Gabe Marshall

Penetration Tester @ NCC Group | Developer | Thoughts are my own and what not... Creator of the @EverSecCTF

[Gabe Marshall @gabemarshall]

@mgrnpxp @MeanGreenMBB A blast from the past, wow! Josh White was so much fun to watch.

[Justin Baragona @justinbaragona]

Historically, as a country, we've had two women who were chosen as a major party's presidential nominee -- and both were defeated decisively by a man who was close friends with Jeffrey Epstein and famously said "grab 'em by the pussy."

Make of that what you will.

[The Daily Show @TheDailyShow]

Jon Stewart on election night: "We're all going to have to wake up tomorrow morning and work like hell to move the world to the place that we prefer it to be." #DailyShow

[Dan Helton @ch1kpee]

I'm back on the job market. If you know anyone who is looking for a seasoned penetration tester, red teamer, and/or manager, let me know! #opentowork

[Gabe Marshall @gabemarshall]

@0xdab0 Heh…dongle

[Eversec CTF @EverSecCTF]

Congrats to our winners and thanks to everyone who played the EverSec CTF this weekend at @cackalackycon! See you again at @BSidesRDU

[Gabe Marshall @gabemarshall]

@thefarmersdog Thank you for taking the time to send us a handwritten condolence letter. It means a lot, and we look forward to being a customer of yours again one day in the future. ❤️😢

[UNT Men's Basketball @MeanGreenMBB]

NIT CHAMPS! #GMG

[Gabe Marshall @gabemarshall]

been a life saver* 😳

[Gabe Marshall @gabemarshall]

I'm a huge fan of Royal TSX. It's been life saver when it comes to keeping track of infrastructure on a daily basis. #adhd

[Royal Apps @royalapps]

We are still celebrating #CyberMonday! 🎉

Here's our #deal: Get our Royal TS (Win) and Royal TSX (macOS) Individual User Licenses and Royal TS/X + Royal Server Personal Licenses and save 50%!

Use the #discount code "CYBERMONDAY22" ➡️ https://t.co/mIIz1xWiVm

#CyberMonday2022

[Anthony. @AnthonySecurity]

Have valid Okta creds, but the account has MFA? Try auth’ing to their sandbox instance ({target}.oktapreview.com)
It might be using the same userdb and unlikely the user has setup their MFA there. Lots of “staging” apps have access to production assets… #redteam

[Greg Linares (Laughing Mantis) @Laughing_Mantis]

My latest phishing campaign is spoofed ticketmaster emails telling people they got access to Taylor Swift tickets

It's at 140% success rate

I am going to hell but at least I got shells

[Gabe Marshall @gabemarshall]

@SaraKauffman 🙋‍♂️😭

[Beto O'Rourke @BetoORourke]

If you're in line to vote, stay in line and cast your ballot.

[Piper Madland @pipermadland]

Texans, I learned this from Harris County Elections Adminstrator: you can overnight your ballot back. It has to be mailed 11/8 with proof of mailing (UPS/FedEx receipt) and must be received by 5 pm 11/9.

[Gabe Marshall @gabemarshall]

@mpgn_x64 @felmoltor @snovvcrash @_ZakSec Unless the stealth option is used (which doesn't appear to be implemented within the cme module) it does drop a service binary to disk.

[mpgn @mpgn_x64]

Dumping LSASS is such a 2020 move, let me introduce a new CrackMapExec module called Masky developed by @_ZakSec 🎉

If you have admin privilege, the module will impersonate all users connected -> ask a certificate (ADCS) -> retrieve the NT hash using PKINIT 🚀

Crazy module 🪂

[Dominic Chell 👻 @domchell]

Make JS great again! 🙌

[Gabe Marshall @gabemarshall]

@domchell 🤤

[Eversec CTF @EverSecCTF]

Amazing work all around 👏🏼