Introducing RelayKing.
https://t.co/D55uuCv6mX
Blog: https://t.co/usrPECsVno
Automatically identify relay attack paths. No longer will you be left to manually detect a comprehensive inventory of all the relaying vectors on your engagements.
It will detect signing/EPA settings on all protocols you specify, NTLM reflection CVEs, and WebDav WebClient presence. Then, produce a comprehensive report of the relaying vectors on the network in your preferred output format. This ensures that you report ALL vulnerable instances easily, without the need for manual patching together of results from various tools.
Ideal usage is with a set of low-privilege AD credentials, but it also supports unauthenticated scanning (with far less coverage). See GitHub and the blog post for more details.
Please note that there ARE bugs. The LDAP(S) detection has been annoying but SHOULD be mostly solid. If you get suspicious results from it, please report an issue on GitHub with the config RelayKing reported, versus the actual one.
Enjoy!
@Defte_ Update:
Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements:
https://t.co/g42CHDxQdB
Now Shadow Creds are working again 😀
@ShitSecure Another way is to look for snapshots of a target VM and get the memory .vmem file. After converting the memory dump it should open in WinDbg and extract some secrets with Mimikatz extension.
Welcome to the EU, where the lunatics in Brussels take everything from us. While it was narrowly prevented this time, the next act of pure fascism disguised as safety will come. 1984 in all its glory.
EU's Chat Control proposal is to effectively ban end to end encryption since it demands that governments can read all msgs.
I find this to be not only insane, but feasibly impossible. Breaking the whole internet. Yet it got voted on last week, and just narrowly stopped. Whew!
@VNchocoTaco When have the insides of Apple products become so ugly? Looks like a cheap Android phone, some parts don’t even seem to be straight. Is this the company so obsessed about details and perfection?
My colleague Mathias and I just finished our talk about "Relaying Unprivileged Users to RCE" at @MCTTP_Con. You can find our slides at https://t.co/gzc76uLjsI
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3
Hackers reportedly used something called "TruffleHog" during their attack. They also used "child_process", and something called HTTP, something called TLS, and something called TCP.
Please be on the lookout for any of these hacking tools being used in your environment.
@techspence@Abdulmalik_TTG Will you still be reporting ESC1, even without a PoC? In our reports, we use a special tag called “inconclusive” for such cases.
#redteam
Now, you can dump the #Windows password from the LSASS process with help from the past: WerFaultSecure.exe
Github: 2x7EQ13/WSASS
Experimental version: Windows 11 24H2
#Blueteam
@vysecurity LinkedIn is a huge cesspool of ass kissers. Can’t stand more than three of the BS posts on there before I feel a strong urge to close the app again.