Charlie Clark retweeted
This release is probably going to be one of our biggest and most impactful! Kudos to the team @peterwintrsmith @modexpblog @s4ntiago_p @GigelV41464 @saab_sec 🙌
Charlie Clark retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
Charlie Clark retweeted
Happy to finally share a new blog with @exploitph on our work revisiting the Kerberos Diamond Ticket.
✅ /opsec for a more genuine flow
✅ /ldap to populate the PAC
🆕 Forge a diamond service ticket using an ST
We finally gave it a proper cut 💎
huntress.com/blog/recutting-…
the same technique also allowed me to bypass authentication silos:
msrc.microsoft.com/update-gu…
this technique makes several attacks possible, one I wrote about at the same time is kerberoasting from a mitm position without creds:
exploit.ph/all-ur-as-belong-…
Charlie Clark retweeted
Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months.
This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk.
Includes a detailed write-up: jonny-johnson.medium.com/no-…
And a new GitHub project "JonMon-Lite": github.com/jonny-jhnson/JonM…
Charlie Clark retweeted
My #SOCON2025 talk is now live for those interested in credential guard research. youtu.be/9U_7u849yQQ?feature…
I think the TDO holds both, as I said I think it's due to how the server lookup is coded, it was easier to have a trust account for requesting tickets rather than trying to code it differently or something, but I'd need to be familiar with the code to be sure
idk why exactly, ig you'd have to ask MS, perhaps the way AD works under the hood it requires an actual account to create a ST
so you request a referral to krbtgt/domain2, it uses the account cred for the DOMAIN2$ INTERDOMAIN_TRUST_ACCOUNT as the service key for the referral
I assume you mean the INTERDOMAIN_TRUST_ACCOUNT, in which case it's used to request a referral to the foreign domain
I'm not sure about with john and certainly the more resources you have, the larger increase you'll notice, but it seems to be due to the enc-part being around 1000 bytes smaller (at around 100-200 bytes without a PAC), it doesn't make a huge difference but it's definitely faster