Zero Networks Research team, specializing in open source security tools for defenders. Join our slack at https://xitter.cf/t.co/wODnpNlq9F
Tel Aviv, Israel
Joined June 2023
- Tweets125
- Following25
- Followers242
- Likes71
#NauthNRPC is a tool that can help you enumerate computer / user accounts anonymously in #ActiveDirectory via DsrGetDcNameEx2 RPC calls.
This is not often in most environments, so used could be blocked via #RPCFirewall.
Nice job by @haider_kabibo 🏆🏆
hubs.li/Q03tvVVY0
Zero Labs retweeted
My thoughts about CVE-2025-33073, and on how to prevent #NTLM / #Kerberos relay attacks in general using #RPCFirewall & #LDAPFirewall
zeronetworks.com/blog/examin…
Are you sure you can enumerate all of your #Azure resources? You may be missing some out.
#MapAz is a new #PowerShell Module that (among other things) can help you enumerate hidden resources.
Read more in my latest post:
zeronetworks.com/blog/discov…
Excellent writeup by @cybergentix on #WMI #LateralMovement
Didn't mention mitigation via #RPCFirewall, which could be achieved by blocking remote #DCOM operations
blog.fndsec.net/2024/09/11/w…
Zero Labs retweeted
ADCS … often exploited, rarely mentioned
ADCS Cheat Sheet, by @pentest_swissky
swisskyrepo.github.io/Intern…
Read @dekel_paz excellent writeup on #badsuccessor #LDAP vulnerability, and how to mitigate with the #LDAPFirwall
BadSuccessor is a slick AD privilege escalation that uses LDAP to take over user accounts
…and the LDAP Firewall can already block it — no updates needed.
How the attack works + how to block it:
👉 zeronetworks.com/blog/stoppi…
Yes, LDAP enumeration is still a thing in 2025.
2ns.fi/en/ldap-enumeration-i…
A new open source tool to visualize #LDAP data ovre #Neo4j graph database: #Neo4LDAP by @_kripteria !
And, you can inject data directly from #BloodHound 🐕
Check it out here:
github.com/Krypteria/Neo4LDA…
CVE-2025-29969 is an RPC #RemoteCodeExecution vulnerability, base score 7.5.
Exploits a time-of-check time-of-use & affects Windows vers 2025, 2022, 2019, 2016, 2012 R2, 2012, 2008 R2 SP1, 2008 SP2; Win 11 22H2/23H2/24H2, Win 10 1607/1809/21H2/22H2.
msrc.microsoft.com/update-gu…
Zero Labs retweeted
Shields up! time to limit access to Telnet (TCP port 23) on internal network.
CC: @ZeroNetworks
A critical vuln in Microsoft’s Telnet Server - complete 0-click NTLM auth bypass
Most people laughed: “Who the hell still runs Telnet?”
But a quick Shodan search shows over 2,000 exposed instances, most of them on Windows XP.
Hopefully, many are honeypots - hopefully…
Internally though, it’s a different story.
Ask your IT team or run a proper asset discovery - you might find Telnet quietly running on:
- Embedded devices
- Factory lines
- Legacy control systems
- Display systems in airports or hospitals
I’ve seen it before - and it’s probably still out there.
(Shameless plug: our THOR scanners can still assess systems as old as Windows XP for signs of compromise.)
securityonline.info/0-click-…
A handy list of LDAP search filters used by common enumeration tools, compiled by @Unit42_Intel (@PaloAltoNtwks).
The best part? You can block all of them with our open-source #LDAPFW! 📷
Full article: unit42.paloaltonetworks.com/…
Get started: github.com/zeronetworks/ldap…
Did you know that you can block DCOM via the #RPCFirewall?
Make sure you're protected against #RemoteMonologue #NTLM #Coersion !
github.com/zeronetworks/rpcf…
RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.
Hope you enjoy the blog & tool drop 🤟
ibm.com/think/x-force/remote…
This one checks a lot of #LateralMovement TTPs. Could have been nicely blocked by #LDAPFirewall & #RPCFirewall + some #NetworkSegmentation
How #blackSuit #ransomware spread from first fake #zoom installer -> d3f@ckloader #IDAT #SectopRAT
thedfirreport.com/2025/03/31…
🌟New report out today!🌟
Fake Zoom Ends in BlackSuit Ransomware
Analysis and reporting completed by @pigerlin, UC1 and @Miixxedup
Audio: Available on Spotify, Apple, YouTube and more!
thedfirreport.com/2025/03/31…
Zero Labs retweeted
Nice work by @YaronZi & @CrowdStrike promoting LDAP Security to detect suspicious LDAP activities.
crowdstrike.com/en-us/blog/i…
Maybe someone wants to slap an AI agent on their #LDAPFirewall for similar results? :)
github.com/zeronetworks/ldap…
How to stop #LDAPNightmare / #LDAPBleed
CVE-2024-49112 & CVE-2024-49113
zeronetworks.com/blog/preemp…
When we first published "What the Filter" we never thought we would have more than a 100 downloads, let alone a thousand.
We're happy to see the community getting value with the latest version bypassing the 1000 mark ! 🏆
powershellgallery.com/packag…
Zero Labs retweeted
🎉2024 brought remarkable growth, new faces to #ZeroNation, and plenty of fun moments together 💪🏼🚀.
To our customers, partners, investors, and team—thank you for an incredible year; here’s to a successful and inspiring 2025! 🥂
#ZeroNetworks #NewYear2025 #Cybersecurity #Gratitude
Hi all!
We released a native version for WTF-WFP, supporting a limited number of operations. Especially good for those instances when you can't use #PowerShell module #NtObjectManager.
/bypass command will skip the entire layer of filters
github.com/zeronetworks/WTF-…
Zero Labs retweeted
Unauthenticated Remote Code Execution (RCE) on Domain Controllers (DC).
It does not get worse than that. Probably will be included in #ransomware campaigns.
Any technical analysis of CVE-2024-49112 published?
CC: @gentilkiwi @harmj0y @_wald0
#ShadowHound by @yudasm_ evades EDRs by operating as a PS module & using a stealthy LDAP search query.
🚨Block it with our free #LDAPFirewall tool!
github.com/Friends-Security/…
