Hey @h2hconference, on your CFP page you have 2 deadlines - Oct 1 for proposals and Oct 17 for slides. Does that mean that you expect both proposals and slides before you make the decision about acceptance? Or only those who've received an acceptance note need to submit slides?
George Noseevich retweeted
Thing I learned today: Decrypting arbitrary TLS sessions
on Windows (for code utilizing schannel):
b.poc.fun/decrypting-schanne…
Great explanation, and very easy to use code, by @webpentest
George Noseevich retweeted
Thanks @hackerdom, @HITBSecConf , @disruptad, @crowdfense, and all competitors for another great AD CTF!
George Noseevich retweeted
Thanks to @hackerdom and all participating teams for #ructf! It has been fun, as always.
Продолжаю бодаться с опсосами. На этот раз с @ru_mts. Три месяца назад писал заявление на расторжение - теперь поддержка говорит что ничего не было, предлагает ... написать претензию. Надо внедрять протоколы неотказуемости для корреспонденции. Заказным письмом что ли послать...
Косячат и обманывают все операторы (есть опыт с @Beeline_RUS, @megafonru , @Tele2Russia и @ru_mts), но максимально комфортный опыт взаимодействия был с @Tele2Russia, они умеют принимать жалобы через дм и возвращать деньги без нервотрепки. С МТС пока опыт самый днищенский.
Part 2 of my schannel research is out: b.poc.fun/decrypting-schanne…. It is much shorter and focuses mainly on session resumption. As always, feedback is very welcome, especially RE TLS1.3 resumption in schannel.
After doing various tests I'm now reasonably sure that current experimental TLS1.3 implementation in Schannel lacks support for any kind of session resumption.If TLS1.3 is enabled, the client doesn't even advertise session_ticket support in ClientHello.
Anyone familiar with win10 schannel state of the art: is session resumption via ids or tickets a thing of the past now? Could not make the client (ie in my case) to resume a TLS session and didn't find a way to enable. In Server 2012 still works as expected out of the box.
UPD: updated another machine (non-VM) to 2004 and cannot reproduce - sessions resume as expected. WTF :/
UPD2: diffing registry fixed the problem. Apparently, DisableClientExtendedMasterSecret reg setting now disables session resumption as well, because starting from Oct 2019 MS enforces EMS for resumption due to CVE-2019-1318. See support.microsoft.com/en-us/….
Some time ago I had a task where I needed to extract TLS session keys from win apps that use schannel (i.e. mstsc). Did some reversing and ended up creating a frida script that hooks key creation in lsass. Feedback welcome! b.poc.fun/sslkeylog-for-scha…
Update: a full writeup of my Schannel + TLS research is now out (b.poc.fun/decrypting-schanne…), featuring a complete walkthrough, some novel research about TLS1.2 session hashes and TLS1.3 + a rewritten script. Feedback is very welcome.
(1/n) Any RDP protocol experts? I've been researching a bit lately and noticed a strange Client Info PDU that contains login-password pair and happens after a complete CredSSP exchange is perfomed.
(3/3) Both freerdp and mstsc send this and I am not able to find what is it used for. Here is how it looks in traffic after TLS decryption
Seems that this is documented (docs.microsoft.com/en-us/ope…) and used to "auto logon using the included user name, password and domain", but it seems that nowadays the autologin happens w/creds from CredSSP step and this PDU is just ignored?
