Breaking stuff and writing about it
Joined April 2021
- Tweets97
- Following281
- Followers290
- Likes1.1K
HTTP418 retweeted
I wrote a script to identify every TAKEOVER and ELEVATE attack in Misconfiguration Manager that can be run with Read-only Analyst privileges or higher in SCCM. Please share with your IT admins, defenders, clients, assessors, and friends in infosec!
posts.specterops.io/rooting-…
HTTP418 retweeted
Today the Cyber Safety Review Board released its independent review of the Summer 2023 Microsoft Exchange Online intrusion laying out what led to the intrusion & what industry & gov't can do to ensure an intrusion at this magnitude does not happen again. go.dhs.gov/JRT
HTTP418 retweeted
MachineAccountQuota = 0, preventing you from grabbing NAA creds remotely?
DPAPI to the rescue!
Ported over NAA Extraction via DPAPI to sccmhunter.
h/t: @agsolino & @clavoillotte for SystemDPAPI.py
HTTP418 retweeted
We would like to express our condolences to Blue Teamers.
Microsoft has announced Microsoft Excel will now support Python.
More information: techcommunity.microsoft.com/…
HTTP418 retweeted
Didn't have time to talk about the newly released TLDs last week, but here we go.
File Archiver In The Browser: Emulating file archive software in the browser with a .zip domain for phishing
mrd0x.com/file-archiver-in-t…
HTTP418 retweeted
We had some issues this year preparing the video recordings of #TROOPERS22. But finally the first batch of videos has been released! Go check it out here: youtube.com/@TROOPERScon 🥳 The rest will follow in the coming weeks! Happy holidays everybody! See you at #TROOPERS23!
HTTP418 retweeted
Free Membership upgrade for students that sign-up to Shodan with their academic email address: help.shodan.io/the-basics/ac…
HTTP418 retweeted
Looking to learn the importance of obfuscation but don't know where to start? Join us on Nov 22 for our Beginners Guide To Obfuscation class! Learn to build AMSI bypass techniques and obfuscate payloads from dynamic and static signature detection methods.
eventbrite.com/e/a-beginners…
HTTP418 retweeted
Will the Real Msiexec Please Stand Up? Exploit Leads to Data Exfiltration
➡️Initial Access: CVE-2021-44077 exploited
➡️Execution: Web shell
➡️Credential Access: WDigest + MiniDump
➡️Lat Movement: RDP using Plink
➡️Exfiltration: Sensitive data exfilled
thedfirreport.com/2022/06/06…
HTTP418 retweeted
Unsafe .Net Deserialization in Windows Event Viewer! This is a by-product of my research. Has confirmed with MSRC that this didn't cross any security boundary, but I guess it could still be another fun #LOLbas or Defender Bypass.😆
HTTP418 retweeted
Check out my new post about coercing NTLM authentication from the local admin accounts used by SCCM servers, how to prevent it, and the release of SharpSCCM, a C# tool that can be used to demonstrate the impact of these techniques: posts.specterops.io/coercing…
HTTP418 retweeted
@saerxcit implemented some recent AD attacks into LDAP relays - for hardened environments where usual techniques are not working, and wrote about why and when to use them: offsec.almond.consulting/lda…
HTTP418 retweeted
New blog: Relaying Kerberos over DNS using krbrelayx and mitm6.
New method of gaining RCE on AD hosts in the same VLAN without credentials or needing NTLM, by abusing Kerberos, DNS and Active Directory Certificate Services.
Blog: dirkjanm.io/relaying-kerbero…
HTTP418 retweeted
I published a new post about SPN-jacking - an edge case in WriteSPN abuse (pun intended).
Check it out:
semperis.com/blog/spn-jackin…
HTTP418 retweeted
We are releasing #BloodHound 4.1 on February 9th, 2022. In the release webinar, @CptJesus, @ddlees and I will cover:
✅ New edges
✅ Big changes to SharpHound
✅ Quality of life improvements
Register here: specterops.zoom.us/webinar/r…. Recording available afterwards.
HTTP418 retweeted
New blog post: Windows 10 RCE via an argument injection in the ms-officecmd URI handler.
While our RCE vector (MS Teams) has been fixed, the argument injection still persists.
positive.security/blog/ms-of…
HTTP418 retweeted
Using supposedly impregnable encrypted phones, Serbian hit men discussed plans to kill a judge. But as they texted, their messages also flashed up on the computer screens of a secret police team in Belgium that had hacked into the messenger service they were using, Sky ECC.
Wild story about the secret police hack of a global network for drug runners, gangsters and hitmen: “Here are pictures of the wife. You can break her legs" on.wsj.com/3CQpt5g
HTTP418 retweeted
So excited that we at @wisporg partnered with @offensive_con on a scholarship to give 7 free tickets, training & travel to women in security! Applicants will be reimbursed up to $2k worth of travel costs to Germany. 🎉 Apply here for scholarship by 11/27: forms.gle/PSvLUNoxxJ4qFLPv7
