Beetle Chunks

OSCP, Red Teamer, Pentester, Developer, Hacker

[Beetle Chunks @BeetleChunks]

@NotMedic @yarden_shafir I like to leave certain analysts handles in there @SamG0ld :D

[Tim McGuffin @NotMedic]

This is beautiful because every exchange server has admin to every other exchange server in the environment. With auth coercion, you go from low priv to admin, then a high likelihood of SYSTEM on one Exchange server to AddMember of privileged groups.
One of my favorite paths.

[Beetle Chunks @BeetleChunks]

Was checking out and noticed the Windows 10 bar at the bottom… wish I hadn’t scanned my card 😑 #DEFCON31

[Beetle Chunks @BeetleChunks]

I just pushed the code from my #DEFCON31 talk, Malware Design - Abusing legacy Microsoft transports and session architecture. https://t.co/BMnoQqnCrW

[Pavel Yosifovich @zodiacon]

Chapter 5 is ready (for now)...
https://t.co/LJHlqRUD1a

[Beetle Chunks @BeetleChunks]

Found out I’ll be speaking @defcon 31! Malware design - abusing legacy Microsoft transports and session architecture. Hope to see you there! #DEFCON #DEFCON31

[Beetle Chunks @BeetleChunks]

@SamG0ld No.

[Beetle Chunks @BeetleChunks]

@sadhineth You are putting "1s" before the SMB share. You need to put "-lS".

[Beetle Chunks @BeetleChunks]

Just made SpoolSploit(https://t.co/tH2AoSQyjW) public on my GitHub: A collection of Windows print spooler exploits containerized with other utilities for practical exploitation. #printnightmare #spoolsample

[Beetle Chunks @BeetleChunks]

@sadhineth Ah I see the issue. Create a folder called “logs” in the “ssploit” directory. This directory is created automatically in my docket build file so if you fun it directly then you have to create that folder.

[Beetle Chunks @BeetleChunks]

@SamG0ld You should start a new line of whiteboards. I would buy one.

[SkelSec @SkelSec]

I waited 2 years for this, rewrote impacket for this, asked cryptographers to remake algos in python for this, spent enormous time of my life to make this happen. and it's finally here this finally works and I can't find the words to express my satisfaction.

[Beetle Chunks @BeetleChunks]

@SamG0ld Man, you can never have to much desk space IMO. My clutter has to be somewhere. Might as well be within arms reach haha.

[Beetle Chunks @BeetleChunks]

@SamG0ld

[Tim McGuffin @NotMedic]

“Dad, what’s cocaine?”
Thanks @Amazon predictive text on my kid’s kindle.

[Beetle Chunks @BeetleChunks]

CVE-2020-12116 POC here: Unauthenticated arbitrary file read in Manage Engine OpManager (https://t.co/ZHPrpD8Xl9). Loot? Private Keys/Certificates, Key Stores, Encryption Keys, Domain Credentials, and every file in the application root install directory.

[Beetle Chunks @BeetleChunks]

@anakata15470651 @Lares_ @gentilkiwi Thanks. I appreciate it.

[Lares @Lares_]

Oh, and here is the #tool that can be used to replicate the findings in @BeetleChunks' blog post: https://t.co/2YedEyMiyH

[Lares @Lares_]

New on the Lares blog - Hunting Azure Admins for Vertical Escalation: Part 2: https://t.co/GO1Kbwp2qx