account inactive, goto mastodon if you want to follow me
Munich
Joined July 2014
- Tweets5.1K
- Following574
- Followers971
- Likes3.3K
Pinned Tweet
NFS has not received much attention of the offensive security community in nearly a decade. Today, we are happy to share our research on the topic: hvs-consulting.de/en/nfs-sec…. I'll give you a short overview in this thread 🧵 (1/5) #redteam #pentest
@[email protected] (inactive) retweeted
Took me two grok requests to return to default (or at least something that looks like it)
See you over in the sane part of the internet!
@[email protected] (inactive) retweeted
Anyone know if Microsoft silently patch the Shadow Creds attack recently ? Looks like a computer object cannot write its own attribute anymore :D
@[email protected] (inactive) retweeted
Net-NTLMv1 is outdated, insecure, and must go. 🛑
To help defenders prove the risk and accelerate deprecation, we’ve released a comprehensive dataset of rainbow tables. See how easily these keys can be recovered, and secure your environment.
Read more: bit.ly/4qpV6MJ
ALT Disable Use of Net-NTLMv1 Protocol
@[email protected] (inactive) retweeted
NetExec v1.5.0 is now available on kali!
Go ahead and apt update && apt upgrade your system to get all the new features🚀
ALT NetExec v1.5.0 is now available on Kali
NetExec v1.5.0 has been released!🔥
Merry Christmas everyone!🎉 It's been a very long time since the last release, so there are a TON of new features!
Some of the highlights:
- Built-in LDAP signing and channel binding checks
- RDP command execution
- certipy find integration
ALT NetExec v1.5.0 has been released!🔥
@[email protected] (inactive) retweeted
SCCM attack paths are messy until you can see them. 👀
ConfigManBearPig from @_Mayyhem extends BloodHound with SCCM nodes + edges using OpenGraph, plus queries to surface hierarchy takeovers and escalation paths.
Check it out! ghst.ly/4svbcWO
@[email protected] (inactive) retweeted
We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯
How did we do it? Just two missing characters was all it took.
This is the story of #CodeBreach 🧵👇
@[email protected] (inactive) retweeted
The blog with how to use the rainbow tables for Net-NTLMv1 is finally live!
cloud.google.com/blog/topics…
My slides from presenting at BRCC are still available if you're curious about how crazy of a three year journey it was to get them created.
content.burningrivercybercon…
@[email protected] (inactive) retweeted
I just released SAMDump, a tool that extracts SAM and SYSTEM files via Volume Shadow Copy (VSS) API with optional exfiltration (local save or network transfer) and XOR obfuscation. Plus, it uses NT APIs for file operations github.com/ricardojoserf/SAM…
@[email protected] (inactive) retweeted
Responder now supports much more LDAP authentications, the LDAP rogue server has been rewritten to support SASL mechanisms.
You'll see a lot of these on your screens :)
@[email protected] (inactive) retweeted
New Windows AD Lab "Pirates of the Caribbean" themed lab is live ! 🔥
🔷NTLMv1/RBCD
🔷GMSA & MSSQL Impersonation
🔷Kerberos Delegation
🔷NTDS Forensics
Build on VMware, VirtualBox, or Ludus.
Thanks @mael91620 for the help!
Full treasure here⬇️
github.com/Pennyw0rth/NetExe…
@[email protected] (inactive) retweeted
Singularity rootkit now can bypass SELinux enforcing mode without audit logs on ICMP trigger, conntrack/netlink filtering (conntrack, ss, SOCK_DIAG), UDP hiding + setup script
github.com/MatheuZSecurity/S…
#linux #rootkits #malware #evasion #antiforensics
@[email protected] (inactive) retweeted
We suggest assigning such vulnerable templates the new ESC number 17 (ESC17) to help identify and mitigate these risks.
You can read our blog post here: blog.digitrace.de/2026/01/us…
2/2🧵
@[email protected] (inactive) retweeted
Using ADCS to Attack HTTPS-Enabled WSUS Clients:
@cookieTheft and I have extended the research by @Coontzy1 on WSUS attacks and explored how to leverage misconfigured ADCS templates to gain code execution on HTTPS-enabled WSUS clients.
1/2🧵
ALT So WSUS with HTTPS is secure u said?
@[email protected] (inactive) retweeted
Enumerate DNS zones that allow unauthenticated updates using NetExec🔥
Adding or updating DNS entries without authentication can give attackers a huge advantage.
Thanks to @toffyrak such DNS zones can now be enumerated using NetExec🚀
ALT Enumerate and update DNS zones that allow unauthenticated updates using NetExec.
@[email protected] (inactive) retweeted
NetExec now extracts even more secrets from the NTDS.dit🚀
With the new --history and --kerberos-keys flags, NetExec will also dump the password history and the AES/DES keys for Kerberos auth from the NTDS.dit🔑
Implemented by @kriyosthearcane, azoxlpf and me.
ALT Dumping password history and Kerberos keys from NTDS.dit with NetExec
@[email protected] (inactive) retweeted
Dump DPAPI credentials via WinRM with NetExec🔥
A lot of sensitive data is stored in Windows DPAPI, such as the login credentials used in scheduled tasks.
Thanks to tiagomanunes this is now also possible via WinRM!
ALT Dump DPAPI credentials via WinRM with NetExec
@[email protected] (inactive) retweeted
Dumping juicy secrets from SAM/LSA is always nice right?
I've added an implementation for the --sam and --lsa flags to the MSSQL protocol of NetExec🚀
No need for manual registry hive extraction anymore!
ALT Dumping SAM/LSA secrets via the MSSQL protocol with NetExec.
@[email protected] (inactive) retweeted
🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!