Sylvain Heiniger

[Compass Security @compasssecurity]

Ups and downs of #redteam engagements. When the standard payloads don’t cut it, innovation wins. Learn how we misused a screenshot tool to load shellcode… at the fifth attempt!…
https://t.co/3HF3OoWGCk

[Eliran Nissan @eliran_nissan]

I am excited to share with you my latest research - "DCOM Upload & Execute"
An advanced lateral movement technique to upload and execute custom payloads on remote targets
Forget about PSEXEC and dive in!
https://t.co/ruQJlXgLqV
https://t.co/Yp25P6pZvH

[Synacktiv @Synacktiv]

Oh, you didn't know? Cool kids are now relaying Kerberos over SMB 😏
Check out our latest blogpost by @hugow_vincent to discover how to perform this attack:
https://t.co/4Drnk4BoBz

[Sylvain Heiniger @sploutchy]

You can also find me there:
https://t.co/FfB3viKUXW

[Compass Security @compasssecurity]

COM is old but gold—for attackers! 🚨 In our latest blog, Sylvain Heiniger (@sploutchy) exposes a privilege escalation vulnerability in the Google Chrome updater. Want to know how cross-session EoP still happens today? Check it out! #COM

https://t.co/zu6vphlXG0

[Sylvain Heiniger @sploutchy]

@stratosberry @compasssecurity @decoder_it @D1iv3 Hey @stratosberry, default AD settings allow users to create new machine accounts (https://t.co/UEFhhqJbDL).
In hardened environments, you need privileges to modify a computer object (e.g. https://t.co/C5pct6jMmv).
Hope this helps!

[Sylvain Heiniger @sploutchy]

@decoder_it @compasssecurity @D1iv3 @tiraniddo This is the cherry on the top ;) Then one doesn't need to implement the whole OXID resolving. Thanks for your great research!

[Compass Security @compasssecurity]

DCOM cross-session coercion + Kerberos = 💣 We took a closer look at the attacks discovered by @decoder_it and @D1iv3 earlier this year and made a PoC in Python! Curious? Full blog post here: https://t.co/MUrrVqdBnW
#potato #impacket

[Sylvain Heiniger @sploutchy]

@Jonas_B_K Great blog post, thanks for sharing! I made a PR in certipy (@ly4k_) for checking ESC13: https://t.co/Ej6TiNfzPb

[Compass Security @compasssecurity]

You like device code phishing? You will like Felix Aeppli’s latest research even more. He shows how to backdoor Entra ID phished accounts by adding a new sign-in method. Details and PoC here: https://t.co/u2jVl2v12S

[TrendAI Zero Day Initiative @thezdi]

Collision – Compass Security was able to execute their stack overflow attack against the Synology BC500. However, the exploit they used was previously known. They still earn $3,750 and 0.75 Master of Pwn points. #Pwn2Own

[Louis Dion-Marcil @ldionmarcil]

Outlook for Windows can be tricked into displaying a fake domain, but open another one. Add a <base> tag with a fake domain + left-to-right mark (U+200E)
Links in <a> tags will show the fake domain, but open the real domain.
No need to buy .zip! :) Convincing #phishing #redteam

[Sylvain Heiniger @sploutchy]

@0xdeaddood Self-plug: https://t.co/yU3TjUJmzF
adds relay to ADCS over RPC to ntlmrelayx

[Andrea P @decoder_it]

We did it again with #LocalPotato!
A not-so-common NTLM reflection attack allowing for arbitrary read/write. Basically EoP from user to SYSTEM.
Tracked as #CVE-2023-21746 - Windows NTLM EoP
Soon more details --> https://t.co/Skyn0xdxNN
cc @splinter_code

[Martin Gallo 🇦🇷 💚✊🏾🚀 @MartinGalloAr]

🆕More personal news here ..

I want to share that the Impacket project is moving to @fortraofficial's @CoreSecurity!

It will now be part of their open source portfolio, and funded with a team of very talented security professionals.

https://t.co/dcfBKv1AFo

#impacket

[BlackAlps @BlackAlpsConf]

Recordings of #blackalps22 are available here: https://t.co/cM6oe6bUUL

[Rémi GASCOU (Podalirius) @podalirius_]

Next week I will present a #talk at #BlackHat Europe 2022 on how to automate the search of RPC functions allowing to coerce authentications on #Windows.

Alongside this talk, I'm publishing a brand new version of #Coercer!

➡️Check it out here: https://t.co/6aVELSPCDa

[S3cur3Th1sSh1t @ShitSecure]

Found an vhdx/vmdk/vhd file in a network share? Volumiser from @_EthicalChaos_ gets you covered to exfiltrate e.G. SAM/SYSTEM to compromise the system via Administrator Pass-The-Hash:

https://t.co/OMiWBOVaS8

Really easy and intuitive to use 👏

[Ramón José @pomaretar]

Si tu as aidé une dame à vélo aujourd'hui devant un tram à Genève, peut-être tu as perdu cet airpod qui est tombé par terre. #airpod #28.11.2022 #geneve #geneva https://t.co/ewTvyrRI8C

[Compass Security @compasssecurity]

At @BlackAlpsConf, our analyst Sylvain Heiniger @sploutchy presented a new attack path to AD CS. Read his blog post for details and tools updates. #adcs #esc11 #ntlmrelay #rpc #msrpc

https://t.co/UiRDilU9TS