Hocine retweeted
Happy to share a technical analysis by @h0j3n on our recent CVE-2026-54121 a.k.a Certighost. glhf🔥
Technical analysis: gist.github.com/H0j3n/a5ef26…
POC: github.com/aniqfakhrul/CVE-2…
Hocine retweeted
Onelogon: Taking over Active Directory Accounts via Netlogon🔑
We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵
ALT Compromise an Active Directory Domain with the Onelogon vulnerability
ALT Scanning an AD domain for accounts vulnerable to Onelogon
Hocine retweeted
Kubernetes assessments just got easier.
@RonJonArod dropped two new Mythic extensions for helping with initial access on container-centric red team ops:
➡️ Wrap payloads in OCI images
➡️ Host them in a self-managed registry
➡️ Deploy via K8s manifest
ghst.ly/4uoCWMs
Hocine retweeted
Forgot to post it, but the recording of my Black Hat talk was released last week. If you're interested in all the hybrid AD attack surface you never knew about, give it a watch: youtu.be/rzfAutv6sB8?si=RqOK…
Hocine retweeted
ADCSDevilCOM 📍
A C# tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses the traditional endpoint mapper requirement by using SMB directly.
By: @AnonArtist8
github.com/7hePr0fess0r/ADCS…
Hocine retweeted
Credential Guard was supposed to end credential dumping. It didn't.
@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more ⤵️ ghst.ly/4qtl2rm
Hocine retweeted
Come to see how we discovered and analyzed CVE-2025-33073 with my colleague @yaumn_ at Hexacon today !
📢 NTLM reflection is dead, long live NTLM reflection: Story of an accidental Windows RCE by Wil (@wil_fri3d)
Hocine retweeted
I wanted to find out if you could start the WebClient service remotely, so I ended up digging into it specterops.io/blog/2025/08/1…
Hocine retweeted
hashcat v7.0.0 released!
After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had.
Detailed writeup is available here: hashcat.net/forum/thread-133…
Hocine retweeted
Yet another bloodhound ingestor for Linux based system and using ADWS as the main interface.
Built with @Sant0rryu , meet github.com/j4s0nmo0n/Soaphou….
You may check out the short blog post for more details.
j4s0nmo0n.github.io/belettet…
Hocine retweeted
🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷♂️
Read Here - akamai.com/blog/security-res…
Hocine retweeted
I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…
Hocine retweeted
You have got a valid NTLM relay but SMB and LDAP are signed, LDAPS has got Channel Binding and ESC8 is not available... What about WinRMS ? :D
Blogpost: sensepost.com/blog/2025/is-t…
Tool: github.com/fortra/impacket/p…
And also, big thanks to jmk (Joe Mondloch) for the collab' :D!
Hocine retweeted
Stumbled on ServiceNow during a red team? If not you might want to check our latest post on Red Teaming with ServiceNow by @__invictus_ mdsec.co.uk/2025/03/red-team…
Hocine retweeted
Loki C2 blog drop! Thank you for all those who helped and all the support from the community. Big shoutout to @d_tranman and @chompie1337 for all their contributions to Loki C2! @IBM @IBMSecurity @XForce
securityintelligence.com/x-f…
Hocine retweeted
Attacks against AD CS are de rigueur these days, but sometimes a working attack doesn’t work somewhere else, and the inscrutable error messages are no help. Jacques replicated the most infuriating and explains what’s happening under the hood in this post sensepost.com/blog/2025/divi…
ALT A screenshot of an AD CS ESC1 attack using Certipy getting a KDC_ERR_INCONSISTENT_KEY_PURPOSE error.
Hocine retweeted
New Active Directory Mindmap v2025.03! 🚀
📖 Readable version: orange-cyberdefense.github.i…
🔧 Now fully generated from markdown files—way easier to update and maintain!
💡 Got improvements? PRs welcome! 👉 github.com/Orange-Cyberdefen…
Hocine retweeted
Bypass AMSI in 2025, my newest blog post is published 🥳! A review on what changed over the last years and what's still efficient today.
en.r-tec.net/r-tec-blog-bypa…
Hocine retweeted
In our latest article, @croco_byte and @SScaum demonstrate a trick allowing to make Windows SMB clients fall back to WebDav HTTP authentication, enhancing the NTLM and Kerberos relaying capabilities of multicast poisoning attacks!
synacktiv.com/publications/t…
