ret2src

Breaker of Stuff | Injector of 0x41 | Discoverer of Dumb Things | Creator of Glitches. Dropping shells since 0x7DC.

[Logan D @relay_royalty]

Introducing RelayKing.

https://t.co/D55uuCv6mX

Blog: https://t.co/usrPECsVno

Automatically identify relay attack paths. No longer will you be left to manually detect a comprehensive inventory of all the relaying vectors on your engagements.

It will detect signing/EPA settings on all protocols you specify, NTLM reflection CVEs, and WebDav WebClient presence. Then, produce a comprehensive report of the relaying vectors on the network in your preferred output format. This ensures that you report ALL vulnerable instances easily, without the need for manual patching together of results from various tools.

Ideal usage is with a set of low-privilege AD credentials, but it also supports unauthenticated scanning (with far less coverage). See GitHub and the blog post for more details.

Please note that there ARE bugs. The LDAP(S) detection has been annoying but SHOULD be mostly solid. If you get suspicious results from it, please report an issue on GitHub with the config RelayKing reported, versus the actual one.

Enjoy!

[ret2src @ret2src]

@Defte_ Patched version available from archpkgs (https://t.co/UloM6qialo) by @0x64616e tomorrow (as soon as the nightly build ran).

[Aurélien Chalot @Defte_]

Self shadow cred is back again 🔥🔥🔥🔥🔥🔥🔥🔥🥳

[Steffen Buck @buck_steffen]

@Defte_ Update:
Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements:
https://t.co/g42CHDxQdB
Now Shadow Creds are working again 😀

[𝅙 @joaovarelas]

@ShitSecure Another way is to look for snapshots of a target VM and get the memory .vmem file. After converting the memory dump it should open in WinDbg and extract some secrets with Mimikatz extension.

[ret2src @ret2src]

Welcome to the EU, where the lunatics in Brussels take everything from us. While it was narrowly prevented this time, the next act of pure fascism disguised as safety will come. 1984 in all its glory.

[Jack Rhysider 🏴‍☠️ @JackRhysider]

EU's Chat Control proposal is to effectively ban end to end encryption since it demands that governments can read all msgs.
I find this to be not only insane, but feasibly impossible. Breaking the whole internet. Yet it got voted on last week, and just narrowly stopped. Whew!

[ret2src @ret2src]

@VNchocoTaco When have the insides of Apple products become so ugly? Looks like a cheap Android phone, some parts don’t even seem to be straight. Is this the company so obsessed about details and perfection?

[Daniel @0x64616e]

My colleague Mathias and I just finished our talk about "Relaying Unprivileged Users to RCE" at @MCTTP_Con. You can find our slides at https://t.co/gzc76uLjsI

[Smukx.E @5mukx]

Active Directory Pentest Mindmap v2025.03

Full view and updated map : https://t.co/nR3pp4ssfa

[ret2src @ret2src]

@nickvangilder @eliedelkind Funny, all of them are basically saying the same thing…what a coincidence

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[ret2src @ret2src]

Better watch out for the TCP, I’ve seen it being abused by those pesky hackers over and over again!

[Dylan @InsecureNature]

Hackers reportedly used something called "TruffleHog" during their attack. They also used "child_process", and something called HTTP, something called TLS, and something called TCP.

Please be on the lookout for any of these hacking tools being used in your environment.

[J⩜⃝mie Williams @jamieantisocial]

no matter how hard you cyber, there will ~ALWAYS~ be another registry persistence you've never heard of.

[ret2src @ret2src]

@techspence @Abdulmalik_TTG Will you still be reporting ESC1, even without a PoC? In our reports, we use a special tag called “inconclusive” for such cases.

[Andy Gill @ZephrFish]

Here's an initial release of a LDAP browser written in python with a nice GUI and some integrations with #BloodHound

https://t.co/5GwpLXz0x3

[Two Seven One Three @TwoSevenOneT]

#redteam
Now, you can dump the #Windows password from the LSASS process with help from the past: WerFaultSecure.exe
Github: 2x7EQ13/WSASS
Experimental version: Windows 11 24H2
#Blueteam

[rekdt @rekdt]

So embarrassing

[blasty @bl4sty]

the jump scare of the morning award goes to @J0R1AN (it even adapts to different native calculators using UA-based OS detection :))

[ret2src @ret2src]

@vysecurity LinkedIn is a huge cesspool of ass kissers. Can’t stand more than three of the BS posts on there before I feel a strong urge to close the app again.

[Chris Power @typecraft_dev]

The memes are on point today