Are you (like me) constantly running into your own Responder? The days are finally over!🚀 Deft and I finally finished up a PR by bdrogja that let's you define exclusions such as "yourself". You can also exclude entire ranges or IPv6 addresses (if anyone uses those lol).

Did anyone say Shadow Credentials?🔑 A very common alternative to RBCD is to add a certificate to a computer account. However, inspecting or removing them later on was not possible with NetExec so far. Heavily inspired by pyWhisker, I wrote a module to interact with these Shadow Credentials.

A new module just got merged into NetExec: rclone🔥 Rclone is a popular tool for connecting and synchronizing data to cloud services. Credentials stored with Rclone are often enough not encrypted. Thanks to crosscutsaw we can now dump these creds with NetExec🚀

Detect the Certighost with NetExec🔥 Thanks to Xed_sama, the enum_cve module of NetExec will now detect if a host has not been patched and is potentially vulnerable to the Certighost vulnerability (CVE-2026-54121)🚀

Onelogon: Taking over Active Directory Accounts via Netlogon🔑 We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵

SPN-less RBCD with NetExec🔥 While classic RBCD requires a computer account, you can use User-to-User (U2U) authentication to perform RBCD with a normal user account, if a computer account is not available. Thanks to azoxlpf, you can now perform this attack with NetExec as well🚀

SMB share enumeration via ACLs with NetExec🔥 NetExec now detects share permissions via ACL enumeration, instead of trying to write a file. In addition, we can now detect if a user has indirect access to the share, e.g. by having ACL write permissions! Made by @PytelJack🚀

Small QOL update for NetExec: Ctrl+C will now immediately exit NetExec without any weird stack traces🚀 However, keep in mind that this still does not exit gracefully, but immediately kills all existing threads. Only do so if necessary. Made by T1erno

Targeted Keberoasting with NetExec🔥 If you have Write privileges over a user, you can temporarily add an SPN to your target user, request the service ticket, and then remove the SPN. Voilà: a crackable hash without interfering with potentially critical users. Made by azoxlpf🚀

@cookietheft.ioc.exchange.ap.brid.gy and I have been accepted to speak at Troopers this year🎉 Hope you all are eager to learn a thing or two about ADCS and ESC17. See you there!

Modifying group membership with NetExec🛠️ A classic situation: You have obtained a privileged user and want to add yourself to one of their groups, e.g. the Domain Admins. With NetExec's new modify-group module you can do that now via both SMB and LDAP. Made by termanix.

A new module just got merged into NetExec: get-scriptpath📜 This module queries all users for the scriptpath attribute. If you have write privileges over one of these scripts (or they e.g. try to mount a network share) you can easily compromise these users on their next login. Made by 0xwyndo.

Crawling MSSQL databases with NetExec: mssql_dumper💾 The new mssql_dumper module, created by LTJAXSON, enables you to crawl MSSQL databases for a predefined set of keywords, including classic credential phrases, or to search using your own regular expression/keyword list.

New NetExec module: mssql_cbt🔥 Relaying to MSSQL can be a hidden gem when you are out of (relaying) options. The only protection against relaying to MSSQL is to enforce Channel Binding Tokens (CBT). Thanks to Defte, NetExec now has a module that checks whether this CBT is required.

Netexec has some really nice NFS capabilities. I found a some weird behavior in one of them, which turned out to be a bug that just got patched. Let's walk through it.

Finding and Fixing a Bug in Netexec NFS

Netexec has some awesome NFS capabilities. While playing Slonik from VulnLab / HackTheBox, I found an issue I couldn't understand. I'll walk through how Nete...

youtube.com

Collecting ADCS data with NetExec🔥 Thanks to the addition of CertiHound, developed and implemented by 0x0Trace, we can now collect ADCS data using the --bloodhound collector of NetExec. As before, the data is exported as JSON files that can be imported directly into BloodHound for further analysis.

Releasing one of my research tools: EVENmonitor🖥️ Inspired by LDAPmonitor, I implemented a monitoring tool for the Windows Event log in pure python. You can just attach it via the network and then filter for specific event IDs or keywords. Available at: github.com/NeffIsBack/E...

Using ADCS to Attack HTTPS-Enabled WSUS Clients: @cookietheft.ioc.exchange.ap.brid.gy and I have extended the research by @Coontzy1 on WSUS attacks and explored how to leverage misconfigured ADCS templates to gain code execution on HTTPS-enabled WSUS clients. 1/2🧵

Yep. Pretty much 😂

NetExec v1.4.0 has been released! 🎉 There is a HUGE number of new features and improvements, including: - backup_operator: Automatic priv esc for backup operators - Certificate authentication - NFS escape to root file system And much more! Full rundown available at: github.com/Pennyw0rth/N...

Happy #BloodHoundBasics day to all who celebrate! Easily RETURN computers, users, and certificate templates created in the last X days where X can match anything you want. In this case we are looking for objects created in the last 365 days. 🧵: 1/3

This looks off to you? Yeah... In the default configuration, NFS exposes THE ENTIRE FILE SYSTEM and not only the exported directory! This means that you can read every file on the system that is not root:root owned, e.g. /etc/shadow. But it can get even worse 1/4🧵

Finally, two new options by @Defte_ got merged into NetExec🔥 --qwinsta: Enumerate active sessions on the target, including numerous useful information --tasklist: Well... enumerates all running tasks on the host Update & enjoy the new reconnaissance flags🔎

Generate a valid krb5 conf file directly from netexec 🔥 Not that NXC needs it, but sometimes you gotta help other tools for them to work. 😂

DCsync a domain when you find a user in the Backup Operators group using netexec, very simple and no need for a custom smb server 😛🏆

Few BloodHound python updates: LDAP channel binding is now supported with Kerberos auth (native) or with NTLM (custom ldap3 version). Furthermore, the BH CE collector now has its own pypi package and command. You can have both on the same system with pipx. github.com/dirkjanm/Blo...

GitHub - dirkjanm/BloodHound.py: A Python based ingestor for BloodHound

A Python based ingestor for BloodHound. Contribute to dirkjanm/BloodHound.py development by creating an account on GitHub.

github.com

So you want to exploit ADCS ESC8 with only netexec and ntlmrelayx ? Fear not my friend, I will show you how to do it 👇 NetExec now supports "Pass-the-Cert" as an authentication method, thanks to @dirkjanm.io original work on PKINITtools ⛱️

Crazy and mind blown 🤯 If you have read access to an NFS share, you can basically read all files from the same filesystem. - Research: www.hvs-consulting.de/en/nfs-secur... - Tooling: github.com/hvs-consulti... - 38c3 CTF Writeup: hxp.io/blog/111/hxp... #pentest #nfs

NFS Security: Identifying and Exploiting Misconfigurations

Understand security features, misconfigurations and technical attacks on NFS shares. Explore tools to analyze NFS endpoints and abuse misconfigurations.

hvs-consulting.de

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

Two new modules for MSSQL on NXC, thanks to the contributions of @lodos2005.bsky.social and @adamkadaban.bsky.social 🔥 - rid-brute from mssql - mssql_coerce from mssql github.com/Pennyw0rth/N...