RedTeam Pentesting

Official RedTeam Pentesting GmbH account --
Impressum:

[RedTeam Pentesting @RedTeamPT]

Wir haben eine Mission: Werde eine*r von uns! 👩‍🚀👨‍🚀

Finde gemeinsam mit uns die Schwachstellen von morgen 🔑 und manchmal auch welche aus längst vergangener Zeit 🗝️

Mehr erfahrt ihr unter https://t.co/Ex83ovEFxQ 🚀

#infosec #cybersecurity #aachen #hiring #ITJobs #Pentesting

[RedTeam Pentesting @RedTeamPT]

@0x6d7572706869 We actually implemented the raw DCERPC interface in 2024 in NetExec ourselves: https://t.co/0gpfcVY21z Its the same methods as before, just over a new interface: PetitPotam used DCERPC over named pipes (ncacn_np), this is raw DCERPC (ncacn_ip_tcp).

[RedTeam Pentesting @RedTeamPT]

🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!

Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀

[RedTeam Pentesting @RedTeamPT]

@0x6d7572706869 This is outdated, it was changed sometime in 2025 that it only uses raw RPC for outgoing connections.

https://t.co/jQ8AUP8GV8

[RedTeam Pentesting @RedTeamPT]

@lowercase_drm We dont know for sure, but sbuck1 suspects CVE-2026-102217: https://t.co/e7j7YegHoT https://t.co/NuD6fm2N3O

[RedTeam Pentesting @RedTeamPT]

More information: https://t.co/hrh1MBqM3K

[RedTeam Pentesting @RedTeamPT]

📢Our CEO Patrick Hof joined a panel discussion at the AHK debelux event "Building Resilience in Cybersecurity" on Oct. 13th 2026.

His takeaway: Regulation alone does not ensure security: systems must be tested in practice and vulnerabilities actively sought out.

[RedTeam Pentesting @RedTeamPT]

🚨 Rocket Remote Desktop encrypts users' saved credentials with their Windows SIDs. Every user with access to a Windows client on which the client software is installed has access to the database, where these credentials are saved. No fix available yet.

https://t.co/gv18e1dIFv

[RedTeam Pentesting @RedTeamPT]

@buck_steffen @0xFunnybananas @Defte_ Before the patch SELF also only had DS-Validated-Write-Computer permissions for msDS-KeyCredentialLink. That was the reason why you could not have more than one KeyCredentialLink per computer account. Only the validation check changed with the update.

[RedTeam Pentesting @RedTeamPT]

This is kind of funny because CustomKeyInformation is actually forbidden for validated writes according to Microsoft's specs 🤡
https://t.co/q2iyPW1Q3O

[RedTeam Pentesting @RedTeamPT]

🚀Our tool keycred for KeyCredentialLinks and Shadow Credential attacks now works with updated domain controllers again!

It turns out, Microsoft violated their own specs.

Try it out: https://t.co/OtBYIGVxGn

[Aurélien Chalot @Defte_]

Anyone know if Microsoft silently patch the Shadow Creds attack recently ? Looks like a computer object cannot write its own attribute anymore :D

[RedTeam Pentesting @RedTeamPT]

Originally, Microsoft did not enforce their own specs for validated writes at all and only checked if a KeyCredentialLink is already present. Now they require a CustomKeyInformation field with the "MFA Not Required" flag to be present and the last logon timestamp to be absent.

[RedTeam Pentesting @RedTeamPT]

🚨Nextcloud was vulnerable to XSS in PDF.js (CVE-2024-4367) found by @thomasrinsma at @CodeanIO.

Although Nextcloud mitigated the vulnerability in their portal by disabling eval, the viewer.html component of the vulnerable PDF.js was still exposed.

https://t.co/hxymSA4Ou6

[RedTeam Pentesting @RedTeamPT]

🎄Care for some Glühwein and flags? The Haix-la-Chapelle CTF 2025 starts tomorrow! 🍷
https://t.co/6GteF4kFCt

[RedTeam Pentesting @RedTeamPT]

@aegixe_team @RHEL @AlmaLinux @rocky_linux Actually, we're talking about 6 CVEs . The patches were published in March and are really simple - mostly clean 1-line diffs like this:

https://t.co/8bxz2SQC1g

The easiest way would be for upstream maintainers to just apply these patches and be done with it 😮‍💨

[RedTeam Pentesting @RedTeamPT]

🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!

[RedTeam Pentesting @RedTeamPT]

You can find the CTFTime event at https://t.co/UY5qXNoF9q

[RedTeam Pentesting @RedTeamPT]

🔥Only 10 days left until the Haix-la-Chapelle 2025 CTF is starting on November 29!

We're sponsoring the prize money for the best writeups and are excited to see your creative solutions.

https://t.co/m1IXybaV2A

[RedTeam Pentesting @RedTeamPT]

@RedHatSecurity How can we get these Ghostscript RCEs (CVE-2025-27835 and others) that have been public for 8 months fixed in RHEL?
We received no response on Bugzilla.

https://t.co/NM879Rbn38

[RedTeam Pentesting @RedTeamPT]

🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!

[RedTeam Pentesting @RedTeamPT]

Disclaimer: We did not discover this vulnerability (credits go to zhutyra🎉), we're just wondering why we can still exploit these vulnerabilities in pentests on patched systems 🤷

We received no response on the @RHEL bug tracker:
https://t.co/sxthqTMiyl

[RedTeam Pentesting @RedTeamPT]

This is neither the first, nor the second time that we can't get distros to apply upstream fixes for publicly disclosed RCEs with POCs available in Ghostscript.

https://t.co/TIgnR0fYRL

[RedTeam Pentesting @RedTeamPT]

🚨 Another month, another critical Ghostscript RCE, with patches rolling out rather slowly to some distros again 👻😱 #infosec #DeprecateUntrustedPostscript