Last Week in Security (LWiS) - 2024-05-29
A special two week edition!
A special two week edition!
Evading MDI (@yaumn_), TAP->NTLM (@_dirkjan), ELF verifier (@kev169), Kerberos delegation + 🦀 in beacons (@_RastaMouse), and more!
Entra to on-prem (@_dirkjan), new bloodhound edges (@Jonas_B_K ), Chrome type confusion (@_manfp), GitHub RCE via actions (@Creastery), and more!
AD Group abuse (@decoder_it), NetNTLM leak attacks (@pfiatde), 'adversary flywheels' (@WHITEHACKSEC), Nemesis 1.0 (@harmj0y + team) and more!
LSA Whisperer (@mcbroom_evan), VirtualBox LPE (@mansk1es), Android Intent exploitation (@suidpit), MagicDot "rootkit" (@oryair1999), and more!
Dev tunnels for C2 (@RedSiege), UAF Windows LPE (@KeyZ3r0), SCCM enum script (@_Mayyhem), ETW patching (@jsecurity101), and more!
Evilginx + GoPhish (@mrgretzky), Ghostwriter updates (@cmaddalena), Intune EPM privesc (@synzack21 + team) 🎣 page bot defense (@fin3ss3g0d), and more!
XZ backdoor (@fr0gger_ + @amlweems), best LPE since DirtyCOW (@notselwyn), SCCM pwnage (@AndrewOliveau + @__Mastadon), kernel fuzzing (@R00tkitSMM), and more!
CI/CD attacks (@bishopfox), IdP pwnage (@_xpn_), on-prem exchange attacks (@Jonas_B_K), Windows privesc (@p1k4l4), SCCM in GOAD (@M4yFly), and more!
Windows patch diffing (@clearbluejar), FileCatalyst RCE (@Nettitude_Labs), Windows/Frida course (@FuzzySec), Tor WebTunnel bridges (@torproject, Pixel 7/8 Pro exploit (@_simo36), and more!