Ash

Computer enjoyer // бегство от действительности))      
(@Mandiant+@GoogleCloud)

[Ash @_bin_Ash]

@rad9800 lemonmaxxers assemble

[Ash @_bin_Ash]

@nikseeth I obviously do not cheer for the breach of any company, but I imagine that people in the SOC 2 world who have been shouting from the hilltops for years about the disingenuousness of automated SOC 2 platforms, feel very vindicated rn

[Ash @_bin_Ash]

@IceSolst @Atredis @DistrictCon "If that is what you want."
"This is hard work."
"I will do what I must."
"This hammer is heavy."
"Can I have some shoes?"

I don't think they could release a game like this nowadays lmao

[Ash @_bin_Ash]

PSA technique is not completely dead

The implied attack path of the post is coerce auth from system -> relay to LDAP -> computer account writes its own attribute

Post patch, there are still use cases for shadow creds. (GenericAll, GenericWrite, or AddKeyCredentialLink, etc).

[Aurélien Chalot @Defte_]

Anyone know if Microsoft silently patch the Shadow Creds attack recently ? Looks like a computer object cannot write its own attribute anymore :D

[Ash @_bin_Ash]

@ConsciousHacker lots of people who used to post cool stuff on Twitter, got consulting jobs, and now are 🤐🤐🤐

[Graham Helton (too much for zblock) @GrahamHelton3]

Excited to disclose my research allowing RCE in Kubernetes

It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.

Unfortunately, this will NOT be patched.

[Ash @_bin_Ash]

@WYTCHRR @hourlybladee What is it like living that close to holy ground?

[Ash @_bin_Ash]

@tcstacks_ If you’re really good at infosec you can be wrong and still get paid

[Ash @_bin_Ash]

I thought infosec twitter was toxic until I discovered meteorology twitter

[Ash @_bin_Ash]

@techspence @jeffmcjunkin MFA on SMB when? @Microsoft

[Ash @_bin_Ash]

@GrahamHelton3 If I had followed this I would have become a lifelong SAP admin

[Ash @_bin_Ash]

@OutflankNL @StanHacked @mariuszbit Whoa!! awesome congrats y’all

[Ash @_bin_Ash]

@jamieantisocial People who say this have obviously never heard of spongemaxxing

Always try to be around smart people. Ask them for advice. Find people building or doing cool things and ask them about it

I’m lucky to feel dumb on a daily basis at work when I talk to colleagues

[Joeyꪗ @Jxxyy]

Why does my Washer machine need AI

[Ash @_bin_Ash]

@tcstacks_ Ok but what about pentesting 2?

[Ash @_bin_Ash]

@Blurbdust @ch1gg1ns Thank u Mr Losby ❤️❤️❤️

[Ash @_bin_Ash]

@HackingLZ @HackingDave brb telling Google marketing to dislike this post

[Ash @_bin_Ash]

@vysecurity Also somewhat related but there are SO many super super talented red teamers that are _not_ on Twitter/x at all. Take what u read on here with a grain of salt

[Ash @_bin_Ash]

@vysecurity Some of the most talented people I've had the pleasure of working with are great because of this. ofc technically they are gifted, but I learned to most from people who thing strategically about how to break in, what to do next, what levers to pull to get someone to do xyz, etc