@psycep_

Senior Red Team Consultant @Mandiant

Joined November 2021
  • Tweets36
  • Following60
  • Followers234
5Media
Windows is now supported + an internal -proxy flag
Jacob Paullus@psycep_Apr 17
gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) github.com/mandiant/gopacket…

GitHub - mandiant/gopacket: A complete Go port of Impacket - 63 CLI tools and 24 libraries for...

A complete Go port of Impacket - 63 CLI tools and 24 libraries for Windows & Active Directory protocol attacks, compiled to a single dependency-free binary. - mandiant/gopacket

github.com
1
15
1,397
hey… stop that
Florian Roth ⚡️
@cyb3ropsApr 21
Nice work by the Mandiant team We took a quick look at the compiled binaries and THOR already detected 9 of the tools via generic rules. We then added coverage for the rest.
7
961
gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) github.com/mandiant/gopacket…

GitHub - mandiant/gopacket: A complete Go port of Impacket - 63 CLI tools and 24 libraries for...

A complete Go port of Impacket - 63 CLI tools and 24 libraries for Windows & Active Directory protocol attacks, compiled to a single dependency-free binary. - mandiant/gopacket

github.com
7
123
4
418
61,294
Jacob Paullus retweeted
Andrew Oliveau
@AndrewOliveauMar 19
🔥🤖Excited to share a new blog I co-authored with @h4wkst3r and @kulinacs - Automating the Operator: Integrating LLMs into Offensive Security armadin.com/blog-posts/autom… We show how LLMs make offensive work more operationally useful, introduce 2 new MCP servers, and an NTLM relaying Gemini extension POC

Integrating LLMs into Offensive Security Workflows

LLMs can streamline reconnaissance, automate data enrichment, assist with repeatable attack path chains, and significantly reduce friction in triage and reporting.

armadin.com
1
39
1
109
10,931
RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS. Hope you enjoy the blog & tool drop 🤟 ibm.com/think/x-force/remote…

RemoteMonologue: Weaponizing DCOM for NTLM authentication coercions | IBM

The IBM X-Force Red team covers the fundamentals of COM and DCOM, dives into the RunAs setting and why authentication coercions are impactful and introduces a new credential harvesting tool.

ibm.com
17
175
6
460
69,900
Publishing a new blog and tool tomorrow 👀
4
4
44
4,589
The tool is release ready, someone give me motivation to write a blog
2
7
237
Planning a new blog+tool release, stay tuned 👀
2
1
11
455
ANOTHA ONE ☝️ check out our latest @Mandiant blog, showcasing the terrifying Browser-in-the-Middle techniques of the modern social engineer cloud.google.com/blog/topics…

BitM Up! Session Stealing in Seconds Using the Browser-in-the-Middle Technique | Google Cloud Blog

The browser in the middle technique can enable compromises, especially if defenses and MFA aren't properly implemented.

cloud.google.com
13
1
38
4,170
Our blog on CVE-2023-6080 is here 💥 check it out! We detail the discovery and exploitation process, going from low privilege to SYSTEM 😎 cloud.google.com/blog/topics…

CVE-2023-6080: A Case Study on Third-Party Installer Abuse | Google Cloud Blog

Mandiant exploited flaws in the Microsoft Software Installer repair action of Lakeside Software's SysTrack installer to obtain arbitrary code execution.

cloud.google.com
1
10
14
512
T-Minus two weeks until my first Mandiant blog as the principal author drops as well 🥳 (Detailing the discovery of CVE-2023-6080)
Jacob Paullus@psycep_15 Jan 2025
Contributed to my first Mandiant blog on web applications, check it out! Officially on my way to becoming a certified web boy (pls no) 🕸️🕸️ cloud.google.com/blog/topics…

Your Single-Page Applications Are Vulnerable: Here's How to Fix Them | Google Cloud Blog

Single-page applications (SPAs) typically have multiple access control vulnerabilities that can introduce risk.

cloud.google.com
3
9
396
Contributed to my first Mandiant blog on web applications, check it out! Officially on my way to becoming a certified web boy (pls no) 🕸️🕸️ cloud.google.com/blog/topics…

Your Single-Page Applications Are Vulnerable: Here's How to Fix Them | Google Cloud Blog

Single-page applications (SPAs) typically have multiple access control vulnerabilities that can introduce risk.

cloud.google.com
1
1
1
7
534
Excited to finally share some details of my favorite CVE, discovered with @psycep_ (definitely give him a follow)! This one’s a fun local privilege escalation vulnerability in Lakeside Software’s SysTrack LsiAgent Installer – CVE-2023-6080 🤜🤛 github.com/mandiant/Vulnerab…

Vulnerability-Disclosures/2024/MNDT-2024-0009.md at master · mandiant/Vulnerability-Disclosures

Contribute to mandiant/Vulnerability-Disclosures development by creating an account on GitHub.

github.com
1
14
78
5,642
A long time in the making, my first credited CVE! cve.org/CVERecord?id=CVE-202… w/ @AndrewOliveau and Jake Rawlins
8
16
997
Jacob Paullus retweeted
Nick@kulinacs19 Aug 2024
Excited to share the (now patched) AKS Privilege Escalation we found! cloud.google.com/blog/topics…

"WireServing" Up Credentials: Escalating Privileges in Azure Kubernetes Services | Google Cloud Blog

An attacker with access to a vulnerable Microsoft Azure Kubernetes Services cluster could have escalated privileges and accessed credentials for services used by the cluster.

cloud.google.com
2
11
1
24
3,996
6 business weeks later, the blog is here! 🙌 Check it out: cloud.google.com/blog/topics…

"WireServing" Up Credentials: Escalating Privileges in Azure Kubernetes Services | Google Cloud Blog

An attacker with access to a vulnerable Microsoft Azure Kubernetes Services cluster could have escalated privileges and accessed credentials for services used by the cluster.

cloud.google.com
3
1
7
439
It got delayed :’(
Jacob Paullus@psycep_9 Jul 2024
My first Mandiant blog drops Thursday 🥳
1
158
My first Mandiant blog drops Thursday 🥳
1
1
4
318
Disclosed my first 0-day today (with @AndrewOliveau)
2
1
11
2,640
Another option is to run “openssl s_client -connect <DC>:636 -showcerts -debug” and look for the CA server tied to the domain controller.
Aurélien Chalot@Defte_29 May 2024
Wanna blindly check if the ADCS web enroll is installed on a domain ? Bruteforce the /certenroll endpoint without the trailing/ on all webservers. If you hit the ADCS web enroll you will get a location: /certenroll/ header in the response. Now enjoy blind ntlmrelayx ESC8👀👀👀
2
57
191
22,779
Load more