OSCP, Red Teamer, Pentester, Developer, Hacker
Joined July 2010
- Tweets417
- Following137
- Followers266
- Likes198
Beetle Chunks retweeted
This is beautiful because every exchange server has admin to every other exchange server in the environment. With auth coercion, you go from low priv to admin, then a high likelihood of SYSTEM on one Exchange server to AddMember of privileged groups.
One of my favorite paths.
As I've already found multiple vulns that allowed to trigger NTLM auth in Exchange, I can't wait for this talk by @D1iv3 🔥
conference.hitb.org/hitbsecc…
Was checking out and noticed the Windows 10 bar at the bottom… wish I hadn’t scanned my card 😑 #DEFCON31
I just pushed the code from my #DEFCON31 talk, Malware Design - Abusing legacy Microsoft transports and session architecture. github.com/BeetleChunks/Obli…
Beetle Chunks retweeted
Chapter 5 is ready (for now)...
leanpub.com/windowsnativeapi…
Just made SpoolSploit(github.com/BeetleChunks/Spoo…) public on my GitHub: A collection of Windows print spooler exploits containerized with other utilities for practical exploitation. #printnightmare #spoolsample
Beetle Chunks retweeted
I waited 2 years for this, rewrote impacket for this, asked cryptographers to remake algos in python for this, spent enormous time of my life to make this happen. and it's finally here this finally works and I can't find the words to express my satisfaction.
CVE-2020-12116 POC here: Unauthenticated arbitrary file read in Manage Engine OpManager (github.com/BeetleChunks/CVE-…). Loot? Private Keys/Certificates, Key Stores, Encryption Keys, Domain Credentials, and every file in the application root install directory.
Beetle Chunks retweeted
Oh, and here is the #tool that can be used to replicate the findings in @BeetleChunks' blog post: github.com/LaresLLC/AzureTok…
Beetle Chunks retweeted
New on the Lares blog - Hunting Azure Admins for Vertical Escalation: Part 2: buff.ly/3aCR10F
Beetle Chunks retweeted
@Lares_ is back on the hunt for an Appsec/research pro. Love tearing up products? Does API stand for Always Pwning Infrastructure? Are front end web apps just an appetizer? Are you always hungry for more? Reach out! We have a job for you. [email protected]
Beetle Chunks retweeted
@BeetleChunks of @Lares_ discovers Use-After-Free (UAF) Vulnerability (CVE-2019-1199) in Microsoft Outlook. Full write up here: buff.ly/2Z4wWOm
Beetle Chunks retweeted
Changeme 1.2.0 is out. It features a Telnet scanner by @decidedlygray and several new credentials. github.com/ztgrace/changeme/…
Beetle Chunks retweeted
Have creds on a local network but no shell yet? Try this.
SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket
github.com/NotMedic/NetNTLMt…
Thanks for the shoulders @tifkin_ @0x31337, @agsolino, @3xocyte, @Evil_Mog, @mysmartlogon
#EternalSpool
Beetle Chunks retweeted
OMG, look what I got :-) Simply add a registry entry value (UAC free) on windows 10 1803, then we can make our vbscript or jscript files bypass AMSI PERMANENTLY! Isn't it so easy? or is it an Easter egg Microsoft left to us? :-( @tiraniddo @bohops @subTee @Oddvarmoe @domchell
