Etienne Cote

Father, Cybersecurity Consultant, OSCP, Security enthusiast and one CVE :)

[Dominic Chell 👻 @domchell]

This cropped up recently for me and hopefully save someone some time... If you're exploiting ADCS and get a KDC_ERR_CERTIFICATE_MISMATCH error, this is down to strong mapping enforcement. Just supply the SID + UPN during your cert request and gtg as normal

[codewhisperer84 @codewhisperer84]

Check out my latest blog post on how the NTDS.dit file is used by Active Directory, and my accompanying tool, DIT Explorer, for browing the data contained within NTDS.dit.

Blog post: https://t.co/11Q7yy3O5q

DIT Explorer on Github: https://t.co/b1bx8WbR5I

[Gareth Heyes \u2028 @garethheyes]

https://t.co/QLLVrH27AZ

[Jean-Michel Besnard @jmbesnard_maz]

Want to check for #ESC15 ? Use the following cypher with #BloodHound
MATCH p=(:Base)-[:MemberOf*0..]->()-[:Enroll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(:Domain) WHERE ct.enrolleesuppliessubject = True AND ct.authenticationenabled = False AND ct.requiresmanagerapproval = False AND ct.schemaversion = 1 RETURN p

Thanks @Jonas_B_K
More information available here: https://t.co/RiRtKsN7B5

[Andrea P @decoder_it]

Following up on my earlier tweet (https://t.co/hTBzbcXcxD) regarding Kerberos relay with SMB server, I've uploaded my quick & dirty version. It's far from perfect, so feel free to improve it! https://t.co/Pi0sfpTbc7

[Adam Chester 🏴‍☠️ @_xpn_]

New tool published which is proving to be useful. Cred1py allows execution of the CRED-1 SCCM attack published by @Raiona_ZA over SOCKS5 UDP by wrapping the awesome https://t.co/vlpvKEVziV from @0xcsandker. Enjoy :) https://t.co/NO7HYTA1PP

[Nicolas Krassas @Dinosn]

The PrintNightmare is not Over Yet https://t.co/aY32jCGC9Q

[Nicolas Krassas @Dinosn]

HTB: EvilCUPS https://t.co/7PBSLR0Ohz

[Haifei Li @HaifeiLi]

Personal update: if you need a guy who is passionate on innovative in-the-wild zero-day exploit detection and advanced vulnerability research, please let me know. DM open. :)

[Panos Gkatziroulis 🦄 @ipurple]

shellsilo - a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode https://t.co/CP2ostqF1A

[Panos Gkatziroulis 🦄 @ipurple]

MaLDAPtive - a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection https://t.co/V9K0SPAxsc

[Print3M @Print3M_]

If you want to take a happy little journey through PEB structs, PE headers and kernel32.dll Export Table to spawn some "calc.exe" on x64 using Assembly, here it is. Enjoy :)
https://t.co/e1ZGw1LdO5

[kristen shaughnessy @kshaughnessy2]

More scrutiny of PwC's auditing

Evergrande's liquidation lawyers are looking into auditor's role in Evergrande overstating its revenue by $78 Billion
over two years through 2020.

$78 Billion over two years!

"Lawyers appointed by the liquidators of China Evergrande Group are investigating some of the property developer's service providers including its former auditor PricewaterhouseCoopers, to potentially recoup losses for creditors, three sources said.

Evergrande, once China's largest property developer, was ordered to be liquidated by a Hong Kong court in January, after it failed to deliver a concrete restructuring plan for its $23 billion worth of offshore debt deemed to be in default.

The move, which is common in liquidation cases, indicates initial steps being taken towards liquidation of the world's most indebted property developer with more than $300 billion of total liabilities.

Reuters reported in March, citing sources, that lawyers working on Evergrande's liquidation will look for evidence of wrongdoing and negligence across the company, its management and external advisers that could have led to it defaulting on its debt..."

https://t.co/sY5h89kLG4

[Synacktiv @Synacktiv]

In our latest blogpost, @croco_byte presents an often overlooked AD attack surface related to OUs ACLs,with the release of a dedicated exploitation tool, https://t.co/RRSBNZXXWA (https://t.co/NVy2xuP2yX).
https://t.co/6sPEjza33b

[Orange Cyberdefense's SensePost Team @sensepost]

Decorrelate attack tool behaviour to avoid EDR interference. In this post, @Defte_ writes about how remote LSA secrets dumping works and retrieves a Windows computer's BOOTKEY using less common methods.

https://t.co/yTmmJupCd5

[Etienne Cote @ECote7]

@mysmartlogon @UK_Daniel_Card I sent an email 😎. Thx!

[Etienne Cote @ECote7]

Ummm i think someone cleared the value instead of setting it to 0 😱

[Etienne Cote @ECote7]

1/2 Anyone has ever seen the ms-ds-MachineAccountQuota attribute missing from an Active Directory ?
@SecurityAura @PyroTek3 @_wald0

[Etienne Cote @ECote7]

2/2 I tried all ldapsearch against all DCs, used ADExplorer, nxc and PingCastle. None reported the missing attribute. Sounds like everyone can join computers to AD. I created 11 computers to test the default.

[Florian Hansemann @CyberWarship]

''Sleeping Safely in Thread Pools | White Knight Labs''

#infosec #pentest #redteam #blueteam
https://t.co/NEyirJpeV5