Macmod

CyberSecurity Analyst, Computer Scientist & Programmer

[Macmod @MacmodSec]

@g0h4n_0 Great work @g0h4n_0! \o

[Macmod @MacmodSec]

@SpiderMorpheus Conhece o https://t.co/9XUBHSQZLJ? :)

[Macmod @MacmodSec]

@cryptopeg Very nice! :)

[Tom Dale @tomdale]

After 88 hours and ~10,000 coordinating agents, we're sharing a solution to the two hardest problems in computer science.

[SEKTOR7 Institute @SEKTOR7net]

Exploiting default Active Directory permissions to create malicious, dormant DNS records for future hostnames.

This might help hijacking new machine records upon network join for subsequent Kerberos or NTLM relay attacks.

A post by Giulio Pierantoni.

Source: https://t.co/1BxP8ANonm

#redteam #blueteam

[Macmod @MacmodSec]

In ldapx v1.3.3 you can now use Unicode modifiers to make queries for attributes like cn and sAMAccountName look like nicknames from 2010😄

[Andrea P @decoder_it]

Super cool research from my colleague Shai Laron on new attack paths to Active Directory that can lead to full domain takeover 😜 . It was presented at Black Hat and he will be speaking again at DEF CON this weekend.
Don't miss this 💪 :
https://t.co/4jIUkg8VNF

[Macmod @MacmodSec]

@sekurlsa_pw @g0h4n_0 @_dirkjan I just had the massive luck of having relatively good libs to import in Go instead of having to rewrite everything myself (which I wouldn’t ever do)

[Macmod @MacmodSec]

@sekurlsa_pw @g0h4n_0 @_dirkjan Sounds accurate to me! The main references for most features were SharpHound, the SharpHoundCommon library, and https://t.co/zVmEXcdvlX. There are a couple of smaller bugs I know about and I don’t have much time to fix, but for 99% of use cases it should be equivalent :)

[Macmod @MacmodSec]

@sekurlsa_pw @g0h4n_0 @_dirkjan Also RustHound is a great initiative, but Rust is still a bit behind on libs that implement core Windows protocols, so that’s probably the reason it doesn’t cover some of the active collection features

[Macmod @MacmodSec]

@sekurlsa_pw @g0h4n_0 @_dirkjan Problem really is getting the community to help with new features / keeping track with SpecterOps updates - the reason some features may exist in SharpHound and not in https://t.co/zVmEXcdvlX is probably related to that

[Macmod @MacmodSec]

@jessefmoore As for the active decryption feature, understanding what legitimate clients do is key to understanding how to blend in when designing offensive tooling, and although most offensive tooling does not encrypt/sign traffic post-bind, many legitimate clients do (such as ADExplorer)

[Macmod @MacmodSec]

🚀ldapx v1.3.0 just dropped
Now with active decryption of security layers on top of LDAP, working with ADExplorer and pretty much every other client (or so I hope). Plus better logging, TLS listeners, "pass the cert" support and other upgrades. Link in the reply👇

[Macmod @MacmodSec]

@jessefmoore For defensive purposes it can be used similarly to understand the traffic fingerprints of known tools with regards to LDAP ops that can be used to build detections

[Macmod @MacmodSec]

@jessefmoore It depends really. For offensive purposes you can obfuscate LDAP searches and other ops (modifications, creations etc) inline to evade custom detections or identity protection alerts. You can also use it to understand what sorts of queries your tools may be issuing under the hood

[Macmod @MacmodSec]

@PoetaRaiz https://t.co/Mod8rxSNVh

[Dave W Plummer @davepl1968]

We had a big meeting one day and decided that when you type a word like Downloads into the Start Menu, what you really wanted to do is to load Edge and search MSN with Bing for Downloads.

[Macmod @MacmodSec]

https://t.co/Y0bxybi7ZJ

[nix @aniqfakhrul]

Happy to share a technical analysis by @h0j3n on our recent CVE-2026-54121 a.k.a Certighost. glhf🔥

Technical analysis: https://t.co/jYrZDLPlJr
POC: https://t.co/yBeHg1vQHP

[Macmod @MacmodSec]

@sekurlsa_pw Yes! https://t.co/O16NYjMuni (lines 47-52)

[Macmod @MacmodSec]

@sekurlsa_pw A cool trick is checking the Sites container in the configuration partition on LDAP (either over the standard port or over the GC 3268 port) as it sometimes contains details on the topology, but ultimately only probing can give some sort of indirect measure of latency 😅