@[email protected] (inactive)

account inactive, goto mastodon if you want to follow me

[@[email protected] (inactive) @michael_eder_]

NFS has not received much attention of the offensive security community in nearly a decade. Today, we are happy to share our research on the topic: https://t.co/iehDxiF46m. I'll give you a short overview in this thread 🧵 (1/5) #redteam #pentest

[@[email protected] (inactive) @michael_eder_]

Took me two grok requests to return to default (or at least something that looks like it)
See you over in the sane part of the internet!

[@[email protected] (inactive) @michael_eder_]

Took me two grok requests to return to default (or at least something that looks like it)
See you over in the sane part of the internet!

[@[email protected] (inactive) @michael_eder_]

#NewProfilePic

[Aurélien Chalot @Defte_]

Anyone know if Microsoft silently patch the Shadow Creds attack recently ? Looks like a computer object cannot write its own attribute anymore :D

[Mandiant (part of Google Cloud) @Mandiant]

Net-NTLMv1 is outdated, insecure, and must go. 🛑

To help defenders prove the risk and accelerate deprecation, we’ve released a comprehensive dataset of rainbow tables. See how easily these keys can be recovered, and secure your environment.

Read more: https://t.co/g4gjEAhCiv

[Alex Neff @al3x_n3ff]

NetExec v1.5.0 is now available on kali!

Go ahead and apt update && apt upgrade your system to get all the new features🚀

[SpecterOps @SpecterOps]

SCCM attack paths are messy until you can see them. 👀

ConfigManBearPig from @_Mayyhem extends BloodHound with SCCM nodes + edges using OpenGraph, plus queries to surface hierarchy takeovers and escalation paths.

Check it out! https://t.co/1PJZkoxK7E

[Yuval Avrahami @yuvalavra]

We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯

How did we do it? Just two missing characters was all it took.

This is the story of #CodeBreach 🧵👇

[Nic Losby @Blurbdust]

The blog with how to use the rainbow tables for Net-NTLMv1 is finally live!
https://t.co/LjN9y6PHXA

My slides from presenting at BRCC are still available if you're curious about how crazy of a three year journey it was to get them created.
https://t.co/NfFotEh7ah

[Ricardo Ruiz @RicardoJoseRF]

I just released SAMDump, a tool that extracts SAM and SYSTEM files via Volume Shadow Copy (VSS) API with optional exfiltration (local save or network transfer) and XOR obfuscation. Plus, it uses NT APIs for file operations https://t.co/9bBRMGko98

[Secorizon @secorizon]

Responder now supports much more LDAP authentications, the LDAP rogue server has been rewritten to support SASL mechanisms.

You'll see a lot of these on your screens :)

[mpgn @mpgn_x64]

New Windows AD Lab "Pirates of the Caribbean" themed lab is live ! 🔥

🔷NTLMv1/RBCD
🔷GMSA & MSSQL Impersonation
🔷Kerberos Delegation
🔷NTDS Forensics

Build on VMware, VirtualBox, or Ludus.

Thanks @mael91620 for the help!

Full treasure here⬇️
https://t.co/CMaLf23P7v

[MatheuZ @MatheuzSecurity]

Singularity rootkit now can bypass SELinux enforcing mode without audit logs on ICMP trigger, conntrack/netlink filtering (conntrack, ss, SOCK_DIAG), UDP hiding + setup script

https://t.co/MKRjVgBROo

#linux #rootkits #malware #evasion #antiforensics

[Alex Neff @al3x_n3ff]

We suggest assigning such vulnerable templates the new ESC number 17 (ESC17) to help identify and mitigate these risks.

You can read our blog post here: https://t.co/oOylKB6Rac

2/2🧵

[Alex Neff @al3x_n3ff]

Using ADCS to Attack HTTPS-Enabled WSUS Clients:

@cookieTheft and I have extended the research by @Coontzy1 on WSUS attacks and explored how to leverage misconfigured ADCS templates to gain code execution on HTTPS-enabled WSUS clients.

1/2🧵

[Alex Neff @al3x_n3ff]

Enumerate DNS zones that allow unauthenticated updates using NetExec🔥

Adding or updating DNS entries without authentication can give attackers a huge advantage.
Thanks to @toffyrak such DNS zones can now be enumerated using NetExec🚀

[Alex Neff @al3x_n3ff]

NetExec now extracts even more secrets from the NTDS.dit🚀

With the new --history and --kerberos-keys flags, NetExec will also dump the password history and the AES/DES keys for Kerberos auth from the NTDS.dit🔑

Implemented by @kriyosthearcane, azoxlpf and me.

[Alex Neff @al3x_n3ff]

Dump DPAPI credentials via WinRM with NetExec🔥

A lot of sensitive data is stored in Windows DPAPI, such as the login credentials used in scheduled tasks.
Thanks to tiagomanunes this is now also possible via WinRM!

[Alex Neff @al3x_n3ff]

Dumping juicy secrets from SAM/LSA is always nice right?
I've added an implementation for the --sam and --lsa flags to the MSSQL protocol of NetExec🚀

No need for manual registry hive extraction anymore!

[RedTeam Pentesting @RedTeamPT]

🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!