EAGAIIN

I break things casu consulto. Red Team at CrowdStrike. My views and comment are my own and do not reflect my employer’s views.

[r0BIT @0xr0BIT]

shipping: WinSSHound

maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.

https://t.co/ONXuguz7r3

[Tom Jøran Sønstebyseter Rønning @L1v1ng0ffTh3L4N]

The proof of concept for this issue is live - contact me if you have any issues.
I am not very experienced in C#, nor in publishing on GitHub, so any feedback is appreciated.
https://t.co/wwARWN5PKp

[incendiumrocks @incendiumrockz]

It's been a while since I wrote a blog post. My new post writes about some cool updates to the MS-RPC-Fuzzer for recursively fuzzing complex structures, logging using ETW, and we found a way to escalate to nt\authority system!

https://t.co/Guxzx0gu2J

[EAGAIIN @EAGAIIN]

@yaumn_ Very juicy bonus! Relays are not dead. Thanks for the research 💪🏼

[EAGAIIN @EAGAIIN]

@haider_kabibo @0xocdsec If you need SeImpersonatePrivilege, why is this not another Potato?

[EAGAIIN @EAGAIIN]

@vxunderground Malware roulette should be a thing

[Jacob Paullus @psycep_]

gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) https://t.co/9XjTickbyA

[n00py @n00py1]

@HackingLZ https://t.co/uam8E4wwrr

Maybe useful

[dylan davis @lildylannn]

I just dropped some research: DSCourier and would love for your opinion and to check it out!!

It’s a novel post-exploitation technique abusing WinGet’s COM API to execute code through Microsoft-signed binaries.

GitHub: https://t.co/pgIhifT5cT
Blog: https://t.co/kgeBvZw06N

[EAGAIIN @EAGAIIN]

@LeveragedHonky @LeafsPassion85 @Waffl3x @Gunvetta @netflix This

[EAGAIIN @EAGAIIN]

@0xLupin @pentest_swissky Great work!

[chiefofautism @chiefofautism]

someone at ANTHROPIC just showed CLAUDE finding ZERO DAY vulnerabilities in a live conference demo

claude has found zero day in Ghost, 50,000 stars on github, never had a critical security vulnerability in its entire, history...

it found the blind SQL injection in 90 minutes, stole the admin api key, then did the exact, same thing to the linux kernel

[CCob🏴󠁧󠁢󠁷󠁬󠁳󠁿 @_EthicalChaos_]

Small updated to DRSAT just pushed that will also allow Group Policy Editor and Certificate Authority / Templates MMC snap-ins work over a TCP only SOCKS connection.
https://t.co/zqGYByH9wc

[EAGAIIN @EAGAIIN]

@Nikaiw @HackingLZ

[NK @Nikaiw]

meet VMkatz, https://t.co/eza4AXRuFT

[EAGAIIN @EAGAIIN]

@614ck1n9 @BetterCallMedhi Les failles sont pas toujours techniques/technologiques

[EAGAIIN @EAGAIIN]

@co11ateral @three_cube @_aircorridor @DI0256 Sounds like a lot of work to just get unusable hashes

[EAGAIIN @EAGAIIN]

@TheXC3LL So the grass is not greener on the other side, just different

[EAGAIIN @EAGAIIN]

@Jean_Maes_1994 Oh no, just going to make it harder for us mere humans

[Logan D @relay_royalty]

Introducing RelayKing.

https://t.co/D55uuCv6mX

Blog: https://t.co/usrPECsVno

Automatically identify relay attack paths. No longer will you be left to manually detect a comprehensive inventory of all the relaying vectors on your engagements.

It will detect signing/EPA settings on all protocols you specify, NTLM reflection CVEs, and WebDav WebClient presence. Then, produce a comprehensive report of the relaying vectors on the network in your preferred output format. This ensures that you report ALL vulnerable instances easily, without the need for manual patching together of results from various tools.

Ideal usage is with a set of low-privilege AD credentials, but it also supports unauthenticated scanning (with far less coverage). See GitHub and the blog post for more details.

Please note that there ARE bugs. The LDAP(S) detection has been annoying but SHOULD be mostly solid. If you get suspicious results from it, please report an issue on GitHub with the config RelayKing reported, versus the actual one.

Enjoy!