Quentin Roland

Pentester @Synacktiv 🤖

[Synacktiv @Synacktiv]

Attacking heavy applications through named pipes: an attack surface often overlooked due to its complexity.

In this article, @TurboThonSec explains how we designed a tool abusing legitimate processes to attack higly privileged components of heavy clients.

Article⬇️
https://t.co/Y9tAU0xGAi

[SpecterOps @SpecterOps]

Hidden GPO-based attack paths are now in BloodHound.

@croco_byte breaks down new OU & AD Site abuse paths that can lead to privilege escalation or full domain compromise, and how to find, map, and weaponize them. #SOCON2026

[DirectoryRanger @DirectoryRanger]

https://t.co/rrK8yn7IFm: Exploiting SCCM Policies Distribution for Credentials Harvesting, Initial Access and Lateral Movement, by @croco_byte
https://t.co/KBnJFNSY1O

[Synacktiv @Synacktiv]

HID recently disclosed HID-PSA-2025-002, a critical flaw in the #ActivID Authentication Appliance 8.7.

In our new blog post, @us3r777 and @__pierreg break down exactly how they uncovered it, from methodology to exploitation 💡

Read it here ⬇️
https://t.co/wmXamNEqra

[Synacktiv @Synacktiv]

[Blogpost] @croco_byte presents how to exploit attack paths related to Active Directory sites' ACLs.
As the latter often constitute a blind spot for AD enumeration tools, the article also describes a pull request aiming to integrate them into the BloodHound project: https://t.co/s1qTnPvD2y

[Synacktiv @Synacktiv]

Afterwards, the great @croco_byte took the stage, also at #OrangeCon, to present the authentication relay techniques he discovered earlier this year.
As always, he illustrated his talk with a demo, showing that these techniques can be applied to real-world AD environments. 🔥

[Synacktiv @Synacktiv]

How safe is your browser?
Our ninja, Riadh Bouchahoua, uncovers how attackers can exploit Chromium extension loading to steal data, maintain persistent access, and breach confidentiality on Chromium-based browsers.
Read more here ⬇️ https://t.co/Q9c4CnL8qr

[Synacktiv @Synacktiv]

🧑‍🎓 Boost your offensive Active Directory skills with our Entry & Advanced trainings. Hands-on labs with dozens of machines + latest research from DEFCON, x33fcon & more! Seats are limited, don’t miss out!
🔗 Entry: https://t.co/7get5clXOg
🔗 Advanced: https://t.co/KEVNM9zdjF

[Quentin Roland @croco_byte]

@mpgn_x64 @mael91620 @rayanlecat @_bluesheet @_sans23 🐊

[Panos Gkatziroulis 🦄 @ipurple]

🛠️ GroupPolicyBackdoor - a python utility for Group Policy Objects (GPOs) manipulation and exploitation.
✅ GPO attack vectors can very often lead to impactful privilege escalation scenarios in Active Directory environments. https://t.co/2bh2HsPORv

[Synacktiv @Synacktiv]

The GroupPolicyBackdoor tool, presented at #DEFCON 2025, is now available on Synacktiv's GitHub: https://t.co/CWLknch5RZ
This python utility offers a stable, modular and stealthy exploitation framework targeting Group Policy Objects in Active Directory!

[Daniel @0x64616e]

My personal #defcon33 highlights:
Better tools for GPO exploitation: https://t.co/ZR1DT7LWOo
Critical vulns in Zscaler and Netskope: https://t.co/FaHFNdyPLL
Phishing on official Microsoft login: https://t.co/P0kwW8GFkD
SSH vulnerabilities: https://t.co/g3YOZfNKuo

[Quentin Roland @croco_byte]

@mjc91295814 @wil_fri3d Hi! The tool will be published during next week on Synacktiv's Github, we'Il announce the release with a tweet 😀

[Synacktiv @Synacktiv]

🔥 A few hours ago our experts took the stage at #DEFCON33, sharing cutting-edge research on SCCM exploitation and modern GPO attacks in Active Directory. Proud of the team! 🙌 cc @kalimer0x00 @quent0x1 @wil_fri3d

[Synacktiv @Synacktiv]

Don't miss @kalimer0x00 at #DEFCON33!
His talk, "SCCM: The Tree That Always Bears Bad Fruits", covers modern attack paths and abuse techniques in Microsoft SCCM, with a focus on internals, post-exploitation, and persistence! https://t.co/Vs9MAtax0I
#DEFCON #SCCM

[Synacktiv @Synacktiv]

Catch us at #DEFCON33!
@quent0x1 and @wil_fri3d will show how to turn your Active Directory into the attacker’s C2. They'll dive deep into how Group Policy Objects can be leveraged for stealthy enumeration and privilege escalation! https://t.co/CTT9EVdc50
#DEFCON #ActiveDirectory

[Synacktiv @Synacktiv]

Microsoft just released the patch for CVE-2025-33073, a critical vulnerability allowing a standard user to remotely compromise any machine with SMB signing not enforced! Checkout the details in the blogpost by @yaumn_ and @wil_fri3d.
https://t.co/EY5Z53w1ZT

[Wil @wil_fri3d]

Check out how I discover CVE-2025-33073 : RCE with NTLM reflectiv attack allowing authenticated user to compromise any machine without SMB signing enforced !

[Quentin Roland @croco_byte]

@stratosberry @Synacktiv The recording of the presentation should be available here shortly: https://t.co/FvoinppvXv

[DirectoryRanger @DirectoryRanger]

Taking the Relaying Capabilities of Multicast Poisoning to the Next Level: Tricking Windows SMB Clients into Falling Back to WEBDAV, by @synacktiv
https://t.co/DcCzTOmXFQ