https://xitter.cf/t.co/j1RauZBiTh
Suisse
Joined December 2009
- Tweets168
- Following204
- Followers418
- Likes515
Sylvain Heiniger retweeted
Ups and downs of #redteam engagements. When the standard payloads don’t cut it, innovation wins. Learn how we misused a screenshot tool to load shellcode… at the fifth attempt!…
blog.compass-security.com/20…
Sylvain Heiniger retweeted
I am excited to share with you my latest research - "DCOM Upload & Execute"
An advanced lateral movement technique to upload and execute custom payloads on remote targets
Forget about PSEXEC and dive in!
deepinstinct.com/blog/forget…
github.com/deepinstinct/DCOM…
Sylvain Heiniger retweeted
Oh, you didn't know? Cool kids are now relaying Kerberos over SMB 😏
Check out our latest blogpost by @hugow_vincent to discover how to perform this attack:
synacktiv.com/publications/r…
Sylvain Heiniger retweeted
COM is old but gold—for attackers! 🚨 In our latest blog, Sylvain Heiniger (@sploutchy) exposes a privilege escalation vulnerability in the Google Chrome updater. Want to know how cross-session EoP still happens today? Check it out! #COM
blog.compass-security.com/20…
Sylvain Heiniger retweeted
DCOM cross-session coercion + Kerberos = 💣 We took a closer look at the attacks discovered by @decoder_it and @D1iv3 earlier this year and made a PoC in Python! Curious? Full blog post here: blog.compass-security.com/20…
#potato #impacket
Sylvain Heiniger retweeted
You like device code phishing? You will like Felix Aeppli’s latest research even more. He shows how to backdoor Entra ID phished accounts by adding a new sign-in method. Details and PoC here: blog.compass-security.com/20…
Sylvain Heiniger retweeted
Collision – Compass Security was able to execute their stack overflow attack against the Synology BC500. However, the exploit they used was previously known. They still earn $3,750 and 0.75 Master of Pwn points. #Pwn2Own
Sylvain Heiniger retweeted
Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain + left-to-right mark (U+200E)
Links in <a> tags will show the fake domain, but open the real domain.
No need to buy .zip! :) Convincing #phishing #redteam
Sylvain Heiniger retweeted
We did it again with #LocalPotato!
A not-so-common NTLM reflection attack allowing for arbitrary read/write. Basically EoP from user to SYSTEM.
Tracked as #CVE-2023-21746 - Windows NTLM EoP
Soon more details --> localpotato.com
cc @splinter_code
Sylvain Heiniger retweeted
🆕More personal news here ..
I want to share that the Impacket project is moving to @fortraofficial's @CoreSecurity!
It will now be part of their open source portfolio, and funded with a team of very talented security professionals.
github.com/fortra/impacket
#impacket
Sylvain Heiniger retweeted
Recordings of #blackalps22 are available here: blackalps.ch/ba-22/talks.php
Sylvain Heiniger retweeted
Next week I will present a #talk at #BlackHat Europe 2022 on how to automate the search of RPC functions allowing to coerce authentications on #Windows.
Alongside this talk, I'm publishing a brand new version of #Coercer!
➡️Check it out here: github.com/p0dalirius/Coerce…
Sylvain Heiniger retweeted
Found an vhdx/vmdk/vhd file in a network share? Volumiser from @_EthicalChaos_ gets you covered to exfiltrate e.G. SAM/SYSTEM to compromise the system via Administrator Pass-The-Hash:
github.com/CCob/Volumiser
Really easy and intuitive to use 👏
Sylvain Heiniger retweeted
Si tu as aidé une dame à vélo aujourd'hui devant un tram à Genève, peut-être tu as perdu cet airpod qui est tombé par terre. #airpod #28.11.2022 #geneve #geneva xitter.cf/JJPomareta/status/1597…
Sylvain Heiniger retweeted
At @BlackAlpsConf, our analyst Sylvain Heiniger @sploutchy presented a new attack path to AD CS. Read his blog post for details and tools updates. #adcs #esc11 #ntlmrelay #rpc #msrpc
blog.compass-security.com/20…
Sylvain Heiniger retweeted
At the end of my talk @BlackHatEvents #Europe 2022, I'll release a completely refactored version of #Coercer. It will include lots of new features useful for pentesters and researchers. 🎉🥳
Star this repository github.com/p0dalirius/Coerce… and/or follow me so you don't miss it!👌
#BHEU "Searching for RPC Functions to Coerce Authentications in Microsoft Protocols" briefing will explore a way to automate this process by parsing Microsoft's OpenSpecs online documentation as well as Interface Definition Language code: bit.ly/3CWOJua
Sylvain Heiniger retweeted
The last part of A New Attack Surface on MS Exchange - #ProxyRelay is out! Have also left some final thoughts on the Closing part. Hope you all enjoy this journey :D
blog.orange.tw/2022/10/proxy…
Sylvain Heiniger retweeted
Weak passwords are a nightmare for corporate security. In his blog post, Felix Aeppli @_fxai shows how easy hashes can be cracked and what you can do to improve (without blaming the users). #passwords #cracking
blog.compass-security.com/20…
Sylvain Heiniger retweeted
Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service not installed but you still want to relay DC authentication to ADCS?
Don't worry MS-DFSNM have your back ;)
github.com/Wh04m1001/DFSCoer…
Sylvain Heiniger retweeted
➡️Part 3 of our series: Session Enumeration Through Remote Registry & Summary
blog.compass-security.com/20…
➡️Part 2 of our series: Session Enumeration Through NetWkstaUserEnum & NetSessionEnum
blog.compass-security.com/20…