Grzegorz Tworek (@0gtweet) / X

Grzegorz Tworek

7,074 posts

Grzegorz Tworek

@0gtweet

My own research, unless stated otherwise. Not necessarily "safe when taken as directed". GIT d- s+: a+ C++++ !U !L !M w++++$ b++++ G-

Joined April 2012

Grzegorz Tworek
@0gtweet
May 7, 2024
Making my computer unhackable after realizing "Security questions" are actually UTF-16LE JSON stored as ResetData REG_BINARY in HKLM\SAM\SAM\Domains\Account\Users\...
Grzegorz Tworek
@0gtweet
Nov 29, 2021
Finally had a moment to test Winlogon password leaking (a.k.a. notifying) on Windows 11. No big surprise. And the flow is: -user enters password -winlogon loads mpnotify.exe -mpnotify opens RPC channel -winlogon sends pass via RPC -mpnotify forwards to DLL -DLL stores it on disk
Grzegorz Tworek
@0gtweet
Jan 3, 2022
WHAT?! 😂 If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path... The weirdest custom DLL launcher I have meet so far :D
Grzegorz Tworek
@0gtweet
Mar 8, 2023
Windows 10 offline admin creation? 😈 Why not?! Everything happens through built-in offlinelsa and offlinesam DLLs. Official, but not very documented. Enjoy the source code and the compiled exe, as usual: github.com/gtworek/PSBits…
GIF
Grzegorz Tworek
@0gtweet
Oct 18, 2021
Need to download mimikatz (or some other nasty stuff) without alerting Windows Defender Antivirus? Paste these 3 lines into the command line 👇👇👇 1/2
Grzegorz Tworek
@0gtweet
Feb 23, 2023
Need an almost invisible, post-exploitation, persistent, fileless, LPE backdoor? There are many, but this one looks really beautiful for me: type "sc.exe sdset scmanager D:(A;;KA;;;WD)" from an elevated command prompt.
Grzegorz Tworek
@0gtweet
Feb 16, 2022
Probably the weirdest #LOLBin I have ever found... 😅 wlrmdr.exe -s 3600 -f 0 -t Click me! -m To run calculator -a 10 -u calc.exe
Grzegorz Tworek
@0gtweet
Nov 5, 2022
Do you detect IIS Application Pool credential dumping by looking for "/text:*"? Time to update your rules with undocumented /show, /(at)t, and /(at)text.
Grzegorz Tworek
@0gtweet
Jul 17, 2022
Didn't described it precisely so far: If you put 'mpnotify' value into the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, your exe will be launched by winlogon.exe when user logs on. After 30s the process will be terminated. persistence-info.github.io/Data/mpnotify.…
Grzegorz Tworek
@0gtweet
Jun 14, 2022
A new tool has arrived! 😎 Somewhat like netstat, but with timestamps for connections!⏱ The C source code, and the compiled exe, as usual - github.com/gtworek/PSBits…
Grzegorz Tworek
@0gtweet
May 12, 2020
Eliminate huge part of lateral movement scenarios with one command: "reg.exe add HKLM\SYSTEM\CurrentControlSet\Control /v DisableRemoteScmEndpoints /t REG_DWORD /d 1" It will make Service Control Manager deaf to remote management. Everything else works properly.
Grzegorz Tworek
@0gtweet
Nov 3, 2023
By-design AV bypass with "dev drive" 😅 I really like this feature! Update your detection rules if you want to spot this...
Grzegorz Tworek
@0gtweet
Jul 1, 2022
Is #SysInternals Sysmon good for discovering the full historical process tree? Of course! Bored with manual process, I have create simple (but fully working) PowerShell script, displaying the tree in a nicely walkable form. Enjoy: github.com/gtworek/PSBits…
Grzegorz Tworek
@0gtweet
Apr 7, 2024