攻防技战术动态一周更新 - 20261102

原创

红蓝对抗技术
红蓝对抗技术

红蓝对抗技战术

2026年11月7日 21:51
北京

去阅读

漏洞相关

1、TrustedHive - (CVE-2026-81963 Suspected)

https://github.com/dis0rder0x00/TrustedHive

LPE Proof-of-Concept for Windows 11 abusing TrustedInstaller's Component Based Servicing (CBS) session COM object and junctions for arbitrary file write.

红队技术

1、Microsoft Defender for Identity evasions in 2026 – Part I

https://cirosec.de/en/news/microsoft-defender-for-identity-evasions-in-2026-part-i/

2、The Quiet Phase: Why Active Directory Group Enumeration Deserves Your Attention

https://trustedsec.com/blog/the-quiet-phase-active-directory-group-enumeration?utm\_content=388981894&utm\_medium=social&utm\_source=twitter&hss\_channel=tw-403811306

3、Red Team vs Pentest: Active Directory Attack Workflow

https://secjuice.com/red-team-vs-pentest-active-directory-attack-workflow/

4、Dump Encoding Library

https://ipurple.team/2026/09/21/dump-encoding-library/

5、Windows Network Provider DLL: Stealing Plaintext Credentials at Logon

https://medium.com/@s12deff/windows-network-provider-dll-stealing-plaintext-credentials-at-logon-0bfdad980d89

6、Paint It Blue: Reversing Win32k's Callbacks

https://idov31.github.io/posts/paint-it-blue-reverse-win32k

7、Malware development trick 68: Module overloading. Simple C example

https://cocomelonc.github.io/malware/2026/11/02/malware-tricks-68.html

8、Executing Shellcode in an Isolated vCPU

https://medium.com/@s12deff/executing-shellcode-in-an-isolated-vcpu-5ac0cc4baaac

9、From a Regular Red Team Exercise to Developing a Custom C2 Channel over MS Teams

https://blog.scrt.ch/2026/04/21/from-a-regular-red-team-exercise-to-developing-a-custom-c2-channel-over-ms-teams/

10、Pass-ta-key Golden Attack: Extracting the Security Domain Secret from Chrome process memory

https://0rcruxe.github.io/posts/pass-ta-key-golden-attack-sds-extraction/

https://github.com/0rcruxe/pass-ta-key

11、[Learning] Kernel Debugging, Basic Driver Programming, and Basic BYOVD

https://iss4cf0ng.github.io/2026/10/31/2026-10-31-KernelDebugging/

蓝队技术

1、

工具类

1、tprtdll-Injection

https://github.com/ivancabrera02/tprtdll-Injection

tprtdll.dll is a Microsoft-signed DLL shipped in C:\Windows\System32\ on Windows 11 (build 26100+). It exports many of the same Nt\/Zw\/Rtl\* functions as ntdll.dll, but mapped as an independent image at separate virtual addresses.

2、HyperLoader

https://github.com/S12cybersecurity/HyperLoader

Hypervisor isolated shellcode execution environment. Maps host process memory into a guest vCPU, intercepts DLL execute faults, and proxies API calls to the host, Stardust PIC shellcode compatible

3、IPP Coercion BOF

https://github.com/sudonoodle/BOF-coerce-ipp

Beacon Object File (BOF) to coerce machine account auth via IPP.

4、SecureDeskDown: Unprivileged Keystroke Injection to SYSTEM via G HUB. Local Privilege Escalation via UAC Bypass.

https://github.com/dennywise/SecureDeskDown

5、Keyeroo

https://github.com/grayhatkiller/keyeroo

Relay a coerced victim's NTLM authentication to LDAP and run an operation as that victim, even when the domain controller requires LDAP signing and is fully patched.

6、espjack

https://github.com/xpsec-Security/espjack

Esp32 based offensive-security and post-exploitation toolkit.

7、DefenderObserver

https://github.com/dobin/defender\_observer

Collect Defender Telemetry/Logs

其他类

1、