Garrett

Research at @SpecterOps

[SkelSec @SkelSec]

And so I wake in the morning and I step outside
And I take a deep breath and I get real high
And I scream from the top of my lungs

[Garrett @unsigned_sh0rt]

@TruthIsDead22 unforgivable

[Garrett @unsigned_sh0rt]

Hard lesson I relearned today is to be careful who you share your ideas with

[Garrett @unsigned_sh0rt]

@techspence auth silos would be cool to see used but never once seen it

[Garrett @unsigned_sh0rt]

@cyber_pannonius @SpecterOps now that is cool

[Garrett @unsigned_sh0rt]

Quick blog on how iSCSI initiators/targets work in AD domains. If you can guess the right IQN you've got access to the disk. Haven't done the attack in prod but see the SPN shared with things like Hyper-V, Failover Clusters, and DFS.

[SpecterOps @SpecterOps]

Without CHAP authentication, attackers can impersonate an authorized iSCSI initiator and access shared virtual disks, bypassing NTFS permissions.

@unsigned_sh0rt shows how the attack path works and what defenders can do: https://t.co/oVlRuhxrsu

[Garrett @unsigned_sh0rt]

@infosecnoodle @Defte_ @chryzsh guess my POC was just busted, nice work

[Garrett @unsigned_sh0rt]

@chryzsh @infosecnoodle wait you shared what I trusted you with?

[Garrett @unsigned_sh0rt]

@Defte_ yeah check the PR comments

[Garrett @unsigned_sh0rt]

@Defte_ 26H2?

[Garrett @unsigned_sh0rt]

@infosecnoodle yup, thats my experience i know with the printer hardening features in newer workstation versions IPP goes away

[Garrett @unsigned_sh0rt]

@infosecnoodle nah had something internal that does the same thing your BOF does....did testing on server versions and found it didn't work

[Garrett @unsigned_sh0rt]

@infosecnoodle huh no shit it works still

[Garrett @unsigned_sh0rt]

@infosecnoodle huh i thought this was patched

[Garrett @unsigned_sh0rt]

@_EthicalChaos_ @karollooool @msftsecresponse Absolutely wild to me. I know they're getting swarmed with reports but not a single human response since July is pretty unacceptable.

[Garrett @unsigned_sh0rt]

MSRC silently patching bugs I disclosed. Neat.

[Matt Nelson @enigma0x3]

It would be really awesome if @msftsecresponse did a blog on what the workflow for a report looks like. What does each stage in the portal mean? When does the product team get involved? Who validates the issue? MSRC? Product? Both?

Transparency in the process would build a lot of trust and understanding.

[Garrett @unsigned_sh0rt]

@karollooool that's insane wtf

[Garrett @unsigned_sh0rt]

@syndrowm man I hope it is

[Garrett @unsigned_sh0rt]

@_logangoins LOL you broke it out