WE POP SHELLS
Estimated Reading Time: 7 minutes This post shows a practical bypass of Application Control for Business (formerly Windows Defender Application Control (WDAC)) by abusing NTFS Kernel Extended Attributes (Kernel EAs) The post Abusing Extended Attributes to Bypass Application Control For Business appeared first on Shells.Systems .
Estimated Reading Time: 15 minutes While doing some code analysis of network services running as root in one of my lab VMs, I came across ISC DHCP Server (dhcpd), a common DHCP implementation in Linux environments. I decided to clone the code and see what I can get from it using LLMs, I used Opus 4.6 to build a better... The post Chaining ISC DHCP Server Features for Unauthenticated Root Remote…
Estimated Reading Time: 9 minutes AMSI, CLM and ETW – defeated* with one Microsoft signed tool Let’s start with AMSI – everyone loves bypassing AMSI! In recent years, many (not all) antivirus products have begun to rely on Antimalware Scan Interface (AMSI) to detect more advanced malicious activity. Today, it captures every PowerShell, Jscript, VBScript, VBA or .NET command or... The post One Tool…
Estimated Reading Time: 9 minutes When you’re running any sort of offensive operations, managing your C2 traffic and hiding it with modern technologies is always an important thing to do, it’s not just a “nice-to-have”; it’s something you want to take care of while putting together your attack infrastructure. While reading through some of the latest AI buzz, I came... The post Watch Your AI! Using…
Estimated Reading Time: 9 minutes Previously, during a quick code review of PandoraFMS, I identified CVE-2019-20224, an RCE vulnerability affecting the product. In this blog post, I’ll delve into another code review of PandoraFMS that uncovered a new RCE vulnerability, now assigned CVE-2024-11320. This post is the first in a two-part series focused on CVE-2024-11320. In this part, I’ll walk... The…
Estimated Reading Time: 5 minutes On a recent Red Team engagement, I was poking around having a look at different files and trying to see if I could extract any information that would allow me to move laterally through the network. I was hopeful, as always, that I would land on domain_admin_passwords_2024.xlsx or something (don’t laugh – we’ve all found... The post Extracting Plaintext Credentials…
Estimated Reading Time: 6 minutes A post exploring how to enumerate and avoid Cortex XDR ransomware files/folders and avoid getting caught The post Cortex XDR Ransomware Protection, Chocolate Teapots and Inflatable Dartboards appeared first on Shells.Systems .
Estimated Reading Time: 8 minutes Summary about Froxlor Froxlor is a web-based server management software for Linux-based operating systems. It is primarily used to manage web hosting environments and allows users to create and manage websites, email accounts, and FTP accounts. It also provides tools for monitoring server resources and managing backups. Froxlor is written in PHP and uses a... The…
Estimated Reading Time: 2 minutes Since last release i was working on new features and to increase the processing speed for large number of windows event logs files so i rebuilt the tool to use multiprocessing and added more feature that will help you in your next investigation. Download from here : https://github.com/ahmedkhlief/APT-Hunter/releases/tag/V3.0 APT-HUNTER V3.0 Features New use cases…
Estimated Reading Time: 4 minutes This article is based mostly on the work of Grzegorz Tworek (@0gtweet) I recently saw this tweet from Grzegorz Tworek (@0gtweet – who if you aren’t following you really should be!) come across my timeline I had seen previous tweets referencing the AppLocker hash/signature cache and having a CPD day I thought I would take... The post Bypassing AppLocker by abusing…