555 matches found
NetNTLMtoSilverTicket
SpoolSample - NetNTLMv1 - NTLM - Silver Ticket Esta técnica ha sido mencionada por otros, pero no he visto nada cohesionado por ahí. A continuación, recorreremos los pasos para obtener una autenticación NetNTLMv1 Challenge/Response, descifrar esas respuestas a hashes NTLM y usar ese hash NTLM par...
vulnerable-AD
Vulnerable-AD 创建一个易受攻击的活动目录，让您可以在本地实验室中测试大多数活动目录攻击。 主要功能 随机化攻击 全面覆盖上述攻击 您需要在已安装活动目录的域控制器上运行脚本 部分攻击需要客户端工作站 支持的攻击 滥用ACL/ACE Kerberoasting AS-REP Roasting 滥用DnsAdmins 对象描述中的密码 使用默认密码的用户对象 Changeme123! 密码喷洒 DCSync 白银票据 黄金票据 传递哈希 传递票据 SMB签名已禁用 示例 root@kitploit: if you didn't install Active Directory...
GhostTask
Ghost 计划任务 受 WithSecure 关于 计划任务篡改 的研究启发，他们解释了仅通过注册表键操作创建计划任务的可行性。这种方法可以绕过计划任务创建事件日志（如 4698 和 106）的生成，从而提供更隐蔽的持久化方式。基于这些见解，我开发了这个 POC，演示如何通过直接操作注册表来创建计划任务。 创建一个新的计划任务需要添加多个注册表键及其关联的值。由于与计划任务相关的注册表值的结构未公开记录，我构建这些结构的方法主要依赖于反复试验，并通过与合法计划任务的注册表值进行对比来指导。此外，我还参考了 Taskschd.h 头文件中的接口，并大量借鉴了 Cyber.WTF 的...
blackhat-usa-2022-demos
blackhat-usa-2022-demos Demostraciones para la charla de Blackhat USA 2022 "Taking Kerberos to the Next Level". Estas son las diapositivas y demostraciones de la presentación de James Forshaw @tiraniddo y Nick Landers @monoxgas. Las demostraciones son las siguientes: demo1.ps1 - Ticket plateado c...
Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT
The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...
New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic
The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan RAR called MODBEACON. Chinese cybersecurity company QiAnXin said that while the threat cluster may appear like a low-sophistication, high-activity operation that propagates malware v...
ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagree
Agent skills extend AI agents with reusable instructions, tools, scripts, references, and workflows, establishing a security boundary distinct from both model safety and traditional package-malware detection. ClawHub Security Signals is a sanitized dataset of 67,453 latest public OpenClaw skill...
Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia
The China-based cybercrime group known as Silver Fox aka Monarch, SwimSnake, The Great Thief of Valley, UTG-Q-1000, and Void Arachne has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor. The activity involved using phishing emails that...
CVE-2026-20709
A flaw was found in some Intel Pentium Processor Silver Series, Intel Celeron Processor J Series, and Intel Celeron Processor N Series. This vulnerability arises from the use of a default cryptographic key in the hardware. A sophisticated attacker with physical access and privileged user access...
EUVD-2026-20538
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
CVE-2026-20709
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
CVE-2026-20709
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
CVE-2026-20709
This CVE (CVE-2026-20709) concerns the use of a default cryptographic key embedded in hardware on select Intel processors (Pentium Silver, Celeron J/N series). The root cause is a default key in hardware that could be exploited by a hardware reverse engineer with privileged access and high attack...
CVE-2026-20709
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains
Chinese-speaking users are the target of an active campaign that uses typosquatted domains impersonating trusted software brands to deliver a previously undocumented remote access trojan named AtlasCross RAT. "The operation covers VPN clients, encrypted messengers, video conferencing tools,...
WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Silver Asu in WordPress Plugin Responsive Blocks versions = 2.2.0...
Fake Huorong security site infects users with ValleyRAT
A convincing lookalike of the popular Huorong Security antivirus has been used to deliver ValleyRAT, a sophisticated Remote Access Trojan RAT built on the Winos4.0 framework, to users who believed they were improving their security. The campaign, attributed to the Silver Fox APT group—a...
CVE-2026-2642 ggreer the_silver_searcher search.c search_stream null pointer dereference
A security vulnerability has been detected in ggreer thesilversearcher up to 2.2.0. The impacted element is the function searchstream of the file src/search.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed...
CVE-2026-2642 ggreer the_silver_searcher search.c search_stream null pointer dereference
A security vulnerability has been detected in ggreer thesilversearcher up to 2.2.0. The impacted element is the function searchstream of the file src/search.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed...