iiinova — where your digital self keeps evolving

Atsika @atsika.bsky.social · 30/04/2025

I've heard that my fellow Red Teamers like to use SOCKS proxies for stealth operations, so here's one that (ab)uses Azure Blob Storage 🚇

000

Reposted by Atsika

Quarkslab @quarkslab.bsky.social · 29/04/2025

Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS? It's ProxyBlob, a reverse proxy over Azure. Check out Alexandre Nesic's article on how it came to exist after an assumed breach mission ⤵️ 👉 blog.quarkslab.com/proxyblobing...

Proxybloby, the read teamer's mascot that will byte your SOCKS if left alone in your internal network

011

Reposted by Atsika

BallisKit @balliskit.bsky.social · 03/04/2025

For us, EDR bypass is not just a buzzword. MacroPack, ShellcodePack, and DarwinOps all come with bypass presets for major EDRs and Antivirus Those presets are regularly updated and tested! If you want to see a demo or an equivalent screenshot for the major EDRs contact us ! #redteam

032

Reposted by Atsika

SpecterOps @specterops.io · 09/04/2025

Think NTLM relay is a solved problem? Think again. Relay attacks are more complicated than many people realize. Check out this deep dive from Elad Shamir on NTLM relay attacks & the new edges we recently added to BloodHound. ghst.ly/4lv3E31

12720

Reposted by Atsika

Quarkslab @quarkslab.bsky.social · 25/03/2025

Next week at the Hack The Box 0x4d meetup in Lille, France @rayanle.cat will talk about PwnShop, the challenge he prepared for the PwnMe CTF 2025 and how he accidentally discovered a RCE 0day while doing so. Join him next Monday at Campus Cyber Hauts-the-France: www.meetup.com/hack-the-box...

A CTF challenge in PHP, what could possibly not be a RCE?

062

Reposted by Atsika

BallisKit @balliskit.bsky.social · 20/03/2025

Balliskit Evasion Tip 🤖 To help with static analysis detection by EDR, ShellcodePack implements a method to load a shellcode from a separate file or from an URL This tutorial explains how to use that option! #redteam blog.balliskit.com/loading-a-sh...

blog.balliskit.com

Loading a shellcode from a file/URL with ShellcodePack

Shellcode in EXE files can sometimes be detected during static analysis, requiring various kinds of obfuscation to bypass EDRs. This…

032

Reposted by Atsika

XPN @xpnsec.com · 20/03/2025

On PTO and bored, so playing around with MCP by exposing Mythic APIs to Claude and seeing what the result. Attempting to have it emulate threat actors while operating Apollo in a lab... would make a good sparring partner :D www.youtube.com/watch?v=ZooT...

youtube.com

Mythic MCP - Claude Sonnet driving Mythic (Apollo)

YouTube video by Adam Chester

1206

Reposted by Atsika

Kuba Gretzky @mrgretzky.breakdev.org · 12/03/2025

🚨 Evilginx Pro is finally here! 🚨🎣🐟 This is it! After over two years of development, countless delays, and hundreds of manual company verifications, Evilginx Pro is finally live! Thank you all for your invaluable support 💗 breakdev.org/evilginx-pro...

breakdev.org

Evilginx Pro is finally here!

After over two years of development, Evilginx Pro reverse proxy phishing framework for red teams is finally live!

0116

Reposted by Atsika

Andrea P @decoder-it.bsky.social · 14/03/2025

KrbRelayEx-RPC tool is out! 🎉 Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;) github.com/decoder-it/K...

github.com

GitHub - decoder-it/KrbRelayEx-RPC

Contribute to decoder-it/KrbRelayEx-RPC development by creating an account on GitHub.

0910

Atsika @atsika.bsky.social · 11/03/2025

If you thought phishing was now ineffective, you may have missed something 👀 My latest post highlights the advanced tactics used to bypass security controls and deceive even the most savvy users. Check it out ⤵️

011

Reposted by Atsika

Quarkslab @quarkslab.bsky.social · 11/03/2025

From classic HTML pages to advanced MFA bypasses, dive in with @atsika.bsky.social in an exploration of phishing techniques 🎣. Learn some infrastructure tricks and delivery methods to bypass common detection. 👉 blog.quarkslab.com/technical-di... (promise this one is legit 👀)

054

Reposted by Atsika

hasherezade.bsky.social @hasherezade.bsky.social · 09/03/2025

#PEbear (github.com/hasherezade/...) is now available via WinGet (learn.microsoft.com/en-us/window...)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.

0128

Reposted by Atsika

hasherezade.bsky.social @hasherezade.bsky.social · 09/03/2025

[DEMO] Searching for #AceLdr in memory, with #PEsieve/#HollowsHunter threads scan: www.youtube.com/watch?v=RQf2... ; read more: github.com/hasherezade/...

youtube.com

[DEMO] Searching for AceLdr in memory, with PE-sieve/HollowsHunter thread scan

YouTube video by hasherezade

044

Reposted by Atsika

Cas van Cooten @casvancooten.com · 28/02/2025

Recently came across a pretty neat technique to silently load (malicious) VS Code extensions using its bootstrapping and portability features. Thought it was interesting enough to warrant my first blog post in 4 years 🙃 Check it out 👇 casvancooten.com/posts/2025/0...

casvancooten.com

Abusing VS Code's Bootstrapping Functionality To Quietly Load Malicious Extensions

Wow, been a while since my last blog 😅. During some research I came across a technique variation which I felt was interesting enough to share in a brief blog post. It relates to how the bootstrapping ...

063

Reposted by Atsika

Quarkslab @quarkslab.bsky.social · 25/02/2025

A Plan to Pwn: Reviving a 17 year old bug or winning a race against Project Management? We've got both. Mathieu Farrell shows you how in the "Pwn Everything, Bounce Everywhere, all at once" blog post series. blog.quarkslab.com/pwn-everythi...

022

Reposted by Atsika

Quarkslab @quarkslab.bsky.social · 26/02/2025

ICYMI: 5 vulnerabilities in SOPlanning, an open source project management application used by major consulting services providers. In part 2 of "Pwn Everything, Bounce Everywhere, all at once" Mathieu Farrell tells you how to chain them for unautheticated RCE blog.quarkslab.com/pwn-everythi...

An AI generated picture depicting exploitation kungfu against SOplanning. We guess they did not plan for that.

011

Reposted by Atsika

Clément Labro @itm4n.bsky.social · 19/02/2025

In this blog post, I explain how I was able to create a PowerShell console in C/C++, and disable all its security features (AMSI, logging, transcription, execution policy, CLM) in doing so. 💪 👉 blog.scrt.ch/2025/02/18/r...

Screenshot showing the execution of the proof-of-concept named PowerChell in comparison to a typical PowerShell prompt. In particular, it shows that PowerChell is able to bypass the Constrained Language Mode (CLM).

24319