formerly Avecto Defendpoint 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash...

CVE-2020-9326

BeyondTrust Privilege Management for Windows and Mac aka PMWM; formerly Avecto Defendpoint 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash...

Detecting Fileless Attacks with Enterprise EDR’s AMSI Visibility

If this year’s 2020 Cybersecurity Outlook Report taught us anything, it’s that defenders are seeing an increasing amount of defense evasion techniques in their environments. It’s crucial for security teams to have the granular visibility they need to spot malicious attacker behavior, however...

UPDATE: FudgeC2 0.5.5

FudgeC2 0.5.5 was released recently. As you may remember, this awesome adversary emulation system was listed in my older post titled – List of Open Source C2 Post-Exploitation Frameworks and FudgeC2 0.5.4. This newer version allows you to screenshot the desktop of any hosts with an implant. What ...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

aioScanCVE-2020-0796 Introduction The detection speed has...

PowerSploit1

This is a PowerShell module for code execution and antivirus bypass. The module contains several functions, including: 1. Find-AVSignature: This function locates tiny AV signatures using the same method as DSplit from "class101" on heapoverflow.com. 2. Invoke-DllInjection: This function injects a...

ManageEngine Desktop Central Java Deserialization

This module exploits a Java deserialization vulnerability in the getChartImage method from the FileStorage class within ManageEngine Desktop Central versions 'ManageEngine Desktop Central Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in the...

Veeam Agent for Microsoft Windows Job Displays the Warning: "Disk is running low on free space"

Challenge A Veeam Agent for Microsoft Windows backup job lists the warning: Disk is running low on free space Copy Log Example C:\ProgramData\Veeam\Endpoint\jobname \Job.jobname.Backup.log Info EpFreeSpaceHelper Volume 'New Volume D:', isSystem=False length is 10718543872 bytes. Free space...

RedRabbit - Red Team PowerShell Script

RedRabbit is a PowerShell script aimed at helping pentesters conduct ethical hacking RedTeam To Run: You can either run locally by downloading the script or run remotely using: powershell –nop –c “iexNew-Object...

2019: Looking Back at Malware

In 2019, attacker behavior evolved, becoming more evasive. The most common behaviors seen across all attack data—mapped to the MITRE ATT&CK™ Framework—were: Software Packing for Defense Evasion, Hidden Windows for Defense Evasion, Standard Application Layer Protocol for Command and Control C2,...

Variant of Paradise Ransomware Targets Office IQY Files

A new variant of the Paradise ransomware attacks rarely-targeted Microsoft Office Excel IQY files, providing a new and relatively inobtrusive way to infiltrate and hijack an organization’s network, researchers have found. Lastline Labs’ James Haughom discovered the variant in December in a spam...

Proton Framework - A Windows Post Exploitation Framework Similar To Other Penetration Testing Tools Such As Meterpreter And Powershell Invader Framework

About Proton Framework Proton Framework is a Windows post exploitation framework similar to other penetration testing tools such as Meterpreter and Powershell Invader Framework. The major difference is that the Proton Framework does most of its operations using Windows Script Host a.k.a...

PowerShell-Suite

This is a PowerShell script called Bypass-UAC, which is designed to bypass User Account Control UAC on Windows systems. The script uses a technique called "auto-elevating IFileOperation COM object method calls" to achieve this. The script supports several methods for bypassing UAC, including:...

Privilege-Escalation-Tater

It is an offensive tool for Windows Privilege Escalation. The primary CVE ID is not present in the provided context, but it is a PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit. The target product/service or framework is Windows, and the vulnerability class/vector...