Pinned Tweet
My @44CON talk from last year on Microsoft Office persistence techniques is now online. More techniques, and more depth than the earlier DEFCON talk / associated @mwrlabs post (which I should really update). It also has a pretty decent COM introduction. youtube.com/watch?v=zWet0dg9…
.NET GAC and NIC hijacking for lateral movement: williamknowles.io/net-gac-an…
Little OPSEC TIL. For dumping processes with MiniDumpWriteDump, it doesn't matter if your initial handle only has query and read memory permissions, it goes fully rogue, and opens a new handle with full access rights (inc. w/ duplicated handles - and from your current process).
Re: SAM permissions, a possible cause: interestingly if you re-enable "RegBack" (auto-backup of these sensitive files, which was disabled by default in Windows 10 1803) it *corrects* the permissions after a reboot (removing "Read" for "Users"). Tested on 20H2 and 1909.
Fetching SharpHound data entirely in-memory (no dropped ZIP or JSON files) using BOF.NET and Cobalt Strike.
williamknowles.io/fetching-s…
bofnet_executeassembly - integrating in-process standard .NET assembly execution into BOF.NET. No modifications to executed assemblies required (unlike my last tweet). Thanks @_EthicalChaos_ for pointing me in the right direction! github.com/CCob/BOF.NET/pull…
Porting existing .NET projects for use with the fantastic BOFNET from @_EthicalChaos_ (in-process .NET assembly execution in Cobalt Strike for when you need to avoid fork and run). williamknowles.io/quickly-po…
Abusing Windows section object permissions for privilege escalation. An interesting case that permitted application-specific environment variables to be modified resulting in arbitrary DLL loads. Affects GE iFIX < 6.1 (industrial HMI product). applied-risk.com/resources/g…
William Knowles retweeted
C3 now supports C2 over LDAP for all your egress and lateral movement needs. Looks like LDAP, quacks like LDAP, must be LDAP? labs.f-secure.com/blog/intro…
Exploring code coverage for module stomping - injecting into unused code areas in legitimately loaded DLLs - williamknowles.io/living-dan…
You can disable the Windows 10 security event log as a low privileged user due to weak registry permissions. Requires reboot to kick in, but the system will stop doing command line logging, etc, if configured. Change "Start"->0 or corrupt/delete other properties.
William Knowles retweeted
A C# tool to enumerate remote access policies via GPO. Useful for targeted lateral movement!! based on prior work of @joncave and @william_knows
github.com/mwrlabs/SharpGPO-…
Very happy to say I'll be presenting at @WEareTROOPERS #TR19 along with my colleague James Coote this coming March. The topic will be practical attack simulations in industrial environments.
William Knowles retweeted
Looking forward to sharing new #RedTeam shiny C3 tooling from @mwrlabs @william_knows tomorrow with the #BlueHatV18 attendees.
William Knowles retweeted
About to head to #BlueHatv18. If you’re around, do come along to hear myself & @william_knows from @mwrinfosecurity @mwrlabs talk about “Overt C2: The Art of Blending In” on Thursday at 16:10 PM. There will be demos of new shiny #RedTeam tooling C3 \0/
William Knowles retweeted
Finally got round to releasing part two. Thought I’d use the excellent GhostPack by @SpecterOps/@harmj0y as an example countercept.com/blog/detecti…
William Knowles retweeted
I’m going to really enjoy presenting this with @william_knows blogs.technet.microsoft.com/… #Microsoft #BlueHat v18.
I'll be speaking at Skytalks at DEF CON this Friday at 13.00 about conducting practical attack simulations in critical national infrastructure. defcon.outel.org/dc26-consol… @dcskytalks