Webbrowsers are a complex piece of software
Webbrowsers are a complex piece of software and there might break some things if you do stupid stuff.
BadOption.eu
Just Infosec stuff, with blogs and a feed.
Latest posts
Slightly bad feeling
Sometimes you just need to … “桳睯猠浯扥摯⁹畱捩整浲湩污愠摮琠敨潣瑮湩敵”
Having fun with Github
Github has some holes in their basic security which allow some tampering and spoofing. This had and will again help APTs to run campaigns. We will walk through some of them. Most of this has been found by several people before and at least once a year this gets some attention. TL;DR: On Github it is possible to: Spoof Commit authors Spoof Contributors Host hidden payloads under github.com (mostly…
Practical Known Plaintext Attack Against ZIP Files
Sometimes in a network far away, which is most of the time not yours, you might encounter ZIP files protected with passwords. For example, for source code archives, there is quite a good chance to decrypt the ZIPs even without knowing or cracking the password. This is nothing new and has been well-known for several years, but it still seems to be relatively unknown. Personal I learned from this in…
NetNTLM is still a thing?
In 2024 NetNTLM leaking is still a thing! In this post we will cover some parts of: Coerce User Authentication via NetNTLM and a file drop The mystery around HTTP.SYS Relaying without admin privileges Relaying with an active Windows firewall SSH Port forwarding
Deactivating Cortex XDR via repair function
It is trivially possible to disable the Cortex EDR as a non-admin user by triggering a repair function. This is only working, if the Tamper Protection is not enforced! TL;DR; Trigger the repair via GUID Disrupt it when EDR is deactivated Done
Cloud storage - never fails to surprise
Public cloudstorage has a lot of crazy stuff in it. You can find a lot of different stuff, from privacy relevant stuff up to complete backups and keys for all services, including keys for AWS, Google Cloud and Azure. Some of keys or tokens would have allowed a complete organization takeover! As still a lot companies do not have a cost limit in cloud providers an attacker can cause a lot of damage.…
Teams external participant splash screen bypass # 2
Teams external participant splash screen bypass #2 Finally after several months and a “very smooth communication”, meaning 4 month of nothing from Microsoft, they patched the External Participant Bypass via Meeting invitations. As this was always a great vector for spearfishing during RedTeaming assesments, I clicked a little bit around in Teams and Mild shock this is not bulletproof. tl;dr The…
MobilePhish
Phishing mobile devices, with DeviceCode phishing and QR codes As protections for endpoints (Laptops, Virtual-Desktops, …) are getting better and sometimes really tough to bypass, it might be time to move along. One of the next weaker devices might be mobile ones, in that case smartphones. Imho the MDM is weaker nowadays then a fully featured EDR with webproxies and packet inspection. For a good…
A redirect chain
A redirect chain for initial access Some programs still do not apply Mark-of-the-Web (MotW), so we can build an, for the victim quite annoying chain involving custom protocol header, Windows search, WebDAV and Java or some other techniques for the final kick. This results in a Zero Warning, yet several clicks, chain for initial access. tl;dr “microsoft-edge:” is a protocol provider to open URLs in…