Geiseric (@Geiseric4) profile picture

Geiseric

@Geiseric4

AD/Azure Enthusiast | eCPPTv2 | CRTP | CRTO | CRTE | CRTM | CARTP | CARTE https://teapawt.net/t.co/yYy84cNFPw

Joined February 2022
  • Tweets210
  • Following171
  • Followers921
8Media
Photo by Geiseric (@Geiseric4)Photo by Geiseric (@Geiseric4)Photo by Geiseric (@Geiseric4)Photo by Geiseric (@Geiseric4)Photo by Geiseric (@Geiseric4)Photo by Geiseric (@Geiseric4)Photo by Geiseric (@Geiseric4)Photo by Geiseric (@Geiseric4)
Geiseric retweeted
Keanu Nys (@RedByte1337) profile picture
Keanu Nys@RedByte1337Jul 29
Excited to be back as a @defcon mainstage speaker in Vegas for the 2nd year in a row! 🎉 This year I'll reveal new techniques to get Microsoft to deliver any phishing email from official Microsoft addresses. Plus... interactive phishing pages rendered inside email clients!? 😜
Image from Keanu Nys (@RedByte1337)
6
5
22
1,448
📧 GraphSpy 1.5.0 is out now and brings a brand new Outlook Graph module! ✅Read emails in any folder ✅Send HTML-formatted emails directly in GraphSpy ✅Access shared mailboxes ✅Search for sensitive information like passwords 🔗Check out GraphSpy here: github.com/RedByte1337/Graph…
Image from Keanu Nys (@RedByte1337)
Image from Keanu Nys (@RedByte1337)
1
23
1
59
5,017
Microsoft seems to have recently deprecated the legacy account.activedirectory.windowsazure[.]com endpoint, which GraphSpy was using to list and add MFA methods for a user. GraphSpy 1.4.3 now utilizes the mysignins[.]microsoft[.]com API now (which is also a FOCI resource!)
Image from Keanu Nys (@RedByte1337)
Image from Keanu Nys (@RedByte1337)
4
16
1,365
GraphSpy just hit 600 stars on GitHub after releasing version 1.4!✨ This version introduces the new Entra ID module, better loading animations, and JSON syntax highlighting. Check it out here: github.com/RedByte1337/Graph…
Image from Keanu Nys (@RedByte1337)
Image from Keanu Nys (@RedByte1337)
Image from Keanu Nys (@RedByte1337)
3
22
1
64
8,248
Old but gold 🏅 Vintage created by Geiseric will go live on 30 November 2024 at 19:00 UTC. Lantern will be retired! ✔️ Hard ✔️ Windows → Choose your Machine and start #hacking: okt.to/BkgKWo #HackTheBox #HTB #CyberSecurity #NewRelease
Image from Hack The Box (@hackthebox_eu)
8
75
5,554
Time to dive into Active Directory again - Redelegate by @Geiseric4 will be released on Thursday!
Image from Vulnlab (@vulnlab_eu)
1
13
1
65
3,067
Congratulations to @Geiseric4 for clearing our Certified Azure Red Team Professional exam! #AzADLab #CARTP #AlteredSecurity cc @nikhil_mitt teapawt.net/AlteredSecurity/status… alteredsecurity.com/azureadl…
Image from Altered Security (@AlteredSecurity)
1
1
7
729
Ifrit has been solved! Congrats on the first bloods @Geiseric4 @rootjaxk NLTE!
Image from Vulnlab (@vulnlab_eu)
5
30
2,492
Congratulations to @Geiseric4 for the rare distinction of clearing our Certified Red Team Master exam! #GCBLab #CRTM #AlteredSecurity cc @nikhil_mitt alteredsecurity.com/gcb
Global Central Bank (CRTM)

Global Central Bank (CRTM)

CRTM - Certified Red Team master is an expert level hands-on certification on Red Team, Enterprise security and Active Directory security.

alteredsecurity.com
1
2
773
GIUDA betrayed again, how to get a new and fresh TGT (or a TGS - if you settle for little) on behalf of another logged user on a Windows machine. How it works: lnkd.in/dYDxq5nx #redteam #giuda #kerberos thx to MzHmO@github
Image from fortunato lodari (@flodari)
Image from fortunato lodari (@flodari)
7
28
2,003
Geiseric retweeted
Rob (@L3o4j) profile picture
Rob@L3o4j22 Jul 2024
Had fun working on a PoC to execute commands in other users' sessions. This could be automated into a chain of actions potentially leading to full domain compromise. Scroll down to "Thoughts" in the repo :) github.com/Leo4j/SessionExec #Pentesting #ActiveDirectory #CyberSecurity
GitHub - Leo4j/SessionExec: Execute commands in other Sessions

GitHub - Leo4j/SessionExec: Execute commands in other Sessions

Execute commands in other Sessions. Contribute to Leo4j/SessionExec development by creating an account on GitHub.

github.com
34
1
74
6,340
Fyi we restarted from scratch (i.e. latest Fortra’s master branch). We had gotten so « ahead » that new pending PRs were always conflicting. We will need to do that once in a while, since our end goal is not to replace the official repo 🙂‍↔️ Merged 4 PRs tonight
Image from Charlie Bromberg « Shutdown » (@_nwodtuhs)
Charlie Bromberg « Shutdown » (@_nwodtuhs) profile pictureCharlie Bromberg « Shutdown »@_nwodtuhs30 May 2024
And welcome to @Geiseric4 who's now a maintainer on it 🚀
8
1
24
7,350
Next up is an Active Directory Chain by @Geiseric4! Definitely worth diving into if you're up for a challenge!
Image from Vulnlab (@vulnlab_eu)
15
73
4,462
I found a new #lolbin for zipping and unzipping arbitrary files with UNC path support using #PrintBrm.exe available in Windows Vista/2008 and higher. First lolbin capable of creating and extracting ZIP files to my knowledge! #lolbas #infosec #cybersecurity #redteam
Proof of Concept (PoC)

ALT Proof of Concept (PoC)

2
89
218
🗣️ "I would like to speak to your manager" A new #HTB Seasons Machine is coming up! Manager created by Geiseric will go live on 21 October 2023 at 19:00 UTC. Jupiter will be retired! ✓ Medium ✓ Windows → Join the competition & start #hacking: hackthebox.com/hacker/season…
Image from Hack The Box (@hackthebox_eu)
2
6
65
11,455
Geiseric retweeted
Vulnlab (@vulnlab_eu) profile picture
Vulnlab@vulnlab_eu2 Oct 2023
Delegate by @Geiseric4 is coming to Vulnlab this week! Expect some quality AD content 🔥
Image from Vulnlab (@vulnlab_eu)
3
19
96
7,411
Geiseric retweeted
mpgn (@mpgn_x64) profile picture
mpgn@mpgn_x6417 Aug 2023
A new module just landed on CrackMapExec called WCC by @__fpr 🚀 This module checks various configuration items on Windows machines, such as LSA cache, hash storage format, etc 🤿 You can also export the results for your pentest report ✍ Available on github.com/mpgn/CrackMapExec
Image from mpgn (@mpgn_x64)
Image from mpgn (@mpgn_x64)
6
81
2
334
26,438
AD Privesc Kerberos TGS and SeTcbPrivilege If you have SeTcbPrivilege, you can ask TGS on behalf of ALL logged users on your machine WITHOUT Password ...and if there is a Domain Admin logged? Zero detection by EDR/AV github.com/foxlox/GIUDA.git #redteam #SeTcbPrivilege
Image from fortunato lodari (@flodari)
Image from fortunato lodari (@flodari)
Image from fortunato lodari (@flodari)
4
247
2
591
67,913
From Local Admin to Domain Admin If you're a local admin and want to duplicate someone's Token and run a command for them, write everything in Delphi. I've tested the code with most of the AV/EDRs. Please give me feedback. github.com/foxlox/hypobrychi… #redteam #DuplicateTokenEx
Image from fortunato lodari (@flodari)
Image from fortunato lodari (@flodari)
5
65
202
20,006
Dropped a new tool for enumeration on AAD joined devices. It's written in Nim cause that's what the cool kids are writing these days. Also, if you use Sliver, it's now an extension in the Armory. github.com/daddycocoaman/AzB…
GitHub - daddycocoaman/azbelt: AAD related enumeration in Nim

GitHub - daddycocoaman/azbelt: AAD related enumeration in Nim

AAD related enumeration in Nim. Contribute to daddycocoaman/azbelt development by creating an account on GitHub.

github.com
7
54
1
168
24,519
Load more