Coontzy1 retweeted
hey did you know you cant get remotely hacked if you stop putting your shit on the internet
Coontzy1 retweeted
From an AD on-prem POV, I still can't believe this research by @MGrafnetter was released this year.
If you haven't read it… definitely worth a read!
Pure 🔥
troopers.de/troopers26/talks…
Coontzy1 retweeted
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
Coontzy1 retweeted
Very cool technique to bypass SMB signing, appears to be patched on recent Windows versions.
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
Coontzy1 retweeted
Microsoft patched PetitPotam in their latest update, EFSRPC now validates shares locally, killing WebDAV coercion
💀
Added a check to NetExec’s enum_cve module to detect if a host already has the fix (CVE-2026-102217), so you can quickly spot what’s still exploitable 🔥
Coontzy1 retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
Coontzy1 retweeted
Did you know PKINIT isn’t the only way to auth with a cert? 🔥
DC cert missing KDC Auth EKU? PKINIT fails (KDC_ERR_PADATA_TYPE_NOSUPP).
A cert from your AD CS (ESC1/ESC8) is still a valid TLS cred. NetExec’s –schannel binds to LDAP/LDAPS with it, skipping Kerberos pre-auth.
Coontzy1 retweeted
Unleash your cybersecurity superpowers at @BSidesColumbus, November 4-5! Be sure to join @curi0usJack and @L1NKD34D for their two-day session, “Supply-Chain to Runtime - RedTeam”—an offense-only training on attacking the modern DevOps stack. Register now! hubs.la/Q04B9XXj0
Coontzy1 retweeted
Little upgrade on NetExec WMI protocol 🚀
Now NetExec supports SAM, LSA and NTDS dump using only WMI. Thanks a lot to @al3x_n3ff for all the help on this PR (and all the work on NetExec overall, you rock bro 🫶)
Coontzy1 retweeted
With PR 2325, you can now expand your ESC8 relay targets in impacket to include CES web enrollment endpoints 🚀
github.com/fortra/impacket/p…
Coontzy1 retweeted
Did you know you can request a certificate via NTLM relay through these 2 AD CS endpoints? 🔥
/<CAName>_CES_Kerberos/service.svc/CES
/<CAName>_CES_NTLM/service.svc/CES
This article explains it really well 👇
adhdmurky.github.io/posts/po…
RustHound-CE v2.5.21 now also checks whether these endpoints exist (on top of /certsrv/certfnsh.asp) so #BloodHound can graph the path!
#ADCS #ESC_CES
Coontzy1 retweeted
We're hiring! TrustedSec is looking for a Hardware Security Consultant / Penetration Tester to join our team. If you're passionate about hardware security and hold your own in application security, this one's for you. Apply now! #infosecjobs
hubs.la/Q04yGQGR0
Coontzy1 retweeted
Whos going to meet me at burningrivercybercon.com/ ? Nov14, 2026?
Coontzy1 retweeted
“apparently privesc to Global Admin and a MFA bypass does not meet the threshold for "immediate servicing". even tho it was patched within days” #QOTD
Coontzy1 retweeted
ItsNotAlwaysSMB: DPAPI in other protocols🔥
SMB is monitored closely nowadays, stopping attacks like looting DPAPI secrets. Thanks to @_zblurx, NetExec got a huge upgrade, extending DPAPI credential dumping to other protocols such as WMI, WinRM and MSSQL and various modules🔑
ALT Dumping DPAPI secrets via WinRM, MSSQL and WMI
ALT Dump various credentials using DPLoot
Coontzy1 retweeted
Kevins been cleaning up a lot of BOFs lately and added a bad_alloc_tracking branch to COFFLoader that helps catch memory leaks, corruption, and crashes in BOFs.
Run your BOF through COFFLoader64_test.exe. If it complains, fix it.
github.com/trustedsec/COFFLo…
Coontzy1 retweeted
Everyone says on-prem AD is picked clean.
Nope!
AD RMS still ships in Server 2025. It got two pages in "AD in a Month of Lunches."
It deserves a series. LFG! 😈
huntress.com/blog/ad-rms-arc…
