my latest post on abusing DES using Kerberos, I've not updated my RoastInTheMiddle tool yet but I'll be doing that shortly, enjoy:
https://t.co/eWoPZcPEN6
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3
Happy to finally share a new blog with @exploitph on our work revisiting the Kerberos Diamond Ticket.
✅ /opsec for a more genuine flow
✅ /ldap to populate the PAC
🆕 Forge a diamond service ticket using an ST
We finally gave it a proper cut 💎
https://t.co/lxneqm3Ssi
@sekurlsa_pw@al3x_n3ff this technique makes several attacks possible, one I wrote about at the same time is kerberoasting from a mitm position without creds:
https://t.co/m8KkI9s5Mi
Have you ever wondered if there was a way to deploy a "Remote EDR"? Today I'm excited to share research I've been working on for the past couple months.
This dives into DCOM Interfaces that enable remote ETW trace sessions without dropping an agent to disk.
Includes a detailed write-up: https://t.co/AiSJZwu3zk
And a new GitHub project "JonMon-Lite": https://t.co/A0rtvhvZNG
@_RastaMouse@_EthicalChaos_@__invictus_@4ndr3w6S I think the TDO holds both, as I said I think it's due to how the server lookup is coded, it was easier to have a trust account for requesting tickets rather than trying to code it differently or something, but I'd need to be familiar with the code to be sure
@_RastaMouse@4ndr3w6S so you request a referral to krbtgt/domain2, it uses the account cred for the DOMAIN2$ INTERDOMAIN_TRUST_ACCOUNT as the service key for the referral
@_abs0lute I'm not sure about with john and certainly the more resources you have, the larger increase you'll notice, but it seems to be due to the enc-part being around 1000 bytes smaller (at around 100-200 bytes without a PAC), it doesn't make a huge difference but it's definitely faster